NCA ECC · Essential Cybersecurity Controls, Kingdom of Saudi Arabia

NCA ECC compliance consulting for cybersecurity controls that hold up when the NCA evaluates them.

Meet Saudi Arabia's Essential Cybersecurity Controls on the terms the National Cybersecurity Authority sets: ECC-2:2024 scoped to each entity, a cybersecurity department independent of IT, policies approved by your Authorised Official, the applicable controls operating across the four domains, and evidence ready for a self-assessment, the compliance tool or a field audit visit. Sterling's expert and experienced consultants work with your cybersecurity and IT teams, build the evidence control by control and stay with you after go-live, in 60+ countries. We ensure a successful NCA ECC compliance programme for our clients.

Book a free discovery call Start the free readiness check

Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
A team of expert and experienced cybersecurity governance consultants, advising on management systems across sectors and countries since 2003
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling builds the controls, the governance and the evidence; compliance is assessed by the National Cybersecurity Authority

NCA ECC at a glance

Purpose: Saudi Arabia's national cybersecurity baseline: minimum requirements that protect national entities' information and technology assets against internal and external threats
Relevant to: Government agencies in the Kingdom and their affiliated companies inside and outside it, and private owners, operators and hosts of critical national infrastructure; others are strongly encouraged to adopt the controls
Edition: ECC-2:2024, which replaced ECC-1:2018: 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols; the Arabic text is binding
Certification: None exists for the ECC. The NCA evaluates compliance through self-assessment, its compliance tool and field audit visits
Sterling's role: Scoping and implementation with your team, Effivity, training, internal audit and evaluation readiness, then Sustain™
Cost and timing: Total investment for an NCA ECC compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 4 to 10 months

8,100+ client engagements in 60+ countries.

NCA ECC client experience

What it is

What is NCA ECC and what is it used for?

The Essential Cybersecurity Controls (ECC) set the baseline cybersecurity requirements for national entities in the Kingdom of Saudi Arabia. They are issued by the National Cybersecurity Authority (NCA), the national authority in charge of cybersecurity in the Kingdom and its national reference, and they aim to provide minimum requirements, drawn from best practices and standards, that reduce internal and external cybersecurity threats and safeguard the information and technology assets of national entities.

The ECC is a set of controls rather than a management system standard. Every entity in scope complies with all the controls that apply to it, continuously, and the NCA evaluates it through means such as self-assessment, periodic reports from its compliance tool and field audit visits, by the mechanism it judges appropriate. In practice the controls make cybersecurity a function of its own: a department separate from IT, a strategy supported by the head of the entity, policies approved by the Authorised Official and evidence behind each control.

Current version. ECC-2:2024 is the second edition and replaced ECC-1:2018. It consists of 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols; the first edition's fifth domain, for industrial control systems, now sits in the Operational Technology Cybersecurity Controls (OTCC-1:2022). The Arabic text is binding on meaning and interpretation. The NCA's ECC page publishes no transition timetable from the first edition; confirm any date that applies to your entity with the NCA directly.

Who it is for

Who needs to comply with NCA ECC?

Scope under the ECC depends on the kind of entity you are, not its size. The controls apply to government agencies in the Kingdom, including ministries, authorities and establishments, and their affiliated companies and entities inside and outside it, and to every private-sector entity that owns, operates or hosts critical national infrastructure; the NCA strongly encourages all other entities in the Kingdom to use them. Organisations come to Sterling from four starting points:

You are a government agency, or one of its companies. ECC-2:2024 names affiliated companies and entities outside the Kingdom as well as inside it, so a subsidiary abroad may now be in scope. The first deliverable is an applicability decision per entity.
You own, operate or host critical national infrastructure. A private operator of critical infrastructure, or the provider hosting it, complies with every applicable control; for national critical systems, the NCA's CSCC extends the ECC.
A government or infrastructure customer writes the ECC into your contract. Third-party controls call for non-disclosure, secure data removal at the end of service, agreed incident communication and, for remote managed monitoring, a centre located entirely in the Kingdom. Suppliers answer those clauses before they win or renew the work.
You sit outside the mandatory scope, or hold ISO/IEC 27001, and want the national baseline. Adopting the controls voluntarily gives Saudi customers a yardstick they already use; a certified ISMS helps, but on its own it does not show the national requirements.

