NCA ECC: What It Is and Who It Applies To
The Essential Cybersecurity Controls (ECC-2:2024) are the minimum cybersecurity requirements issued by Saudi Arabia's National Cybersecurity Authority (NCA). They apply to government agencies and their affiliated entities, and to private entities that own, operate or host Critical National Infrastructure. NCA strongly encourages all other entities in the Kingdom to use them too.
What are the NCA Essential Cybersecurity Controls?
The ECC are a set of cybersecurity controls published by NCA. The document says their aim is to provide "the minimum cybersecurity requirements" that reduce internal and external threats to an entity's information and technology assets, protecting confidentiality, integrity and availability. They are built around four pillars: strategy, people, process and technology.
NCA is described in the document as "the national and specialized cybersecurity reference in the Kingdom". Its Statute was approved by Royal Order No. 6801, dated 11/02/1439H.
ECC-2:2024 is the second edition and updates ECC-1:2018. The document's cover tells readers to check nca.gov.sa for the latest version, so confirm there that no newer edition exists. The document also says the Arabic version is the binding language, so treat this English summary as a guide only.
Who has to comply with the ECC?
Entities inside the ECC's scope of work. The document says the controls apply to:
- government agencies in Saudi Arabia, including ministries, authorities and establishments;
- their affiliated companies and entities, inside and outside the Kingdom; and
- all private sector entities owning, operating or hosting Critical National Infrastructures (CNIs).
For everyone else, NCA "strongly encourages all other entities in the Kingdom" to use the controls as best practice. The text frames that as encouragement, not as a requirement.
The document defines CNI as essential infrastructure (assets, facilities, systems, networks, processes and key personnel) whose loss or compromise could seriously affect basic services, national security, defence, the state economy or national capacities. It does not list which organisations count as CNI owners, so an organisation unsure of its status should ask NCA or a Saudi legal adviser. This page is general information, not legal advice.
Within scope, "each entity shall comply with all controls applicable thereto". Some controls depend on what the entity does. For example, the cloud computing and hosting controls (subdomain 4-2) are "applicable and binding on entities currently using or planning to use" those services.
What do the controls cover?
ECC-2:2024 has four main domains and 28 subdomains. Its introduction lists 108 main controls and 92 subcontrols.
- Cybersecurity Governance: strategy, management, policies, roles, risk management, project management, compliance, review and audit, human resources, and awareness and training.
- Cybersecurity Defense: asset management, identity and access, systems and facilities, email, network, mobile devices, data protection, cryptography, backup, vulnerabilities, penetration testing, logging and monitoring, incidents and threats, physical security and web applications.
- Cybersecurity Resilience: cybersecurity requirements within business continuity management.
- Third-Party and Cloud Computing Cybersecurity: third-party risk, and cloud computing and hosting.
A few examples show how specific the wording gets:
- Control 1-2-1 requires a cybersecurity department that is independent from the IT department.
- Control 1-2-2 says "all cybersecurity positions shall be filled out with full-time and qualified Saudi cybersecurity professionals".
- Under control 4-1-3 (subcontrol 4.1.3.2), contracts with third parties providing IT or cybersecurity outsourcing or managed services must provide that cybersecurity managed service centers "for monitoring and operations which use remote access" are "fully located in the Kingdom of Saudi Arabia".
What changed in ECC-2:2024 compared with ECC-1:2018?
The document's Appendix C lists the updates. The main ones:
- ECC-1's fifth main domain, Industrial Control Systems Cybersecurity, was deleted. Its controls moved to the OTCC (Operational Technology Cybersecurity Controls).
- Data localisation controls were transferred to the National Data Management Office (NDMO) at the Saudi Data and Artificial Intelligence Authority, and entities must refer to NDMO on localisation.
- Control 1-2-2 was widened from the head of the cybersecurity function and critical positions to all cybersecurity positions.
- Multi-factor authentication wording was clarified, email domain validation now names SPF, DKIM and DMARC, and a new subcontrol (2-5-3-9) covers protection against DDoS attacks.
How does NCA check compliance with the ECC?
The document says NCA evaluates compliance through "self-assessment by the entities, periodic reports of the compliance tool, and/or field auditing visits", using whichever mechanism NCA considers appropriate. It also says NCA will issue an ECC-2:2024 Assessment and Compliance Tool.
Inside the entity, the cybersecurity department reviews implementation periodically (control 1-8-1), and the controls must also be reviewed and audited by parties other than that department, independently (control 1-8-2). Results go to the cybersecurity supervisory committee and the head of the entity or delegate. The document describes no certificate and no fixed assessment frequency.
Does the ECC have an effective date or compliance deadline?
ECC-2:2024 does not state one. It gives its year of issuance (2024) but no effective date or transition period from ECC-1:2018, and it says NCA will review and update the ECC periodically. Check NCA directly for any timeline that applies to your entity.
The document does say entities within scope "shall take all necessary measures to ensure ongoing and continuous compliance", citing Article 10(3) of NCA's Statute and High Order No. 57231, dated 10/11/1439H.
How does the ECC relate to ISO 27001 and other frameworks?
They are separate instruments from different issuers. ISO/IEC 27001 is an international management-system standard, with certificates issued by external certification bodies rather than by ISO. SOC 2 is a report issued by a CPA firm. The ECC is published by NCA and assessed as described above. ECC-2:2024 does not name either, and does not say that either satisfies it.
The document says NCA studied "multiple cybersecurity standards, frameworks, and controls" when developing the ECC, and that the controls are linked to relevant national and international legislative and regulatory requirements. Banks and other financial institutions regulated by the Saudi Central Bank should also read the SAMA Cyber Security Framework. Personal data is covered by a separate law, the Saudi PDPL.
What does NCA ECC stand for?
It stands for the National Cybersecurity Authority's Essential Cybersecurity Controls. ECC-2:2024 is the 2024 edition, which updates ECC-1:2018.
Does the ECC apply to every company in Saudi Arabia?
No. The document applies it to government agencies and their affiliated entities, and to private entities that own, operate or host Critical National Infrastructure. NCA strongly encourages all other entities in the Kingdom to use it.
Is there an ECC certificate?
The ECC-2:2024 document describes assessment through self-assessment, periodic reports of the compliance tool and field auditing visits. It does not describe a certificate.
Which language version is binding?
The document says the Arabic version is the binding language for its meaning and interpretation. Use the Arabic text for any legal reading.
Does the ECC cover industrial control systems?
Not as a separate domain in ECC-2:2024. The document deleted ECC-1's fifth main domain and says its controls moved to the OTCC (Operational Technology Cybersecurity Controls).
Which edition is current?
This page is based on ECC-2:2024. NCA's own cover note says to check nca.gov.sa for the latest version, so confirm there before relying on any edition.
Talk to a practitioner
Tell us the obligation you are trying to meet and who is asking for it. The first call is with a practitioner.