What is NCA ECC?

The Essential Cybersecurity Controls (ECC) are the baseline set of cybersecurity requirements issued by Saudi Arabia’s National Cybersecurity Authority (NCA). The current version is ECC-2:2024, which updates the first version, ECC-1:2018. This guide describes the version in the NCA’s published ECC-2:2024 document. Because the NCA can update its documents, always check the NCA website for the latest text before relying on any summary, including this one.

What the ECC is and who it applies to

According to the NCA’s document, the ECC applies to government agencies in the Kingdom (including ministries, authorities and establishments) and their affiliated companies and entities, inside and outside the Kingdom. It also applies to private sector entities that own, operate or host Critical National Infrastructure. The NCA strongly encourages all other entities in the Kingdom to use the controls to improve their cybersecurity. In other words, the controls are mandatory for entities in the stated scope and encouraged for others.

The document states that each in-scope entity must comply with all the controls that apply to it, and gives an example of how applicability varies: the cloud computing and hosting controls apply to entities that use or plan to use cloud and hosting services.

How the ECC is structured

The introduction of the NCA’s ECC-2:2024 document states that it consists of:

• 4 main domains
• 28 subdomains
• 108 main controls
• 92 subcontrols

The four main domains are Cybersecurity Governance, Cybersecurity Defense, Cybersecurity Resilience, and Third-Party and Cloud Computing Cybersecurity. Governance has ten subdomains, and they include cybersecurity strategy, policies and procedures, risk management, periodical review and audit, and awareness and training.

For example, the governance subdomain on cybersecurity policies and procedures requires that policies and procedures are documented, approved by the authorised official, communicated, implemented, supported by technical security standards, and reviewed at planned intervals. The risk management subdomain requires a documented methodology and says risk assessment is carried out at least at the early stage of technology projects, before major infrastructure changes, when planning to obtain third-party services, and before releasing new technology services and products.

The document also says the ECC controls are linked to relevant national and international legislative and regulatory requirements, which is why many organisations use it as a reference when building one programme that answers several expectations.

How compliance is assessed

The NCA’s document says the NCA evaluates compliance through several means, which it lists as self-assessment by the entity, periodic reports from a compliance tool, and field audit visits, in whatever mechanism the NCA considers appropriate. It also says the NCA will issue an assessment and compliance tool for ECC-2:2024. The NCA’s ECC page links to the document and to a separate implementation guide.

This is not the same as an external certificate. Do not tell a client that they are “ECC certified” unless the NCA has said so. Describe the position accurately: the client has assessed itself against the controls, and has, or has not, met them.

Why it matters for MSPs

Many MSPs and vCISO practices that serve Saudi organisations, or international organisations with Saudi operations, will be asked about the ECC in procurement. Understanding scope is the first step, because the same client can have some systems in scope and others not.

How an MSP or vCISO delivers it

1. Confirm applicability in writing. Work out whether the client falls into the stated scope, and which conditional controls, such as cloud and hosting, apply.
2. Baseline with a gap assessment. Compare current controls to the ECC. Our guide to the gap assessment describes the method.
3. Build the governance documents. The governance domain asks for strategy, policies and procedures, roles, and a risk method. See the policies, standards and procedures guide.
4. Run the risk process. Keep a risk register tied to the ECC risk subdomain.
5. Collect evidence per control. Give each control an owner and an evidence source, so a self-assessment is quick.
6. Review on a schedule. The document asks for ongoing and continuous compliance, so build in recurring reviews.

Our NCA ECC service line guide goes deeper on packaging this as a recurring service. If you are mapping the ECC alongside other frameworks, read about control mapping.

Common mistakes

• Using the first version. ECC-1:2018 was updated by ECC-2:2024. Check which version the client’s regulator or customer expects.
• Assuming every control applies. Applicability depends on the entity’s business and technology, and the reasoning should be recorded.
• Quoting control or domain counts from memory. Counts and structure differ between versions, so verify against the NCA’s document.
• Treating the Arabic and English texts as interchangeable. The document states that the Arabic version is the binding language, so use the Arabic text when the exact wording matters.
• Skipping the third-party domain. Supplier and cloud arrangements are often overlooked, so check them explicitly.
• Calling self-assessment certification. The NCA’s assessment mechanisms are not the same as a third-party certificate.

Where GetCybr fits

If you run ECC readiness for several clients, GetCybr is a platform for holding the control set, owners, evidence and policy links for each client in one place, and for tracking progress through a gap assessment. It does not replace the client’s accountability or the NCA’s own assessment. You can see how the framework is handled on the NCA ECC compliance page.

Sources

• National Cybersecurity Authority (Saudi Arabia), Essential Cybersecurity Controls (ECC) page. Source for the ECC-2:2024 listing and the link to the implementation guide.
• National Cybersecurity Authority (Saudi Arabia), Arabic edition of the ECC page. The Arabic text is the binding language according to the NCA’s disclaimer in the document.
• National Cybersecurity Authority (Saudi Arabia), Essential Cybersecurity Controls (ECC-2:2024) PDF, linked from the NCA page above. Source for the scope, applicability, structure counts (4 domains, 28 subdomains, 108 main controls, 92 subcontrols), subdomain names, assessment means and the examples of policy and risk requirements.