Business benefits

How NCA ECC compliance protects services and strengthens oversight

The value is sharpest where a failure would be public: a ransomware outage in a government service, a breach through a contractor's remote access, an incident the NCA hears about from someone else. We design the programme around those events and give each applicable control an owner and a record.

Ready whenever the NCA evaluatesSelf-assessments, tool submissions and field audit visits served from one evidence set, kept current instead of rebuilt.
A cybersecurity department with authorityA department independent of IT, a strategy the head of the entity supports and a supervisory committee, so decisions on cyber risk have a home.
Incidents handled and reported to the NCADetection, response and reporting procedures, with incident information and threat intelligence shared with the NCA as the controls require.
Contractors held to your controlsNon-disclosure, secure data removal at exit and incident communication written into contracts, and managed monitoring kept inside the Kingdom.
Services that recoverBackups whose recovery is tested, DDoS protection and the cybersecurity aspects of business continuity rehearsed, not assumed.
One control set for the NCA and your certificationsThe ECC, ISO/IEC 27001 and the NCA's cloud, data and OT controls mapped once, so a new requirement adds a layer rather than a project.

Track a few indicators: applicable controls with evidence, MFA coverage of privileged accounts, log retention against the 12-month minimum, restore tests passed and cybersecurity positions filled. A longer policy list proves nothing.

Requirements

What are the main NCA ECC requirements?

ECC-2:2024 has 108 main controls and 92 subcontrols in 28 subdomains, grouped in four main domains: Cybersecurity Governance (subdomains 1-1 to 1-10), Cybersecurity Defence (2-1 to 2-15), Cybersecurity Resilience (3-1) and Third-Party and Cloud Computing Cybersecurity (4-1 and 4-2). Each control is numbered by domain and subdomain, 1-2-1 for example. The table is a plain-language map; your implementation is checked against the Arabic text and each applicable control, one by one, during the programme.

Subdomain	What it requires of you	Typical evidence
1-1 Cybersecurity Strategy	A strategy approved and supported by the head of the entity or a delegate, delivered through an action plan and reviewed at planned intervals	Strategy, action plan, reviews
1-2 Cybersecurity Management	A department independent of IT, staffed by full-time, qualified Saudi professionals, with a supervisory committee	Organisation chart, appointments, minutes
1-3 Cybersecurity Policies and Procedures	Policies and procedures documented by the department and approved by the Authorised Official	Approved, versioned policy set
1-4 Cybersecurity Roles and Responsibilities	Roles and responsibilities defined and assigned	Approved responsibility matrix
1-5 Cybersecurity Risk Management	An approved methodology; assessments early in technology projects, before major changes, when planning third-party services and before new services launch	Risk register, dated assessments
1-6 Cybersecurity in Information and Technology Project Management	Security requirements built into technology projects	Security sign-offs in project records
1-7 Compliance with Cybersecurity Standards, Laws and Regulations	Compliance with the national cybersecurity requirements that apply	Register of applicable requirements
1-8 Periodical Cybersecurity Review and Audit	Periodic review by the department; independent review and audit by parties outside it	Review and audit reports, actions
1-9 Cybersecurity in Human Resources	Security and non-disclosure clauses in employment contracts; screening or vetting for cybersecurity and privileged technical roles	Contract clauses, vetting records
1-10 Cybersecurity Awareness and Training Programme	An awareness programme through several channels, developed periodically and approved	Programme plan, completion records
2-1 Asset Management	Information and technology assets identified and managed	Asset inventory with owners
2-2 Identity and Access Management	Access control, with multi-factor authentication now explicit for privileged accounts	Access reviews, MFA coverage
2-3 Information Systems and Information Processing Facilities Protection	Systems and processing facilities protected	Hardening, patch and malware status
2-4 Email Protection	E-mail protected, with domain validation by SPF, DKIM and DMARC	DNS records, filtering reports
2-5 Networks Security Management	Networks secured, now including protection against DDoS attacks	Network diagrams, DDoS protection
2-6 Mobile Devices Security	Mobile devices that reach entity data secured	Device management records
2-7 Data and Information Protection	Data protected; privacy and classification detail now referred to the National Data Management Office	Controls matched to classification
2-8 Cryptography	Cryptography in line with the NCA's National Cryptographic Standards	Cryptography standard, key records
2-9 Backup and Recovery Management	Backups, with recovery effectiveness tested periodically	Restore test results
2-10 Vulnerabilities Management	Technical vulnerabilities identified and treated	Scan and remediation records
2-11 Penetration Testing	Periodic tests whose scope includes every service offered over the internet	Test and retest reports
2-12 Cybersecurity Event Logs and Monitoring Management	Events logged and monitored, with logs kept for at least 12 months	Log sources, retention settings
2-13 Cybersecurity Incident and Threat Management	Incidents reported to the NCA; notifications, threat intelligence, indicators and incident reports shared with it	Incident log, NCA reports
2-14 Physical Security	Premises and equipment protected from unauthorised access	Access and visitor records
2-15 Web Application Security	Web applications protected	Security settings, test results
3-1 Cybersecurity Resilience Aspects of Business Continuity Management (BCM)	Cybersecurity built into business continuity management	Plans with cyber scenarios, exercises
4-1 Third-Party Cybersecurity	Non-disclosure, secure data removal at the end of service and incident communication in contracts; managed monitoring centres using remote access located entirely in the Kingdom	Contract clauses, SOC location
4-2 Cloud Computing and Hosting Cybersecurity	For entities using or planning cloud and hosting: data protected by classification and returned in a usable format when the service ends	Cloud register, exit terms

