Saudi NCA ECC 2-12-3-4: 2-12-3-4 Continuous monitoring of event logs

Event logs are monitored continuously. The guide expects a 24/7 monitoring model staffed internally or by a contracted service whose SIEM access is inside the Kingdom.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in 2-12 Cybersecurity Event Logs and Monitoring Management – Saudi NCA ECC

2-12-1 2-12-1 Event log and monitoring requirements defined
2-12-2 2-12-2 Event log and monitoring implemented
2-12-3-1 2-12-3-1 Event logs enabled on critical assets
2-12-3-2 2-12-3-2 Logging of privileged accounts and remote access
2-12-3-3 2-12-3-3 SIEM capability defined
2-12-3-5 2-12-3-5 Log retention of at least 12 months
2-12-4 2-12-4 Logging implementation reviewed

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Saudi NCA ECC controls