What the NCA ECC is
The Essential Cybersecurity Controls (ECC) are the baseline cybersecurity requirements issued by Saudi Arabia's National Cybersecurity Authority (NCA). The current edition is ECC-2:2024.
They apply to government entities, their subsidiaries, and private organisations that own, operate or host critical national infrastructure — and they are increasingly passed down to suppliers through contracts.
The main domains
The controls are grouped into main domains, each broken into subdomains and individual controls:
- Cybersecurity Governance — strategy, roles, policies, risk management, compliance reviews
- Cybersecurity Defense — asset, identity and access management, email, network, mobile, data protection, cryptography, backup, vulnerability and penetration testing, logging and monitoring, incident management
- Cybersecurity Resilience — cybersecurity in business continuity
- Third-Party and Cloud Computing Cybersecurity
- Industrial Control Systems Cybersecurity (where relevant)
Checklist: preparing for an ECC assessment
Work through these steps in order:
- Confirm whether ECC applies to you directly or through a customer contract
- Appoint a cybersecurity function independent of IT operations, with a Saudi national leading it where required
- Approve a cybersecurity strategy and policy set at leadership level
- Inventory assets and classify data
- Run a gap assessment against every applicable control
- Prioritise remediation and record owners and dates
- Collect evidence per control — configurations, logs, reports, approvals
- Review periodically and keep the evidence current
How muVerity helps
We run ECC gap assessments, build the policy set, map Microsoft 365 and Azure configurations to the relevant controls, and organise evidence so it is ready for review. AuditLance was designed with ECC evidence tracking in mind.