What does useful NCA ECC evidence look like?

An applicability decision per entity; the supported strategy; the department's structure and appointments; policies with the Authorised Official's approval; a register of every applicable control with owner, status and proof; dated risk assessments; MFA coverage, retained logs, restore tests and penetration test reports; the incident log with its NCA reports; supplier clauses; review and audit reports. We build them from your real systems and keep them in Effivity from the first workshop, so a field audit visit finds controls in operation.

NCA ECC requirements explained, control by control

Compliance process

How do you become NCA ECC compliant?

Controls are scoped, built and operated first; the NCA evaluates them afterwards. Sterling designs and builds the controls with your team. Whether they meet the ECC is for the NCA to decide, through the self-assessments, tool reports and field visits it chooses; no consultant's report substitutes for that.

01
Establish which controls apply to you.Each entity's category, the systems and services in scope, any cloud or hosting use under subdomain 4-2, and whether the NCA's cloud, data, critical-systems or operational-technology controls also apply.
02
Gap analysis: test your current position against ECC-2:2024.Each applicable main control and subcontrol is compared with your policies, configurations and records; programmes built on ECC-1:2018 are re-baselined; effective practice is kept, and actions get owners and dates.
03
Implement the controls and record the evidence as you go.The department and committee, the strategy and policies with their approvals, MFA, logging and retention, backup testing, penetration tests, supplier clauses and the awareness programme.
04
Review, audit and close the findings.A review by the cybersecurity department, an independent audit by people outside it and a rehearsal of the self-assessment; we raise findings before the NCA does and close them with evidence.
05
Complete the NCA's compliance evaluation.Submit the self-assessment or compliance-tool report the NCA asks for, host any field audit visit and answer its observations from an evidence set that already exists.
06
Keep compliance continuous.Strategy and policies reviewed at planned intervals, risk assessed at each trigger, backups and defences tested periodically, awareness renewed and each NCA update absorbed.

Judge an offer by what it leaves behind: who decides which controls apply and on what evidence, how each control is tested against your own systems, who prepares the self-assessment and where the evidence will live. The ECC offers no certificate; the NCA evaluates controls in operation, not badges. How to choose a credible NCA ECC provider · The certification buyer's checklist

Cost

How much does NCA ECC compliance cost?

