NCA Essential Cybersecurity Controls for Saudi organisations
NCA ECC-2:2024: who must comply, what it contains, and how it sits beside SAMA
Who the National Cybersecurity Authority's controls apply to, the four domains and 108 main controls of ECC-2:2024, what changed from ECC-1:2018, how compliance is assessed, and how to run one control set when SAMA applies too.
In short
The Essential Cybersecurity Controls (ECC) are the National Cybersecurity Authority's mandatory minimum cybersecurity requirements for Saudi government entities, their affiliates and operators of critical national infrastructure. The current version, ECC-2:2024, is organised into four main domains (governance, defence, resilience, and third-party and cloud) with 108 main controls and 92 subcontrols. NCA evaluates compliance through self-assessment, reports from its compliance tool and on-site audits; there is no certificate.
Who has to comply with NCA ECC?
ECC applies to Saudi government agencies (ministries, authorities, establishments and others), to companies and entities affiliated with them, whether inside or outside the Kingdom, and to private-sector organisations that own, operate or host critical national infrastructure.
Not every control binds every entity. The cloud computing and hosting subdomain (4-2) applies only to organisations that use cloud services or plan to. NCA's implementation guide explains how each control is expected to be met.
- Critical national infrastructure (CNI)
- Assets, systems and networks whose disruption would seriously affect national security, the economy or public services. A private-sector organisation that owns, operates or hosts CNI is in scope of ECC.
- Main control and subcontrol
- ECC states requirements as main controls, some of which are broken down into numbered subcontrols that say more precisely what must be in place.
- OTCC
- NCA's Operational Technology Cybersecurity Controls, for industrial control systems. OTCC-1:2022 makes compliance with ECC a prerequisite.
The four domains of ECC-2:2024
ECC-2:2024 groups its 108 main controls and 92 subcontrols into four main domains and 28 subdomains. Governance and defence carry most of the weight.
| Domain | Subdomains | What it covers |
|---|---|---|
| 1. Cybersecurity governance | 10 | How cybersecurity is directed and managed: strategy, the cybersecurity function, policies, roles, risk, compliance and review |
| 2. Cybersecurity defence | 15 | The technical and operational controls that protect systems, networks, identities and data, detect threats and handle incidents |
| 3. Cybersecurity resilience | 1 | Cybersecurity as part of business continuity |
| 4. Third-party and cloud computing cybersecurity | 2 | Cybersecurity requirements for third parties and for cloud computing and hosting |
The descriptions above summarise each domain. Build your control list from the subdomain and control text in the current English edition of ECC-2:2024 on the NCA site.
What changed from ECC-1:2018 to ECC-2:2024
ECC-1:2018 had five main domains and 114 controls. ECC-2:2024 has four. The fifth domain, which covered industrial control systems, left ECC and now sits in the Operational Technology Cybersecurity Controls (OTCC).
| ECC-1:2018 | ECC-2:2024 | |
|---|---|---|
| Main domains | Five | Four |
| Controls | 114 | 108 main controls and 92 subcontrols |
| Industrial control systems | A domain within ECC | Moved to the OT Cybersecurity Controls (OTCC) |
How NCA assesses compliance
There is no ECC certificate. NCA evaluates compliance in three ways, used alone or together:
- Self-assessment. The organisation assesses its own compliance with each applicable control.
- Periodic reports. Compliance is reported through NCA's compliance tool.
- On-site audits. NCA can audit an organisation's implementation directly.
Whichever route applies, the question is the same: for each control in scope, can you show what is in place and the record that it operates? A self-assessment answer without evidence behind it does not survive an audit.
When SAMA's framework applies as well
Some organisations answer to both regulators. A bank, insurer or other SAMA Member Organization that also owns, operates or hosts critical national infrastructure falls under the SAMA Cyber Security Framework and ECC. So can a company affiliated with a government entity that also provides financial services.
The two frameworks are published separately, in different terminology, and neither defers to the other. SAMA measures maturity on a scale from 0 to 5; ECC asks whether each control is in place. An organisation in scope of both answers two assessments of largely the same controls.
| NCA ECC-2:2024 | SAMA Cyber Security Framework | |
|---|---|---|
| Issued by | National Cybersecurity Authority | Saudi Central Bank |
| Applies to | Government entities, their affiliates and CNI operators | SAMA Member Organizations |
| Structure | Four domains, 28 subdomains, 108 main controls, 92 subcontrols | Four domains, broken into subdomains |
| Measured by | Compliance with each control | Maturity levels 0 to 5, minimum Level 3 |
| Assessment | Self-assessment, NCA compliance tool, on-site audits | Self-assessment reviewed and audited by SAMA |
The workable approach is one set of controls, each traced to the SAMA subdomain and the ECC control it satisfies, with one body of evidence behind them. Confirm that mapping yourself: the two frameworks group requirements differently, and some ECC controls have no direct SAMA counterpart.
