NCA Essential Cybersecurity Controls (ECC) Compliance Consulting
NCA ECC compliance consulting is gap assessment, remediation planning, and evidence readiness against Saudi Arabia's Essential Cybersecurity Controls issued by the National Cybersecurity Authority. CyberInTech delivers this from Riyadh - practical controls and proof, not paperwork theatre.
What is NCA ECC (ECC-2:2024)?
The Essential Cybersecurity Controls (ECC) are Saudi Arabia's baseline cybersecurity requirements issued by the National Cybersecurity Authority (NCA). The current widely referenced edition is ECC-2:2024; NCA publishes the official control set and any updates - always use NCA's published text as the source of truth. ECC sets expectations for how organisations govern cybersecurity, protect systems and data, manage identities and access, handle incidents, and manage third parties and cloud use.
Engagement highlights
- Riyadh-based ECC consultants
- Gap assessment against applicable ECC edition
- Evidence quality review
- Risk-ranked remediation roadmap
ECC-2:2024 domains overview
ECC-2:2024 (also styled ECC 2-2024 on NCA's site) is organised as 4 main domains, 28 subdomains, 108 main controls, and 92 subcontrols, per NCA's published Essential Cybersecurity Controls. Always treat the NCA PDF / regulatory-documents page as the source of truth; Arabic text prevails for interpretation where NCA so states.
| Domain | What it covers (plain language) |
|---|---|
| 1. Cybersecurity Governance | Strategy, management, policies, roles, risk, projects, legal/regulatory compliance, review/audit, HR security, awareness and training |
| 2. Cybersecurity Defense | Assets, IAM, systems protection, email, networks, mobile, data protection, cryptography, backup/recovery, vulnerability management, penetration testing, logging/monitoring, incident/threat management, physical security, web application security |
| 3. Cybersecurity Resilience | Cybersecurity aspects of business continuity management (BCM) |
| 4. Third-Party and Cloud Computing Cybersecurity | Third-party cybersecurity; cloud computing and hosting cybersecurity (cloud subdomain applies when you use or plan to use cloud/hosting) |
Official references: NCA Essential Cybersecurity Controls and the ECC-2:2024 English PDF published by NCA.
How we help with NCA ECC
We map your policies, controls, and evidence to applicable ECC domains, prioritise gaps by business and regulatory risk, and support remediation and evidence packaging with your internal team - you keep ownership.
ECC readiness and gap assessment
Clear gap register against domains/controls in scope.
Self-assessment and tooling support
Structure honest self-assessment inputs where useful; we do not replace NCA's official tools or processes.
Evidence quality review
What assessors can sample vs what only exists as intent.
Policies, controls, and documentation
Artefacts aligned to how your team actually operates.
Technical implementation support
Access, logging, endpoint, network, monitoring, and related fixes alongside your IT team.
Remediation roadmap
Phased plan with owners and sequencing; optional follow-on support.
Typical engagement flow
A typical ECC engagement runs discovery to gap assessment to findings workshop to roadmap to implementation support to audit-readiness pack. Many organisations run gap assessment before any formal external assessment so remediation spend is targeted.
Discovery call
Scope, systems, deadlines, who owns security today.
Gap assessment
Interviews, document review, control sampling.
Findings workshop
Plain-language gaps and priorities.
Roadmap
Phased remediation with effort and sequencing.
Implementation support
Policies and technical fixes as agreed.
Who this is for
NCA ECC is typically relevant for government and government-affiliated organisations, critical national infrastructure (CNI) and essential services, and regulated or sensitive private-sector entities that must prove cybersecurity maturity for contracts, tenders, or oversight.
Government and affiliated organisations
Entities under government cybersecurity expectations.
CNI and essential-service operators
Critical national infrastructure and essential services.
Regulated private sector and suppliers
Sensitive suppliers and regulated organisations.
Buyer / partner questionnaires
Organisations answering "are you ECC-ready?" questions.
Who must comply with NCA ECC-2:2024?
Per NCA's published ECC-2:2024 scope, these Controls apply to:
- Government agencies in Saudi Arabia (ministries, authorities, establishments and others)
- Their affiliated companies and entities (inside and outside the Kingdom)
- Private-sector entities that own, operate, or host Critical National Infrastructures (CNIs)
NCA strongly encourages other entities in the Kingdom to use ECC as best practice even when not strictly mandatory. In commercial reality, tenders, partners, and multi-regulator programmes often still ask "are you ECC-ready?"
Confirm exact applicability with counsel and current NCA guidance. Subdomain applicability can also vary (for example, cloud/hosting controls bind when cloud is in use or planned).
ECC vs SAMA CSF vs CST CRF
| Framework | Regulator | Typical audience | What buyers should remember |
|---|---|---|---|
| NCA ECC-2:2024 | National Cybersecurity Authority | Government, affiliates, CNI owners/operators/hosts | National baseline cybersecurity controls |
| SAMA CSF | Saudi Central Bank (SAMA) | Banks, insurers, finance companies, many fintechs / suppliers | Sector maturity programme (Level 3+ objective in the CSF maturity model) |
| CST CRF | Communications, Space & Technology Commission | CST-licensed/registered ICT, telecom, hosting and related providers | Sector compliance levels (commonly CL1 / CL2 / CL3) |
Overlaps exist (governance, IAM, logging, third parties, resilience themes), but labels, evidence expectations, and assessment paths differ. Forced "one checklist for all" programmes usually fail sampling. Where more than one applies, we map overlaps on discovery so you do not remediate twice - see SAMA CSF, CST CRF, and banking & fintech.
Timeline and steps (typical)
Exact duration depends on entity size, system count, and starting maturity. A realistic pattern:
Discovery (about 1 week)
Confirm ECC edition in scope, systems, cloud use, OT/ICS flag, deadlines, owners.
Gap assessment (often about 2-4 weeks for a focused scope)
Interviews, document review, control sampling - gap register.
Findings workshop
Prioritised gaps in plain language for management.
Remediation (phased; often multi-month)
Governance first where weak, then defence/resilience/third-party & cloud; OTCC parallel if needed.
Evidence pack & readiness check
Index what assessors can sample; fix gaps before formal assessment or high-stakes tender.
We do not publish fake "guaranteed pass in X weeks" claims. Prefer to start with a cybersecurity gap assessment before heavy tool spend.
Deliverables
Typical ECC engagement outputs (final set confirmed on discovery):
- ECC-2:2024 gap register mapped to domains/controls in scope
- Prioritised remediation roadmap with owners and sequencing
- Policy and control artefacts as scoped (aligned to real operations)
- Evidence checklist / readiness index
- Clear list of open technical and process actions
- Optional multi-framework overlap map (SAMA / CST / PDPL / ISO) when scoped
FAQ
What is ECC-2:2024?
ECC-2:2024 is the widely referenced current edition of NCA's Essential Cybersecurity Controls. NCA publishes the official control set; use that text as authoritative. We map engagements to the edition that applies to your scope.
Who is in scope for NCA ECC (government / CNI)?
Per ECC-2:2024, government agencies in Saudi Arabia, their affiliated companies and entities inside and outside the Kingdom, and private-sector entities that own, operate, or host Critical National Infrastructures. Confirm exact applicability with counsel and current NCA guidance.
How does ECC differ from NCNICC?
ECC is NCA's essential (baseline) cybersecurity controls. NCNICC refers to NCA's national cybersecurity controls context for broader or more specialised national requirements - they are related but not interchangeable labels. We clarify which control set(s) apply to you on discovery and against official NCA publications.
Should we do a gap assessment before an ECC audit or assessment?
Yes, in most cases. A gap assessment shows missing controls and weak evidence before you face formal assessment or a high-stakes tender questionnaire.
What ECC domains does CyberInTech cover?
We work against the four ECC-2:2024 domains - Cybersecurity Governance, Cybersecurity Defense, Cybersecurity Resilience, and Third-Party and Cloud Computing Cybersecurity - and the controls in the official edition applicable to your scope. The NCA publication is the source of truth for control counts.
Do you only write policies, or do you help with evidence and remediation?
We assess, prioritise, and support remediation and evidence - not policies alone. You keep ownership; we work with your team.
Can ECC work align with SAMA, CST, PDPL, or ISO 27001?
Yes, where those frameworks also apply. Overlaps can reduce duplicate remediation; we map them on discovery.
What about NCA licence or registration status?
We confirm our current NCA registration status for the specific services you need on discovery. We do not claim licences or registrations we do not hold. If a licensed specialist is legally required for part of your scope, we say so plainly.
How many domains and controls are in ECC-2:2024?
NCA's published ECC-2:2024 states 4 main domains, 28 subdomains, 108 main controls, and 92 subcontrols. Prefer NCA's current PDF over older "5 domains / 114 controls" summaries from ECC-1:2018.
Is NCA ECC mandatory for every private company in Saudi Arabia?
Not automatically. ECC-2:2024's stated scope centres on government agencies and affiliates, plus private entities that own, operate, or host CNI. NCA strongly encourages others to adopt ECC. Tenders and partners may still require ECC-aligned evidence - confirm with counsel.
How does ECC-2:2024 differ from ECC-1:2018?
ECC-2:2024 updates the baseline: four main domains (ICS/OT moved toward dedicated OTCC), clarified affiliate scope, and refreshed controls. Do not run a 2026 programme against obsolete five-domain summaries.
What deliverables do we get from an ECC engagement with CyberInTech?
A mapped gap register, prioritised roadmap, scoped policy/control artefacts, evidence checklist, and open-actions list - plus optional multi-framework mapping. Details confirmed on discovery.
Related frameworks
Next step: practical ECC plan
Share your sector, whether you are government/CNI/private, any tender or assessment deadline, and whether other frameworks (SAMA, CST, PDPL, ISO) apply. Our Riyadh team will outline a practical ECC plan - fees scoped on discovery. Call +966 531 446 716 or request a consultation online.
Request a Consultation