An ECC programme is priced by the entities and systems in scope, the state of the cybersecurity department and how much technology has to change. A government company with a working ISO/IEC 27001 ISMS and a staffed department starts far nearer the line than an infrastructure operator building the department and the monitoring from nothing. Every Sterling proposal lists the components and states everything that is included.

Cost component	What affects it
Consulting and implementation	Entities and systems in scope, current maturity, the related NCA controls that also apply, deliverables, and how much of the work your team carries (Design™ or Drive™)
Independent testing and audit	Penetration testing, independent audit where it is not carried out in-house, and any ISO/IEC 27001 certification you choose, each shown separately
Internal resources and remediation	Time from cybersecurity, IT, legal, procurement and HR, recruitment for cybersecurity positions, and missing technology such as MFA, log retention, backup, DDoS protection or encryption
Software and learning	Included in a Sterling engagement: Effivity for the programme and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal
Continued support	Periodic reviews, independent audits, self-assessment updates, refresher learning and new NCA versions under Sustain™

What moves the price

Entities in scope, including affiliated companies outside the Kingdom
Whether the NCA's cloud, OT, critical-systems or data controls apply as well
Whether a cybersecurity department and an ISO/IEC 27001 ISMS already exist
Technical gaps in MFA, logging, backup, penetration testing or supplier control
An NCA request, a contract date or a field audit visit already on the calendar

What a Sterling proposal always shows

Deliverables, responsibilities, assumptions and exclusions, in writing
Testing, audit, certification and legal fees identified separately, so the full programme cost is comparable
Effivity, training and Academy access itemised at no additional cost
Payment milestones tied to deliverables, not to the calendar
One all-inclusive proposal. No surprises, ever

Timeline

How long does NCA ECC compliance take?

Allow four to ten months for a programme that operates and can show its evidence. Four is realistic with a staffed cybersecurity department, a working ISO/IEC 27001 ISMS and tested incident handling; ten is closer where the department must be created and filled, policies written and approved, and logging, MFA, backup testing or supplier clauses built from scratch. The applicability decision, the department and the Authorised Official's approvals come first, each a dated milestone in Effivity.

Phase	What determines the pace
Scope and gap analysis	Entity information for the applicability decision, and access to IT, security and supplier records
Build and implementation	Approvals by the Authorised Official, recruitment for cybersecurity positions, technical changes and contract renewals
Evidence and review	Controls operating long enough to leave records, the department's review, an independent audit and a rehearsal of the self-assessment
NCA compliance evaluation	The mechanism and timetable the NCA chooses: self-assessment, compliance-tool reporting or a field audit visit

If the NCA has written to you, or a customer has set a date, bring it to the first call. We will say what can be in place by then and which decisions your leadership must take in the first two weeks. ECC compliance promised within days, before anyone has seen your systems, is a sales line, not a plan.

Challenges

Common NCA ECC implementation challenges

ECC programmes tend to slow down at the same five points. Each has a workable answer.

Cybersecurity still sits inside the IT department.

Control 1-2-1 asks for a cybersecurity department independent of IT and communications. We set out the structure, mandate and interfaces with IT for leadership to decide, then record the decision and the appointments.

Cybersecurity positions are hard to fill with qualified Saudi professionals.

Control 1-2-2 expects cybersecurity positions to be filled with full-time, qualified Saudi professionals. A staffing plan with role profiles, qualification criteria and a hand-over from external support to your own people makes progress measurable.

Controls exist, but nobody can show the evidence control by control.

A compliance register lists every applicable main control and subcontrol with its owner, status and proof, so a self-assessment becomes an export and a field audit visit a walk through records.

Suppliers and the managed SOC were contracted before ECC-2:2024.

Contracts are reviewed at renewal for non-disclosure, secure data removal and incident communication; managed monitoring that relies on remote access is checked against the in-Kingdom requirement; and new suppliers are risk-assessed while their services are being planned.

Cloud, OT and critical systems bring further NCA controls.

The OTCC, CSCC and DCC extend the ECC for industrial control systems, national critical systems and data, and the CCC adds cloud requirements for providers and tenants. One control library with a layer for each keeps the evidence in one place.

