NCA ECC: A Practical Guide to Saudi Arabia's Essential Cybersecurity Controls (ECC-2:2024)

NCA ECC, the Essential Cybersecurity Controls, is the National Cybersecurity Authority's mandatory minimum cybersecurity baseline for Saudi government entities, their affiliated companies and private organisations that own, operate or host critical national infrastructure. The current version, ECC-2:2024, contains 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols.

What is NCA ECC?

The National Cybersecurity Authority (NCA) is the Kingdom's national reference for cybersecurity, established under its statute issued by Royal Order No. 6801 dated 11/2/1439H. High Order No. 57231 dated 10/11/1439H requires all government agencies to raise their cybersecurity level and comply with the NCA's policies, frameworks, standards and controls. The Essential Cybersecurity Controls are the core of that regime: the minimum requirements every in-scope entity must meet.

ECC was built after studying national and international standards, analysing previous incidents against government and critical entities, and consulting national organisations. Its objective is to protect the confidentiality, integrity and availability of information and technology assets, and it addresses four pillars: strategy, people, process and technology. The full text is published on the NCA's ECC page.

ECC-1:2018 vs ECC-2:2024: what changed?

The NCA issued the first version, ECC-1:2018, and replaced it with ECC-2:2024 after reviewing its implementation and the threat landscape.

Element	ECC-1:2018	ECC-2:2024
Main domains	5	4
Subdomains	29	28
Controls	114 controls	108 main controls and 92 subcontrols
Industrial control systems	Domain 5 inside ECC	Removed; covered by the Operational Technology Cybersecurity Controls (OTCC)
Data classification, privacy and localisation	Inside ECC	Moved to the National Data Management Office (NDMO) at SDAIA

The most practical changes for IT and security teams, listed in Appendix C of the ECC-2:2024 document, are:

• Saudi workforce (control 1-2-2): all cybersecurity positions, not only the head and critical roles, must be filled by full-time, qualified Saudi professionals.
• Multi-factor authentication: required for remote access and privileged accounts, and for remote and webmail access to email.
• Email security: email validation now explicitly includes SPF, DKIM and DMARC.
• DDoS protection: a new subcontrol (2-5-3-9) for protection against distributed denial-of-service attacks.
• Data protection by classification: data and cloud provider protection requirements now follow the data's classification level.
• Cryptography: aligned with the NCA's National Cryptographic Standards.

Who must comply with ECC?

ECC-2:2024 applies to:

• Government agencies in Saudi Arabia, including ministries, authorities and establishments.
• Companies and entities affiliated with those agencies, inside and outside the Kingdom.
• Private sector entities that own, operate or host Critical National Infrastructure (CNI).

The NCA strongly encourages every other organisation in the Kingdom to use the controls as best practice. In practice, ECC also reaches private suppliers: technology vendors, managed service providers and cloud providers serving government or CNI clients are routinely asked to demonstrate ECC alignment through contracts and third-party controls. Some controls apply only if you use the relevant technology; for example, subdomain 4-2 on cloud computing and hosting is binding on entities that use or plan to use cloud services.

What are the four ECC domains?

1. Cybersecurity Governance

Ten subdomains: strategy; cybersecurity management (including an independent cybersecurity function separate from IT); policies and procedures; roles and responsibilities; risk management; cybersecurity in IT project management; compliance with standards, laws and regulations; periodic review and audit; cybersecurity in human resources; and awareness and training.

2. Cybersecurity Defense

Fifteen subdomains: asset management; identity and access management; protection of information systems and processing facilities; email protection; network security; mobile device security; data and information protection; cryptography; backup and recovery; vulnerability management; penetration testing; event logs and monitoring; incident and threat management; physical security; and web application security.

3. Cybersecurity Resilience

One subdomain covering the cybersecurity aspects of business continuity management. Our guide to disaster recovery and business continuity in Saudi Arabia covers how to design for it.

4. Third-Party and Cloud Computing Cybersecurity

Two subdomains: third-party cybersecurity, which among other things requires managed security operations centres that use remote access to be located fully inside the Kingdom, and cloud computing and hosting cybersecurity.

Which other NCA frameworks sit alongside ECC?

ECC is the baseline. The NCA publishes additional controls that build on it for specific technologies and situations:

Framework	Full name	Applies when
CCC (CCC-2:2024)	Cloud Cybersecurity Controls	Cloud service providers and organisations using cloud services
DCC (DCC-1:2022)	Data Cybersecurity Controls	Protecting data across its lifecycle, by classification
OTCC (OTCC-1:2022)	Operational Technology Cybersecurity Controls	Industrial control systems and OT environments
CSCC	Critical Systems Cybersecurity Controls	Systems classified as critical within in-scope entities
TCC	Telework Cybersecurity Controls	Remote working arrangements
OSMACC	Organisations' Social Media Accounts Cybersecurity Controls	Official social media accounts
NCS	National Cryptographic Standards	Selection and use of cryptography

How does the NCA assess ECC compliance?

The NCA evaluates compliance through self-assessment by entities, periodic reports from its compliance tool and field audit visits, using whichever mechanism it considers appropriate. The ECC-2:2024 document states that the NCA will issue an ECC-2:2024 Assessment and Compliance Tool to organise the process. The NCA also publishes a Guide to ECC Implementation that explains the expected deliverables for each control. Compliance is continuous: entities must take all necessary measures to maintain it, not just pass a one-time review.

How do you run an ECC gap assessment?

1. Confirm scope and applicability. Decide which entities, systems and sites are in scope and which controls apply, such as cloud (4-2) or OT, which now falls under OTCC.
2. Collect existing evidence. Gather policies, procedures, organisation charts, asset inventories, architecture diagrams, configuration baselines, logs and previous audit reports.
3. Interview control owners. Walk through each subdomain with IT, security, HR, procurement and business continuity owners.
4. Test, do not just read. Sample configurations: is MFA enforced for privileged and remote access, are DMARC records published, do backups restore, are logs centralised?
5. Rate each control. Use a clear scale such as implemented, partially implemented, not implemented or not applicable, with evidence references.
6. Prioritise by risk. Rank gaps by impact on critical services and by effort, and flag quick wins.
7. Produce a roadmap. Assign owners, budgets and target dates, and report progress to the cybersecurity supervisory committee.

What does a practical ECC compliance roadmap look like?

• Phase 1, governance foundations: approve the cybersecurity strategy, establish an independent cybersecurity function and supervisory committee, publish policies, and start the risk register.
• Phase 2, high-impact technical controls: asset inventory, MFA, privileged access management, email authentication, patching and vulnerability management, backups and centralised logging.
• Phase 3, detection and response: security monitoring, an incident response plan aligned with NCA reporting, penetration testing and threat intelligence.
• Phase 4, third parties, cloud and resilience: vendor security clauses, cloud controls, business continuity testing and alignment with CCC or DCC where they apply.
• Phase 5, continuous compliance: periodic reviews, internal audit, awareness training and evidence kept ready for NCA assessment.

Architecture choices make each phase easier or harder. Our article on cybersecurity architecture for KSA enterprises explains how to design controls in rather than bolt them on, and in our cloud migration case study a hybrid AWS platform with NCA-aligned controls gave the client centralised security posture with continuous NCA compliance monitoring.

What are the most common ECC gaps?

• Incomplete asset inventories, which undermine every other control.
• Cybersecurity function not independent from IT, or roles not filled by full-time qualified Saudi professionals.
• MFA gaps on VPN, privileged accounts and webmail.
• Missing DMARC enforcement and weak email filtering.
• Backups that are never restore-tested.
• Logs collected but not monitored, with no defined retention.
• Third-party contracts without cybersecurity clauses or risk assessments before signing.
• Business continuity plans that ignore cyber scenarios such as ransomware.

ECC vs ISO 27001 vs SAMA CSF: how do they compare?

Aspect	NCA ECC-2:2024	ISO/IEC 27001:2022	SAMA Cyber Security Framework
Issuer	National Cybersecurity Authority	ISO and IEC (international)	Saudi Central Bank (SAMA), version 1.0, May 2017
Nature	Mandatory national minimum controls	Voluntary, certifiable management system standard	Mandatory for SAMA-regulated entities
Who uses it	Government entities, affiliates and CNI operators	Any organisation worldwide	Banks, insurers, finance companies, credit bureaus and financial market infrastructure
Structure	4 domains, 28 subdomains, 108 main controls, 92 subcontrols	Management system clauses plus 93 Annex A controls in 4 themes	4 domains, with a maturity model from level 0 to 5
Assessment	Self-assessment, NCA compliance tool and field audits	Third-party certification audit	Maturity assessment; minimum level 3 expected
Saudi-specific requirements	Yes, such as Saudi staffing and in-Kingdom managed SOCs	No	Yes, for the financial sector

The frameworks overlap heavily, so map controls once and reuse evidence. ISO 27001 certification helps but does not prove ECC compliance on its own. Financial institutions should read our SAMA Cyber Security Framework guide and the SAMA framework itself. ECC also supports PDPL compliance, which requires appropriate security for personal data.

What is the next step?

Start with an honest gap assessment against ECC-2:2024, then fund the roadmap by risk. Amwaj designs and implements NCA-aligned architectures, from identity and zero trust to cloud and monitoring. Explore our cybersecurity and compliance service or email info@amwajsol.sa to book a consultation.