Third-party and cloud cybersecurity
Domain 4 makes third parties and cloud providers part of your scope. Its two subdomains cover the cybersecurity requirements you set for third parties and those for cloud computing and hosting, which apply only if you use cloud services or plan to.
- Before onboarding. Decide which third parties touch your systems or data, and set the cybersecurity requirements they must meet.
- In the contract. Write those requirements into the agreement, including what happens when the relationship ends.
- Cloud and hosting. Apply the cloud subdomain's requirements to any cloud or hosting service you use.
- Ongoing. Review third parties during the relationship, not only at the start.
Building an ECC-2:2024 programme
Most organisations start from controls they already run for ISO 27001, NIST CSF or the SAMA framework. The work is confirming scope, mapping those controls to ECC, closing the gaps and keeping evidence that each control operates.
-
01
Confirm scope
Confirm that ECC applies to you, which subdomains bind you (cloud 4-2 only if you use cloud), and whether SAMA or OTCC applies too.
Your CISO and legal or compliance function
-
02
Map existing controls
Trace the controls you already run to the ECC-2:2024 controls they satisfy, and list the ones with no match.
Your compliance team
-
03
Close the gaps
Write and approve missing policies and procedures, assign owners, and put the remaining technical controls in place.
Control owners across the organisation
-
04
Keep evidence current
Collect the records that show each control operating, and refresh them before they go stale.
Control owners, tracked by your compliance team
-
05
Prepare for assessment
Keep the self-assessment and evidence ready for NCA's reporting tool or an on-site audit.
Your compliance function and internal audit
Who does what
ECC is set and assessed by the National Cybersecurity Authority. The organisation owns its controls and its self-assessment; software keeps the record of both.
| Task | Your team | Certifyi | NCA |
|---|---|---|---|
| Cybersecurity governance | Set the strategy, function, policies and roles | Holds policies, owners, approvals and review dates | Reviews governance through assessment and audit |
| Control implementation | Put each applicable control in place and keep it running | Keeps controls, owners and linked evidence together | Assesses compliance with each control |
| Third-party and cloud | Set and check requirements for third parties and cloud services | Holds supplier records and risk assessments, with a vendor portal | Examines third-party and cloud arrangements |
| Self-assessment and reporting | Assess compliance and report it | Holds the controls and evidence your answers rest on | Receives reports and can audit on site |
How Certifyi helps
Run ECC beside the frameworks you already manage
ECC-2:2024 is not in Certifyi's published framework catalogue today. Certifyi does hold the controls, evidence, supplier records and incidents that ECC asks about, alongside the other frameworks you run.
-
One control set across frameworks
Map a control once and reuse the mapping across frameworks such as ISO 27001, NIST CSF and PCI DSS in the unified frameworks module.
-
Third parties and cloud
Take suppliers through intake and risk assessment, and give them their own portal in the vendor risk module instead of email.
-
Risk register
Record cybersecurity risks with likelihood, impact, treatment and owner, with heatmaps.
-
Tamper-evident activity log
Evidence is linked to its control, and every action on it is written to a tamper-evident activity log.
Questions
NCA ECC, answered
What is NCA ECC?
The Essential Cybersecurity Controls are the National Cybersecurity Authority's mandatory minimum cybersecurity requirements for Saudi government entities, their affiliates and operators of critical national infrastructure. The current version is ECC-2:2024.
Who must comply with NCA ECC?
Government agencies, companies and entities affiliated with them (inside and outside the Kingdom), and private-sector organisations that own, operate or host critical national infrastructure. The cloud subdomain applies only to organisations that use or plan to use cloud services.
How many controls are in ECC-2:2024?
ECC-2:2024 has 108 main controls and 92 subcontrols, organised into four main domains and 28 subdomains.
What is the difference between ECC-1:2018 and ECC-2:2024?
ECC-1:2018 had five main domains and 114 controls. ECC-2:2024 has four domains, 108 main controls and 92 subcontrols. The industrial control systems domain moved out of ECC into the OT Cybersecurity Controls (OTCC).
Is there an NCA ECC certification?
No. NCA evaluates compliance through self-assessment, periodic reports through its compliance tool and on-site audits. There is no certificate to obtain.
Does SAMA CSF replace NCA ECC?
No. They are separate frameworks from separate regulators, and neither defers to the other. An organisation in scope of both must meet both, although many of the underlying controls overlap.
How does ECC relate to the OT Cybersecurity Controls?
OTCC-1:2022 covers operational technology and makes compliance with ECC a prerequisite. An organisation running industrial control systems needs ECC in place before OTCC.
Does Certifyi make us ECC compliant?
No. Compliance depends on your controls and NCA's assessment. ECC-2:2024 is not in Certifyi's published catalogue today; Certifyi holds the controls, evidence, supplier records and incidents you manage alongside your other frameworks.
Talk through ECC and SAMA in a 30-minute call.
Bring your ECC self-assessment or your SAMA control set. We will show how your controls, evidence, suppliers and incidents are kept in Certifyi, and what is in the catalogue today.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them