Your engagement

What your NCA ECC engagement includes

The agreed scope brings together what a working ECC programme and a prepared team need, delivered by one team for one all-inclusive proposal.

Applicability, gap analysis and implementation plan
Entities and applicable controls confirmed, related NCA controls identified, the gap measured against ECC-2:2024, and actions, owners and dates agreed before work starts.
Strategy, department, policies and procedures
The strategy and action plan, the department's structure and committee, and policies and procedures per applicable subdomain, on Sterling's template sets adapted to your systems.
Effivity ISO & GRC software
Your programme runs in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit and management review
Conducted or facilitated as agreed, by people independent of the work they review, with findings closed with evidence before the NCA evaluates.
Evaluation readiness and support
Self-assessment and compliance-tool submissions prepared with you, rehearsal for a field audit visit, and support through ISO/IEC 27001 certification if you pursue it.

Compliance is evaluated by the National Cybersecurity Authority. Sterling provides consulting, not legal advice.

How we deliver

How Sterling supports your NCA ECC implementation

Each ECC engagement runs on Sterling OS™, our delivery operating system, in five phases with named deliverables, decision owners and evidence. Your team's capacity sets how much Sterling carries; the method, the software and the accountability stay fixed.

01
Design™Guided implementation: your cybersecurity department builds the controls with Sterling's structure, templates, workshops and coaching.
02
Drive™Fully managed consulting: Sterling consultants take on the applicability, policy, supplier and evidence work alongside your teams.
03
Sustain™After go-live: periodic reviews, independent audits, self-assessment updates and refreshers, year after year.
04
Automate™The programme in Effivity: entities, controls, risks, incidents, suppliers, reviews and approvals in one workspace.
05
Revise™New ECC versions and NCA controls, the move from ECC-1:2018, and changes in your entities, systems or cloud use.

In the first week we agree the engagement team, the weekly working session, the deliverables and which decisions go to the Authorised Official; progress is tracked against them, so a slipping control surfaces early.

How Sterling OS™ works

Often combined with

Standards organisations pair with NCA ECC (Saudi Arabia)

Effivity · NCA ECC compliance software, included in every engagement

How Effivity helps you fulfil, automate and simplify the requirements of NCA ECC-2:2024.

Every Sterling ECC engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the workspace within the agreed scope, so controls with their owners and evidence, risks, approvals, incidents and NCA reports, suppliers, recovery tests, training and audits sit together, and a field audit visit finds a programme in daily use. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.

Included in every engagement See Effivity

Effivity: Context of the Organisation dashboard with issues, interested parties and scope — Effivity · Context of the Organisation dashboard

Cybersecurity Management

Department, positions and supervisory committee

The department's structure and independence from IT, each position with its holder and qualifications, and the committee's decisions, kept as records, not memories.

Cybersecurity Policies and Procedures

Policies with the Authorised Official's approval

Every policy and procedure with version, approval and next review date, so the version in use is the approved one.

Cybersecurity Risk Management

Risk assessments at every trigger

A methodology and risk register, with assessments raised when a project starts, a major change is planned, a third-party service is sought or a new service nears launch.

Periodical Cybersecurity Review and Audit

Department reviews and independent audits

Periodic reviews by the department and independent audits by parties outside it, with findings tracked to closure.

Cybersecurity Incident and Threat Management

Incidents, NCA reports and threat intelligence

An incident workflow from detection to closure, with each report to the NCA and each item of shared threat intelligence kept as evidence.

Cybersecurity Resilience

Continuity, backups and recovery tests

Continuity plans with cyber scenarios, backup schedules and the periodic recovery tests that prove them, linked to the services they protect.

Third-Party and Cloud Computing Cybersecurity

Suppliers, managed services and cloud providers

A register of third parties and cloud services with contract clauses, risk assessments, SOC location and exit terms, reviewed at each renewal.

Across the programme

Control register, assets, access and training

Every applicable ECC control with owner, status and proof; the asset inventory, access reviews and awareness records linked to Sterling Academy; forms and reports adapted to your work, without code.

