Saudi NCA ECC 2-12-3-1: 2-12-3-1 Event logs enabled on critical assets

Cybersecurity event logs are activated on critical information assets. The guide lists network devices, applications, databases, servers and workstations (through the protection system) as log sources to be linked to the SIEM.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in 2-12 Cybersecurity Event Logs and Monitoring Management – Saudi NCA ECC

2-12-1 2-12-1 Event log and monitoring requirements defined
2-12-2 2-12-2 Event log and monitoring implemented
2-12-3-2 2-12-3-2 Logging of privileged accounts and remote access
2-12-3-3 2-12-3-3 SIEM capability defined
2-12-3-4 2-12-3-4 Continuous monitoring of event logs
2-12-3-5 2-12-3-5 Log retention of at least 12 months
2-12-4 2-12-4 Logging implementation reviewed

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Saudi NCA ECC controls