How to Get NCA ECC Compliance in Saudi Arabia: The 2026 Step-by-Step Guide
What is NCA ECC and does "certification" actually exist?
The Essential Cybersecurity Controls (ECC) are mandatory cybersecurity requirements issued by Saudi Arabia's National Cybersecurity Authority (NCA). The current version, ECC-2:2024, contains 108 main controls and 92 sub-controls across 4 domains and 28 subdomains (the earlier ECC-1:2018 used 114 controls across 5 domains, including Industrial Control Systems — ICS controls now live in the separate OTCC framework).
An important correction for anyone searching "how to get NCA ECC certification": the NCA does not issue an ECC certificate to organizations. Compliance is assessed — through self-assessments submitted via the NCA compliance tool, periodic compliance reports, and field audit visits by the NCA or designated third parties. What organizations actually obtain is a demonstrated state of compliance, sometimes evidenced by a third-party attestation or consultancy gap-assessment report. Any vendor promising an official "ECC certificate" is misdescribing the regime.
Who must comply with NCA ECC?
- Government entities in Saudi Arabia and their affiliated bodies, inside or outside the Kingdom
- Private-sector entities that own, operate, or host critical national infrastructure (CNI) — energy, water, transport, health, telecom and related sectors
- Organizations notified directly by the NCA as in-scope
Other organizations are encouraged to adopt ECC voluntarily to raise their security posture — and in practice, many enterprises operating in KSA supply chains (e.g., Aramco or government vendors) must meet ECC or ECC-derived requirements contractually even when not directly mandated.
The 4 domains of ECC-2:2024
| Domain | Focus | Example controls |
|---|---|---|
| 1. Cybersecurity Governance | Leadership, policy, oversight | Cybersecurity strategy & KPIs, board accountability, policies, designated Cybersecurity Officer, risk management, compliance management, third-party governance |
| 2. Cybersecurity Defense | Technical & operational protection | Asset management, identity & access management, network security, data classification, cryptography, vulnerability & patch management, logging and monitoring, secure development |
| 3. Cybersecurity Resilience | Respond & recover | Business continuity plans, disaster recovery, tested incident response plans, backup & restore (including air-gapped backups for critical systems) |
| 4. Third-Party & Cloud Computing Security | Supply chain & cloud | Vendor risk assessment, contractual security clauses, cloud service provider requirements, ongoing monitoring, exit and data-return procedures |
Not every control applies to every organization. ECC explicitly requires compliance with all applicable controls — which makes a documented applicability decision (with rationale for anything excluded) one of the highest-leverage audit-readiness artifacts you can produce.
How to become NCA ECC compliant: the 6-step roadmap
Step 1 — Confirm scope and regulatory posture (1–2 weeks)
Determine whether you are a government entity or a CNI owner/operator/host, whether cloud usage activates Domain 4 obligations, and whether OT environments pull in OTCC. Write a one-page scope statement agreed by security, IT, OT, procurement and leadership.
Step 2 — Run a gap assessment against ECC-2:2024 (3–6 weeks)
Benchmark every applicable control. Classify each as compliant, partially compliant, or non-compliant, with evidence notes. A structured gap assessment is the single strongest predictor of a smooth NCA evaluation, because it converts an abstract framework into a finite, owned remediation list.
Step 3 — Build the remediation plan and statement of applicability (2–3 weeks)
Prioritize gaps by risk and NCA visibility. For each control: assign an owner, a deadline, and the evidence that will prove it. Map systems to subdomains and mark applicability decisions with rationale, including compensating controls where a direct implementation is impractical.
Step 4 — Implement governance first, then defense, then resilience (2–5 months)
Governance gaps (policies, accountability, awareness programs) are usually fastest to close and are examined first in assessments. Technical defense controls take longer — asset inventory, IAM hardening, logging coverage, patch discipline. Resilience requires tested plans: an incident response plan that has never been exercised does not demonstrate compliance.
Step 5 — Produce continuous evidence (ongoing)
NCA evaluation checks evidence, not intentions. Maintain: policy approvals with version history, risk register updates, vulnerability scan and penetration test reports (at minimum twice yearly), access reviews, backup restore test records, incident response exercise reports, and vendor assessment files.
Step 6 — Undergo NCA evaluation (timing set by the NCA)
Complete the NCA self-assessment via the official ECC Assessment and Compliance Tool, respond to periodic reporting requests, and prepare for potential field audits. Treat the first assessment as a milestone in a permanent operating rhythm, not a project end.
How long does NCA ECC compliance take?
| Organization profile | Typical timeline | Main driver |
|---|---|---|
| Small entity, basic controls in place | 3–5 months | Documentation and governance formalization |
| Mid-size enterprise, partial maturity | 5–8 months | Technical remediation (IAM, logging, patching) |
| Large enterprise or CNI operator | 8–14 months | Scale of assets, OTCC layering, third-party program |
Costs are driven by scope (number of systems and sites), existing maturity (ISO 27001 organizations typically cut timeline by 30–40% because of control overlap), tooling gaps (SIEM, vulnerability management), and whether external consulting is used for the gap assessment and remediation management.
Evidence checklist — what assessors ask to see
- Governance: approved cybersecurity policy set, risk management framework, defined roles with a named Cybersecurity Officer, awareness training records, compliance reporting
- Defense: asset inventory with classification, access control matrix and privileged-access reviews, network diagrams with segmentation, encryption standards, vulnerability scan + penetration test reports, SOC/log monitoring procedures
- Resilience: BCP/DRP with test results, incident response plan with exercise records, backup configuration and restore test evidence
- Third-party/cloud: vendor risk assessments, contracts with security clauses, cloud provider security documentation, exit plans
How ECC relates to other Saudi frameworks
- SAMA CSF: mandatory for financial institutions alongside ECC; controls overlap heavily — map once, report twice
- OTCC-1:2022: applies to critical ICS facilities; ECC compliance is a prerequisite; control volume scales by facility level (L1–L3)
- NCA CCC (Cloud Computing Controls): extends Domain 4 for cloud and hosting providers
- CST CRF: telecom-specific obligations run in parallel
- ISO 27001: not mandated by NCA, but an ISMS certified against ISO 27001 covers a large share of ECC evidence requirements
Frequently asked questions
Is NCA ECC compliance mandatory for private companies?
It is mandatory for private-sector entities that own, operate, or host critical national infrastructure, and for any organization the NCA notifies directly. Government vendors frequently inherit ECC-derived obligations contractually.
Can a consultancy "certify" us against ECC?
No third party can issue an official ECC certificate. Consultancies perform gap assessments and remediation support; only the NCA (or its designated assessors) evaluates compliance.
Does ISO 27001 certification satisfy NCA ECC?
No — but it overlaps substantially. Organizations with ISO 27001 typically find 50–60% of ECC evidence already exists and need to map and supplement for Saudi-specific controls and reporting.
What happens if we don't comply?
The NCA can mandate remediation, issue observations, and escalate enforcement for persistent non-compliance. For government suppliers, non-compliance increasingly blocks contract eligibility.
Where do we submit the self-assessment?
Through the NCA's ECC Assessment and Compliance Tool, which organizes evaluation and compliance measurement against the controls.
How CyberInTech helps with NCA ECC
CyberInTech is a Riyadh-based cybersecurity consultancy delivering NCA ECC compliance consulting in Saudi Arabia — from fixed-fee gap assessments and remediation roadmaps through evidence preparation and NCA assessment support. We also cover the layered frameworks that sit alongside ECC: SAMA CSF, NCA CCC, NCA DCC, and NCA OTCC. Talk to our team: +966 53 144 6716 · info@cyberintech.com.