What this means at the audit

A field audit visit or a self-assessment comes down to specific records: approved strategy and policies, the department's structure, risk assessments, the incident log and its reports, restore tests, penetration test results, supplier clauses and the independent audit. In Effivity each is a screen with dates, owners and evidence attached. Sustain™ continues in the same workspace, so the next evaluation meets a programme that has kept running.

Effivity for NCA ECC: the guide Effivity ISMS on effivity.com

In your engagement

Subscription included with the engagement, at no additional cost
Configured by your Sterling consultant within the agreed scope
Your control register, policies and records migrated, not retyped
Admin and user training for your team
Modules for ISMS, BCMS, PIMS, QMS and more when you integrate other standards

NCA ECC client experience

Client letters on file, available on request.

Client feedback wall: letters on file

Signed client letters for NCA ECC are available on request. The client feedback wall lists every letter by standard.

Programmes with NCA ECC in scope

How the ECC fits beside certified standards.

All case studies

01
Government-owned companies and infrastructure operators: ECC, ISO/IEC 27001 and continuity as one programme
How a programme of this kind runs: an ISO/IEC 27001 ISMS provides the risk method, the management cycle and many technical controls; ISO 22301 carries the resilience aspects of business continuity; the ECC layer adds the independent department and its Saudi staffing, the Authorised Official's approvals, incident reporting to the NCA, 12-month log retention and in-Kingdom managed monitoring, with the OTCC or CCC where plants or cloud services are in scope, on one evidence base and one audit calendar.
Integrated management systems

Sterling Academy · NCA ECC e-learning

Train every employee on NCA ECC, not just the cybersecurity department.

Subdomain 1-10 asks for a cybersecurity awareness programme delivered through several channels and developed periodically, and 1-9 writes cybersecurity responsibilities into employment contracts. Sterling Academy delivers e-learning for the whole workforce and for the people who run the programme: video lessons with checkpoints, a final exam and a numbered Certificate of Completion per learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.

NCA ECC awareness for every employee, one channel of the programme subdomain 1-10 asks for
Practitioner courses for the cybersecurity department, risk owners and incident handlers
Internal auditor training for the people who will audit the controls, as applicable to your standard, as part of the engagement
Completion reports by department, ready for a self-assessment or a field audit visit
New joiners trained on arrival, so awareness evidence never lapses
A Sterling consultant on hand when a learner has a question

Where we work

Where Sterling delivers NCA ECC (Saudi Arabia)

NCA Essential Cybersecurity Controls in Saudi Arabia

Keep exploring

Explore more about NCA ECC (Saudi Arabia)

Watch a video on how to comply with NCA ECC here.
Watch a video on NCA ECC requirements here.

NCA ECC resources

Services for NCA ECC (Saudi Arabia)

Why Sterling

Want successful NCA ECC compliance? Come to Sterling.

Whether the ECC applies to one government company in Riyadh or to a group with affiliates abroad, Sterling builds one control set with a national layer for the NCA, so a new entity, NCA control or contract clause extends the programme instead of starting another.

In 60+ countries since 2003

Security, continuity and quality programmes for technology and service providers, BPOs, manufacturers and public bodies, with one engagement team accountable across every country involved.

All-inclusive proposal

Consulting, Effivity, training and Academy access in one proposal, with testing, audit and certification fees shown separately. No surprises, ever.

Controls your teams can operate

Controls sized to your systems, procedures that match how incidents, access and suppliers are really handled, and software that keeps the proof, so compliance becomes routine rather than a scramble before an NCA visit.

Expert and experienced consultants

Consultants with management system consulting across sectors and countries since 2003, who build the ECC controls right the first time, so the NCA's evaluation confirms what already operates.

Sterling vs the rest: the full comparison Explore NCA ECC client experience

The Sterling Promise

What our NCA ECC compliance success guarantee means

100%on-time completion · success · 8,100+ client engagements

We stay with you until the agreed ECC programme outcome is reached: applicability decided, the department and committee in place, policies approved, applicable controls operating with evidence and the self-assessment prepared, so your team can face an NCA evaluation, a customer's questions or an incident. Clear explanations, included software and workforce learning make the result a capability you keep.

The engagement records the entities, applicable controls, outcome and responsibilities. Your organisation provides accurate information, access to the systems and suppliers in scope, and the people and decisions the controls require. The National Cybersecurity Authority evaluates compliance; legal interpretation remains with your legal advisers. Our commitment covers the agreed programme support; it is neither legal advice nor a guarantee that no incident will occur.

After the programme is in place

What happens after NCA ECC compliance?

The ECC asks for ongoing and continuous compliance. The strategy is reviewed at planned intervals and when legislation changes; risk is reassessed at each new project, major change or supplier decision; penetration and recovery tests recur; the awareness programme is refreshed; and the NCA evaluates by the means it chooses. It also reviews and updates the controls periodically.

Under Sterling OS™ Sustain™ we run that cycle with you: the department's periodic review, the independent audit, self-assessment updates, supplier and cloud reviews at renewal, refresher learning and a watch on new NCA versions, so the programme stays current.

FAQs

Frequently asked questions about NCA ECC

Is there an NCA ECC certification?

No. The ECC sets controls and the NCA evaluates compliance with them, through self-assessment, its compliance tool and field audit visits. No certificate is provided for, so an "ECC certificate" from a private firm is that firm's own document; an ISO/IEC 27001 certificate from an accredited body is genuine certification of a different standard.

Does the ECC apply to private companies, or to companies outside Saudi Arabia?

Yes, where a private-sector entity owns, operates or hosts critical national infrastructure, and where a company or entity is affiliated to a government agency, whether inside or outside the Kingdom. The NCA strongly encourages every other entity in the Kingdom to use the controls, and suppliers anywhere meet the third-party requirements through their contracts with in-scope entities.

Does ISO/IEC 27001 certification make us ECC compliant?

Not on its own. The two are commonly aligned in practice, and an ISMS supplies the risk method, policies and many technical controls. The ECC adds national requirements a certificate does not show: a cybersecurity department independent of IT, positions filled with qualified Saudi professionals, approvals by the Authorised Official, incident reporting to the NCA, log retention of at least 12 months, in-Kingdom managed monitoring and the National Cryptographic Standards.

What changed between ECC-1:2018 and ECC-2:2024?

The NCA's summary of changes includes: scope extended to affiliated companies inside and outside the Kingdom; the industrial control systems domain moved to the OTCC; "qualified" rather than "experienced" Saudi professionals; multi-factor authentication explicit for privileged accounts; SPF, DKIM and DMARC for e-mail; DDoS protection; data privacy, classification and localisation requirements handed to the National Data Management Office; and cryptography tied to the National Cryptographic Standards.

How does the NCA assess ECC compliance?

By the mechanism it considers appropriate, using means such as self-assessment by the entity, periodic reports from its compliance tool and field audit visits. ECC-2:2024 says the NCA will issue an ECC-2:2024 Assessment and Compliance Tool to organise assessment; ask the NCA which submission it expects from you and when, and keep evidence for every applicable control.

Do cybersecurity positions have to be filled by Saudi professionals?

Control 1-2-2 of ECC-2:2024 states that cybersecurity positions are to be filled with full-time, qualified Saudi cybersecurity professionals, and control 1-2-1 places them in a department independent of IT. Entities in scope plan recruitment, qualification and the hand-over from any external support around that requirement; the Arabic text governs its interpretation.

We use cloud services. Which controls apply?

Subdomain 4-2 binds entities that use or plan to use cloud computing and hosting services: providers must protect the entity's data according to its classification and return it in a usable format at the end of the service. The NCA's Cloud Cybersecurity Controls (CCC-2:2024) add minimum requirements for cloud service providers and cloud service tenants.

Can our managed SOC or security provider operate from outside the Kingdom?

Not where it delivers monitoring and operations through remote access: control 4-1-3 requires such managed service centres to be located entirely in the Kingdom. Separately, the NCA requires any entity providing cybersecurity solutions, services or products in the Kingdom to register with it, and issues licences for managed security operations centre services in two tiers, with only Tier 1 able to serve government and critical infrastructure entities. The NCA publishes both lists.

