Two-minute brief
NCA Essential Cybersecurity Controls (ECC) requirements explained: video brief
A two-minute brief on the structure of Saudi Arabia's Essential Cybersecurity Controls, ECC-2:2024.
Key takeaways
- ECC-2:2024 has four domains, 28 subdomains, 108 main controls and 92 subcontrols.
- Governance requires a strategy approved by the head of the entity.
- The cybersecurity department must be independent of IT.
- Third-party and cloud computing cybersecurity is its own domain.
- The NCA evaluates compliance; there is no certificate.
Four domains of controls
ECC-2:2024 has 108 main controls and 92 subcontrols in 28 subdomains, grouped in four main domains: Cybersecurity Governance, Cybersecurity Defence, Cybersecurity Resilience, and Third-Party and Cloud Computing Cybersecurity. Each control is numbered by domain and subdomain. This short film walks through the structure.
Cybersecurity Governance has ten subdomains. The first asks for a cybersecurity strategy approved and supported by the head of the entity or a delegate, delivered through an action plan and reviewed at planned intervals. The second asks for cybersecurity management through a department independent of IT, staffed by full-time, qualified Saudi professionals, with a supervisory committee; the evidence is an organisation chart, appointments and minutes. The other governance subdomains cover policies and procedures, roles and responsibilities, risk management, cybersecurity in project and change management, compliance, periodic review and audit, human resources, and awareness and training.
Defence, resilience and third parties
Cybersecurity Defence is the largest domain, with fifteen subdomains covering the technical protections an entity operates, from asset management, identity and access management and protection of systems, email, networks and mobile devices to data protection, cryptography, backup, vulnerability management, penetration testing, event logging and monitoring, incident and threat management, physical security and web application security. Cybersecurity Resilience covers cybersecurity within business continuity. Third-Party and Cloud Computing Cybersecurity covers suppliers and cloud and hosting services.
The controls apply to government agencies in the Kingdom and their affiliated companies, and to private owners, operators and hosts of critical national infrastructure; others are strongly encouraged to adopt them. ECC-2:2024 replaced ECC-1:2018, and the Arabic text is binding. There is no certification; the NCA evaluates compliance through self-assessment, its compliance tool and field audit visits.
ISO/IEC 27001 certification supplies the risk method, policies and many technical controls, but the ECC adds national requirements a certificate does not show, such as a cybersecurity department independent of IT and positions filled with full-time, qualified Saudi cybersecurity professionals. Managed security operations delivered through remote access must be located entirely in the Kingdom, and cloud and hosting providers must protect the entity's data according to its classification and return it in a usable format when the service ends.
NCA ECC (Saudi Arabia) at a glance
- Purpose
- Saudi Arabia's national cybersecurity baseline: minimum requirements that protect national entities' information and technology assets against internal and external threats
- Relevant to
- Government agencies in the Kingdom and their affiliated companies inside and outside it, and private owners, operators and hosts of critical national infrastructure; others are strongly encouraged to adopt the controls
- Edition
- ECC-2:2024, which replaced ECC-1:2018: 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols; the Arabic text is binding
- Certification
- None exists for the ECC. The NCA evaluates compliance through self-assessment, its compliance tool and field audit visits
- Sterling's role
- Scoping and implementation with your team, Effivity, training, internal audit and evaluation readiness, then Sustain™
- Cost and timing
- Total investment for an NCA ECC compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 4 to 10 months
NCA ECC (Saudi Arabia): questions people ask
Is there an NCA ECC certification?
No. The ECC sets controls and the NCA evaluates compliance with them, through self-assessment, its compliance tool and field audit visits. No certificate is provided for, so an "ECC certificate" from a private firm is that firm's own document; an ISO/IEC 27001 certificate from an accredited body is genuine certification of a different standard.
Does the ECC apply to private companies, or to companies outside Saudi Arabia?
Yes, where a private-sector entity owns, operates or hosts critical national infrastructure, and where a company or entity is affiliated to a government agency, whether inside or outside the Kingdom. The NCA strongly encourages every other entity in the Kingdom to use the controls, and suppliers anywhere meet the third-party requirements through their contracts with in-scope entities.
Does ISO/IEC 27001 certification make us ECC compliant?
Not on its own. The two are commonly aligned in practice, and an ISMS supplies the risk method, policies and many technical controls. The ECC adds national requirements a certificate does not show: a cybersecurity department independent of IT, positions filled with qualified Saudi professionals, approvals by the Authorised Official, incident reporting to the NCA, log retention of at least 12 months, in-Kingdom managed monitoring and the National Cryptographic Standards.
What changed between ECC-1:2018 and ECC-2:2024?
The NCA's summary of changes includes: scope extended to affiliated companies inside and outside the Kingdom; the industrial control systems domain moved to the OTCC; "qualified" rather than "experienced" Saudi professionals; multi-factor authentication explicit for privileged accounts; SPF, DKIM and DMARC for e-mail; DDoS protection; data privacy, classification and localisation requirements handed to the National Data Management Office; and cryptography tied to the National Cryptographic Standards.
How does the NCA assess ECC compliance?
By the mechanism it considers appropriate, using means such as self-assessment by the entity, periodic reports from its compliance tool and field audit visits. ECC-2:2024 says the NCA will issue an ECC-2:2024 Assessment and Compliance Tool to organise assessment; ask the NCA which submission it expects from you and when, and keep evidence for every applicable control.
Keep exploring
Related to this video
The complete guide
Everything on NCA ECC (Saudi Arabia)
Start with the NCA ECC (Saudi Arabia) page, or go straight to the guide you need.
On the NCA ECC (Saudi Arabia) page
Often combined with NCA ECC (Saudi Arabia)
More videos: Information security, cyber and cloud
- How to comply with the NIS2 DirectiveCompliance walkthrough · 3 min 15 s
- NIS2 Directive requirements explainedTwo-minute brief · 2 min
- How to implement NIST CSF 2.0Implementation walkthrough · 3 min 15 s
- NIST CSF 2.0 explainedTwo-minute brief · 2 min
- How to implement NIST SP 800-171Implementation walkthrough · 3 min 15 s
- NIST SP 800-171 requirements explainedTwo-minute brief · 2 min
- How to get TISAX labelsImplementation walkthrough · 3 min 15 s
- TISAX requirements explainedTwo-minute brief · 2 min
- How to comply with the UAE IA StandardCompliance walkthrough · 3 min 15 s
Talk to a consultant
Plan your NCA ECC compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice