Compliance walkthrough
How to comply with the NCA Essential Cybersecurity Controls (Saudi Arabia): video walkthrough
A walkthrough of implementing Saudi Arabia's Essential Cybersecurity Controls for national entities and preparing for the NCA's evaluation.
Key takeaways
- The ECC sets Saudi Arabia's baseline cybersecurity controls for national entities.
- Government entities and critical infrastructure operators are in scope.
- Governance includes a cybersecurity department independent of IT.
- There is no ECC certificate; the NCA evaluates compliance.
- The Arabic text of ECC-2:2024 is binding.
Saudi Arabia's national cybersecurity baseline
The Essential Cybersecurity Controls set the baseline cybersecurity requirements for national entities in the Kingdom of Saudi Arabia. They are issued by the National Cybersecurity Authority, the national authority in charge of cybersecurity in the Kingdom, and provide minimum requirements, drawn from best practices and standards, that reduce internal and external cybersecurity threats and safeguard the information and technology assets of national entities.
The ECC is a set of controls rather than a management system standard. Every entity in scope complies with all the controls that apply to it, continuously, and there is no certificate: the NCA evaluates compliance through self-assessment, its compliance tool and field audit visits. This short film walks through how an entity implements the controls.
Scope, build and operate, then evaluation
Establish which controls apply: the entity's category, the systems and services in scope, any cloud or hosting use, and whether other NCA control sets also apply. Government agencies, their affiliated companies and private owners, operators and hosts of critical national infrastructure are in scope, and other organisations are strongly encouraged to adopt the controls.
A gap analysis against each applicable control then guides implementation across the four main domains. Cybersecurity governance comes first: a strategy approved by the head of the entity and delivered through an action plan, a cybersecurity department independent of IT staffed by qualified Saudi professionals with a supervisory committee, and the policies, roles, risk management and compliance processes that support them. Cybersecurity defence, resilience, and third-party and cloud computing cybersecurity follow, each with evidence. Controls are then operated continuously, and the entity prepares for the NCA's self-assessments, compliance tool reports and field visits. Whether the controls meet the ECC is for the NCA to decide; the Arabic text is binding.
Sterling's expert and experienced consultants carry the scoping and implementation with your team under Sterling OS™, with the evidence held in Effivity. ECC-2:2024 replaced ECC-1:2018.
NCA ECC (Saudi Arabia) at a glance
- Purpose
- Saudi Arabia's national cybersecurity baseline: minimum requirements that protect national entities' information and technology assets against internal and external threats
- Relevant to
- Government agencies in the Kingdom and their affiliated companies inside and outside it, and private owners, operators and hosts of critical national infrastructure; others are strongly encouraged to adopt the controls
- Edition
- ECC-2:2024, which replaced ECC-1:2018: 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols; the Arabic text is binding
- Certification
- None exists for the ECC. The NCA evaluates compliance through self-assessment, its compliance tool and field audit visits
- Sterling's role
- Scoping and implementation with your team, Effivity, training, internal audit and evaluation readiness, then Sustain™
- Cost and timing
- Total investment for an NCA ECC compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 4 to 10 months
NCA ECC (Saudi Arabia): questions people ask
Is there an NCA ECC certification?
No. The ECC sets controls and the NCA evaluates compliance with them, through self-assessment, its compliance tool and field audit visits. No certificate is provided for, so an "ECC certificate" from a private firm is that firm's own document; an ISO/IEC 27001 certificate from an accredited body is genuine certification of a different standard.
Does the ECC apply to private companies, or to companies outside Saudi Arabia?
Yes, where a private-sector entity owns, operates or hosts critical national infrastructure, and where a company or entity is affiliated to a government agency, whether inside or outside the Kingdom. The NCA strongly encourages every other entity in the Kingdom to use the controls, and suppliers anywhere meet the third-party requirements through their contracts with in-scope entities.
Does ISO/IEC 27001 certification make us ECC compliant?
Not on its own. The two are commonly aligned in practice, and an ISMS supplies the risk method, policies and many technical controls. The ECC adds national requirements a certificate does not show: a cybersecurity department independent of IT, positions filled with qualified Saudi professionals, approvals by the Authorised Official, incident reporting to the NCA, log retention of at least 12 months, in-Kingdom managed monitoring and the National Cryptographic Standards.
What changed between ECC-1:2018 and ECC-2:2024?
The NCA's summary of changes includes: scope extended to affiliated companies inside and outside the Kingdom; the industrial control systems domain moved to the OTCC; "qualified" rather than "experienced" Saudi professionals; multi-factor authentication explicit for privileged accounts; SPF, DKIM and DMARC for e-mail; DDoS protection; data privacy, classification and localisation requirements handed to the National Data Management Office; and cryptography tied to the National Cryptographic Standards.
How does the NCA assess ECC compliance?
By the mechanism it considers appropriate, using means such as self-assessment by the entity, periodic reports from its compliance tool and field audit visits. ECC-2:2024 says the NCA will issue an ECC-2:2024 Assessment and Compliance Tool to organise assessment; ask the NCA which submission it expects from you and when, and keep evidence for every applicable control.
Keep exploring
Related to this video
The complete guide
Everything on NCA ECC (Saudi Arabia)
Start with the NCA ECC (Saudi Arabia) page, or go straight to the guide you need.
On the NCA ECC (Saudi Arabia) page
Often combined with NCA ECC (Saudi Arabia)
More videos: Information security, cyber and cloud
- How to comply with the NIS2 DirectiveCompliance walkthrough · 3 min 15 s
- NIS2 Directive requirements explainedTwo-minute brief · 2 min
- How to implement NIST CSF 2.0Implementation walkthrough · 3 min 15 s
- NIST CSF 2.0 explainedTwo-minute brief · 2 min
- How to implement NIST SP 800-171Implementation walkthrough · 3 min 15 s
- NIST SP 800-171 requirements explainedTwo-minute brief · 2 min
- How to get TISAX labelsImplementation walkthrough · 3 min 15 s
- TISAX requirements explainedTwo-minute brief · 2 min
- How to comply with the UAE IA StandardCompliance walkthrough · 3 min 15 s
Talk to a consultant
Plan your NCA ECC compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice