IT Integration
NCA ECC Compliance and Cyber Security Services in Saudi Arabia
Gap assessment, security architecture and remediation for NCA ECC-2:2024, CCC, PDPL and the SAMA Cyber Security Framework, built for Saudi organisations.
Key takeaways
- ECC-2:2024 replaced ECC-1:2018 and contains 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols.
- The ECC is mandatory for government entities, their affiliates and private-sector CNI operators, and its third-party controls reach their suppliers.
- The PDPL has been enforceable since 14 September 2024, with SDAIA as regulator, 72-hour breach notification and fines of up to SAR 5 million.
- Amwaj assesses gaps, designs zero trust architecture and implements controls, while compliance itself is evaluated by the NCA, SDAIA or SAMA.
NCA ECC compliance means meeting the Essential Cybersecurity Controls (ECC-2:2024) issued by Saudi Arabia's National Cybersecurity Authority (NCA), the minimum cybersecurity baseline for government entities and operators of critical national infrastructure. Amwaj Solutions helps organisations close ECC, PDPL and SAMA gaps by designing and implementing the architecture, controls and evidence these frameworks require.
Cyber security in Saudi Arabia is now a regulatory question as much as a technical one. Boards are asked for evidence, not assurances; suppliers to government are asked to demonstrate controls; and personal data carries enforceable penalties. We work as your engineering partner: we find the gaps, design the target architecture and implement the controls that close them.
What is the NCA Essential Cybersecurity Controls (ECC) framework?
The ECC sets the minimum cybersecurity requirements for national entities in the Kingdom. The current version, ECC-2:2024, replaced ECC-1:2018 and is organised into:
- 4 main domains: Cybersecurity Governance; Cybersecurity Defense; Cybersecurity Resilience; and Third-Party and Cloud Computing Cybersecurity.
- 28 subdomains, from asset management and identity and access management to event logs and monitoring, penetration testing and web application security.
- 108 main controls and 92 subcontrols.
ECC-1:2018 had 5 domains, 29 subdomains and 114 controls. In the 2024 update, the industrial control systems domain moved to the Operational Technology Cybersecurity Controls (OTCC), and data localisation controls were transferred to the National Data Management Office (NDMO) at SDAIA (NCA: Essential Cybersecurity Controls). The NCA evaluates compliance through self-assessment, reports from its compliance tool and field audits. Our NCA ECC guide walks through each domain in detail.
Who must comply with the NCA ECC?
ECC-2:2024 applies to government agencies in the Kingdom, including ministries, authorities and establishments, and to their affiliated companies and entities inside and outside the Kingdom. It also applies to private-sector entities that own, operate or host Critical National Infrastructure (CNI). The NCA strongly encourages every other organisation in the Kingdom to apply the controls as best practice.
In practice, the reach is wider than the formal scope. The ECC's Third-Party Cybersecurity subdomain requires in-scope entities to manage supplier risk, so technology vendors, integrators and service providers to government and CNI operators are commonly asked to show ECC-aligned controls in contracts and due diligence.
Which other Saudi cybersecurity and data frameworks may apply?
The ECC is the foundation. Depending on your sector, systems and data, several extensions and parallel regimes sit alongside it.
| Framework | Who it applies to | Regulator |
|---|---|---|
| Essential Cybersecurity Controls (ECC-2:2024) | Government entities and their affiliates; private-sector owners, operators and hosts of CNI | National Cybersecurity Authority (NCA) |
| Cloud Cybersecurity Controls (CCC-2:2024) | Cloud service providers serving in-scope entities, and in-scope entities that use or plan to use cloud services | NCA |
| Data Cybersecurity Controls (DCC-1:2022) | Government organisations and private-sector CNI organisations, across the whole data lifecycle | NCA |
| Operational Technology Cybersecurity Controls (OTCC-1:2022) | Industrial control systems in critical facilities owned or operated by government or private-sector CNI organisations | NCA |
| Critical Systems Cybersecurity Controls (CSCC-1:2019) | National critical systems; 32 main controls and 73 subcontrols that extend the ECC | NCA |
| Personal Data Protection Law (PDPL) | Any public or private organisation processing personal data of individuals in Saudi Arabia, including from outside the Kingdom | Saudi Data and AI Authority (SDAIA) |
| SAMA Cyber Security Framework | SAMA-regulated banks, insurance and reinsurance companies, financing companies, credit bureaus and financial market infrastructure | Saudi Central Bank (SAMA) |
The Cloud Cybersecurity Controls were updated to CCC-2:2024 and set requirements for both cloud service providers and cloud tenants (NCA: Cloud Cybersecurity Controls). If you run SCADA or other industrial control systems in critical facilities, the OTCC now carries the requirements that used to sit in the ECC's fifth domain.
How does the PDPL affect your cybersecurity programme?
Saudi Arabia's Personal Data Protection Law came into force on 14 September 2023 and, after a one-year grace period, became enforceable on 14 September 2024, with SDAIA as the regulator (SDAIA national data governance platform). For security teams, PDPL compliance means appropriate technical and organisational safeguards, notifying SDAIA within 72 hours of becoming aware of a qualifying personal data breach, and meeting SDAIA's conditions before transferring personal data outside the Kingdom. General violations can attract fines of up to SAR 5 million. Our PDPL compliance guide covers the full set of obligations.
What does the SAMA Cyber Security Framework require?
The Saudi Central Bank issued its Cyber Security Framework in May 2017 for the institutions it regulates (SAMA Rulebook). It is structured around four domains: cyber security leadership and governance; risk management and compliance; operations and technology; and third-party cyber security. Institutions measure themselves against a maturity model from level 0 to 5 and are expected to reach at least level 3, meaning controls are structured and formalised. Our SAMA cybersecurity framework guide explains each domain.
Our cybersecurity and compliance services
Gap assessment against ECC, PDPL and SAMA
We map your current controls, policies and technical configuration against the frameworks that apply to you, then rank gaps by regulatory exposure and business risk. You receive a control-by-control gap register, the status of your evidence and a prioritised remediation roadmap.
Security architecture: zero trust, IAM, logging and monitoring
We design a target architecture that makes compliance sustainable rather than a yearly scramble. That means zero trust principles, verifying every user, device and request and granting least privilege, implemented through identity and access management with multi-factor authentication, privileged access management, network segmentation, and centralised event logging and monitoring. These map directly onto ECC subdomains for identity and access management, network security management, and cybersecurity event logs and monitoring management. Read more on cybersecurity architecture for KSA enterprises.
Remediation and implementation
We close gaps hands-on: hardening configurations, deploying and tuning security tooling, writing the policies and procedures the ECC governance domain requires, and assembling the evidence auditors and regulators will ask for.
Cloud security for Saudi workloads
We design and secure AWS, Microsoft Azure and Google Cloud environments, using in-Kingdom hosting where data residency matters, with controls aligned to the NCA CCC for cloud tenants: identity, encryption, configuration baselines and continuous monitoring.
Backup, disaster recovery and resilience
The ECC covers backup and recovery management in its defence domain and the cybersecurity aspects of business continuity in its resilience domain. We design backup, disaster recovery and continuity plans with tested recovery objectives. See our guide to disaster recovery and business continuity in Saudi Arabia.
How does a compliance engagement work?
- Scope: confirm which frameworks apply, which systems are in scope and what evidence regulators expect.
- Assess: interviews, configuration reviews and technical testing against each applicable control.
- Design: target architecture and remediation roadmap, prioritised by risk and deadline.
- Remediate: implement controls, policies and tooling in phases, with minimal disruption to operations.
- Evidence and monitor: build the evidence pack and set up continuous compliance monitoring so your posture does not drift.
What results has this approach delivered?
For a Saudi enterprise consolidating its stack, we delivered a hybrid cloud on AWS with unified identity, centralised monitoring, automated DevOps and NCA-aligned controls. The result was a 40% reduction in infrastructure overhead and a centralised security posture with continuous NCA compliance monitoring. Read the cloud migration case study.
A note on roles: we are an engineering and advisory partner, not a regulator or certification body. Compliance is evaluated by the NCA, SDAIA or SAMA through their own mechanisms; where your sector requires an independent or licensed assessor, we work alongside them and prepare the evidence. Tell us which frameworks apply to you and we will start with a scoped gap assessment. We respond to consultation requests within 24–48 business hours.
Cybersecurity & Compliance
Frequently Asked Questions
Is NCA ECC compliance mandatory for private companies?
Only for some. ECC-2:2024 is mandatory for government agencies and their affiliated companies, and for private-sector entities that own, operate or host Critical National Infrastructure. The NCA strongly encourages all other organisations to adopt it. Private companies that supply government or CNI operators are also commonly asked to demonstrate ECC-aligned controls through contracts and third-party risk reviews.
What changed between ECC-1:2018 and ECC-2:2024?
ECC-2:2024 has 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols, compared with 5 domains, 29 subdomains and 114 controls in ECC-1:2018. The industrial control systems domain moved to the OTCC, data localisation controls moved to SDAIA's National Data Management Office, and several controls were clarified, such as defining suitable multi-factor authentication factors.
What are the penalties for violating the PDPL?
General PDPL violations can attract a warning or a fine of up to SAR 5 million, and fines can be doubled for repeat violations. Disclosing or publishing sensitive personal data with intent to harm or for personal benefit can lead to up to two years' imprisonment and/or a fine of up to SAR 3 million. SDAIA is the regulator responsible for enforcement.
Does Saudi regulation require data to stay inside the Kingdom?
There is no single blanket rule. The PDPL allows personal data to be transferred abroad only under SDAIA's conditions, such as adequacy decisions or appropriate safeguards. For government and CNI entities, data localisation requirements are now set through SDAIA's National Data Management Office rather than in the ECC itself. Many organisations host sensitive workloads in-Kingdom to simplify compliance.
Does the NCA require a zero trust architecture?
The ECC does not mandate zero trust by name. However, zero trust principles, such as verifying every user and device, least-privilege access, segmentation and continuous monitoring, map directly onto ECC subdomains for identity and access management, network security and event log monitoring. Adopting zero trust is therefore an efficient way to meet those controls sustainably rather than one audit at a time.
Can Amwaj certify that we are NCA ECC compliant?
No. ECC compliance is evaluated by the NCA through self-assessment, its compliance tool and field audits. Our role is to assess your gaps, design and implement the controls, and prepare the evidence. Where your sector requires an independent or licensed assessor, we work alongside them so that findings are closed quickly and your posture is maintained afterwards.
Who needs to follow the SAMA Cyber Security Framework?
The SAMA Cyber Security Framework, issued in May 2017, applies to organisations regulated by the Saudi Central Bank: banks, insurance and reinsurance companies, financing companies, credit bureaus and financial market infrastructure. Some requirements apply differently to non-bank institutions. Institutions are expected to reach at least maturity level 3, and the framework includes a dedicated third-party cyber security domain.