What do you need to prepare an NCA ECC proposal?

The entities involved and how each relates to government or critical infrastructure, the systems and services in scope, any cloud or OT use, whether a cybersecurity department and an ISO/IEC 27001 ISMS exist, and any NCA or customer date. That is enough for a scoped, all-inclusive proposal; there is no need to finish an applicability analysis first.

Before the first call

Prepare a useful NCA ECC readiness brief

No applicability analysis is needed before the first call; an account of your entities, systems and who is asking will do. Seven questions:

Which entities are involved, and is each a government agency, an affiliated company, an owner, operator or host of critical national infrastructure, or none of these?
Which systems and services are in scope, and which are internet-facing, cloud-hosted or industrial control systems?
Does a cybersecurity department exist, separate from IT, and how are its positions filled today?
Who is asking: the NCA, a government customer, a contract clause, your board or an insurer?
What exists already: ISO/IEC 27001, ISO 22301, an ECC-1:2018 self-assessment, incident procedures, supplier security clauses?
Who is your Authorised Official, and who from IT, legal, procurement and HR can give time?
Is there an NCA request, a field audit visit, a contract renewal or another date to plan around?

These answers let us scope the work and fix a realistic fee. They open a discussion; they are not a scored assessment or a legal opinion on applicability.

Don’t be fooled by certification scams

If it takes ten days, it is not NCA ECC compliance.

The ECC provides for no certificate, yet "ECC certified" badges, ten-day packages and translated policy sets with another entity's name still inside are all on offer. They cost less than a programme until a field audit visit asks for the incident reports or the Authorised Official's approvals.

How to choose a credible NCA ECC provider

Ask for the deliverables by name: the applicability decision, the department and committee, approved policies, operating controls and the evidence for each applicable control.
Ask what an "ECC certificate" is supposed to prove. The NCA evaluates compliance itself; the controls provide for no certificate. Genuine certification, such as ISO/IEC 27001 from an accredited body, supports the programme under its own name.
Check the NCA's published lists. Anyone providing cybersecurity solutions, services or products in the Kingdom must register with the NCA, and a managed security operations centre needs the licence tier your entity requires.
Ask where managed monitoring will run. A SOC that serves an in-scope entity through remote access must be located entirely in the Kingdom.
Confirm the version. Packs written for ECC-1:2018 miss the second edition's changes and still treat industrial control systems as an ECC domain.
Walk away from "ECC compliant in ten days", "NCA-approved" seals and template packs sold as compliance. The controls ask for a department, approvals and evidence that operate; paperwork alone supplies none of them.

All ten warning signs of shortcut compliance

What a credible NCA ECC compliance programme always involves

A written applicability decision for each entity, including affiliates abroad
A cybersecurity department independent of IT, with its positions and committee in place
A strategy and policies approved at the level the controls require
Every applicable ECC-2:2024 control implemented, with evidence
Incidents reported to the NCA, and logs kept for at least 12 months
Periodic review by the department and audit by independent parties
Evidence ready for a self-assessment, a tool report or a field audit visit

Sterling's position. Sterling does not certify, evaluate compliance or speak for the NCA. We build the controls, the governance and the evidence with you; the National Cybersecurity Authority evaluates compliance. No seal or certificate is for sale here, and if an offer in front of you is one, we will say so. Where a certificate helps we name it: ISO/IEC 27001 from an accredited body as supporting evidence, never a stand-in for the ECC.

Offered an "ECC certificate" or an "NCA-approved" seal? Send it to us; at no charge, we will explain what the document is and what it is not.

Keep exploring

More on NCA ECC (Saudi Arabia) and related standards

More in Information security, cyber & cloud

Talk to a consultant

Plan your NCA ECC compliance with confidence.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

hello@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Build an NCA ECC compliance programme for the first timeUnderstand cost, scope and timingMove our programme from ECC-1:2018 to ECC-2:2024Align our ISO/IEC 27001 ISMS with NCA ECC

Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice