Saudi NCA ECC 2-12-4: 2-12-4 Logging implementation reviewed

Implementation of the event log and monitoring requirements is periodically reviewed. The review confirms the requirements remain applied and effective against the subdomain objective, so that event logs are collected, analysed and monitored in time to detect and manage attacks proactively; NCA's guide suggests a documented review plan with a set interval, a compliance assessment report and approval of changes by the head of the entity or delegate.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in 2-12 Cybersecurity Event Logs and Monitoring Management – Saudi NCA ECC

2-12-1 2-12-1 Event log and monitoring requirements defined
2-12-2 2-12-2 Event log and monitoring implemented
2-12-3-1 2-12-3-1 Event logs enabled on critical assets
2-12-3-2 2-12-3-2 Logging of privileged accounts and remote access
2-12-3-3 2-12-3-3 SIEM capability defined
2-12-3-4 2-12-3-4 Continuous monitoring of event logs
2-12-3-5 2-12-3-5 Log retention of at least 12 months

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Saudi NCA ECC controls