Back to Frameworks
Saudi NCA ECC
Saudi Arabia
vECC-2:2024 (second edition); replaces ECC-1:2018
28 domains
176 controls
The Saudi National Cybersecurity Authority's Essential Cybersecurity Controls, second edition (ECC-2:2024): the mandatory minimum cybersecurity requirements for government agencies, their affiliates and private operators of critical national infrastructure, in four domains (governance, defense, resilience, third-party and cloud), 28 subdomains, 108 main controls and 92 subcontrols. 176 leaves read against the complete NCA text; replaces ECC-1:2018.
Verified
Saudi NCA ECC is a compliance framework from Saudi Arabia with 28 domains and 176 controls. The largest domains are 2-5 Networks Security Management – Saudi NCA ECC (12 controls), 1-10 Cybersecurity Awareness and Training Program – Saudi NCA ECC (10 controls), 1-6 Cybersecurity in Information and Technology Project Management – Saudi NCA ECC (9 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (28)
1-1 Cybersecurity Strategy – Saudi NCA ECC
3 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::1-1-1 | 1-1-1 Cybersecurity strategy defined and approved |
| saudi-nca-ecc::1-1-2 | 1-1-2 Action plan executing the strategy |
| saudi-nca-ecc::1-1-3 | 1-1-3 Strategy reviewed at planned intervals |
1-10 Cybersecurity Awareness and Training Program – Saudi NCA ECC
10 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::1-10-1 | 1-10-1 Awareness programme developed and approved |
| saudi-nca-ecc::1-10-2 | 1-10-2 Awareness programme implemented |
| saudi-nca-ecc::1-10-3-1 | 1-10-3-1 Awareness: email and phishing |
| saudi-nca-ecc::1-10-3-2 | 1-10-3-2 Awareness: mobile devices and storage media |
| saudi-nca-ecc::1-10-3-3 | 1-10-3-3 Awareness: secure internet browsing |
| saudi-nca-ecc::1-10-3-4 | 1-10-3-4 Awareness: social media |
| saudi-nca-ecc::1-10-4-1 | 1-10-4-1 Training for cybersecurity department staff |
| saudi-nca-ecc::1-10-4-2 | 1-10-4-2 Training for developers and asset operators |
| saudi-nca-ecc::1-10-4-3 | 1-10-4-3 Training for executive and supervisory positions |
| saudi-nca-ecc::1-10-5 | 1-10-5 Awareness programme implementation reviewed |
1-2 Cybersecurity Management – Saudi NCA ECC
3 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::1-2-1 | 1-2-1 Independent cybersecurity department |
| saudi-nca-ecc::1-2-2 | 1-2-2 Cybersecurity positions filled by full-time qualified Saudi professionals |
| saudi-nca-ecc::1-2-3 | 1-2-3 Cybersecurity supervisory committee |
1-3 Cybersecurity Policies and Procedures – Saudi NCA ECC
4 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::1-3-1 | 1-3-1 Cybersecurity policies and procedures documented, approved and communicated |
| saudi-nca-ecc::1-3-2 | 1-3-2 Policies and procedures implemented |
| saudi-nca-ecc::1-3-3 | 1-3-3 Technical security standards supporting the policies |
| saudi-nca-ecc::1-3-4 | 1-3-4 Policies and procedures reviewed and updated |
1-4 Cybersecurity Roles and Responsibilities – Saudi NCA ECC
2 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::1-4-1 | 1-4-1 Cybersecurity governance structure, roles and responsibilities |
| saudi-nca-ecc::1-4-2 | 1-4-2 Roles and responsibilities reviewed |
1-5 Cybersecurity Risk Management – Saudi NCA ECC
7 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::1-5-1 | 1-5-1 Cybersecurity risk management methodology |
| saudi-nca-ecc::1-5-2 | 1-5-2 Risk methodology implemented |
| saudi-nca-ecc::1-5-3-1 | 1-5-3-1 Risk assessment at the early stage of technology projects |
| saudi-nca-ecc::1-5-3-2 | 1-5-3-2 Risk assessment before major infrastructure changes |
| saudi-nca-ecc::1-5-3-3 | 1-5-3-3 Risk assessment when planning third-party services |
| saudi-nca-ecc::1-5-3-4 | 1-5-3-4 Risk assessment before releasing new technology services and products |
| saudi-nca-ecc::1-5-4 | 1-5-4 Risk methodology reviewed |
1-6 Cybersecurity in Information and Technology Project Management – Saudi NCA ECC
9 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::1-6-1 | 1-6-1 Cybersecurity in project and change management |
| saudi-nca-ecc::1-6-2-1 | 1-6-2-1 Vulnerability assessment and remediation in projects and changes |
| saudi-nca-ecc::1-6-2-2 | 1-6-2-2 Secure configuration, hardening and patch review before launch |
| saudi-nca-ecc::1-6-3-1 | 1-6-3-1 Secure coding standards used |
| saudi-nca-ecc::1-6-3-2 | 1-6-3-2 Trusted and licensed development tools and libraries |
| saudi-nca-ecc::1-6-3-3 | 1-6-3-3 Compliance testing of software against cybersecurity requirements |
| saudi-nca-ecc::1-6-3-4 | 1-6-3-4 Secure integration between applications |
| saudi-nca-ecc::1-6-3-5 | 1-6-3-5 Hardening and patch review before launching software |
| saudi-nca-ecc::1-6-4 | 1-6-4 Project cybersecurity requirements reviewed |
1-7 Compliance with Cybersecurity Standards, Laws and Regulations – Saudi NCA ECC
1 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::1-7-1 | 1-7-1 Compliance with nationally approved international agreements |
1-8 Periodical Cybersecurity Review and Audit – Saudi NCA ECC
3 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::1-8-1 | 1-8-1 Periodic review of control implementation by the cybersecurity department |
| saudi-nca-ecc::1-8-2 | 1-8-2 Independent review and audit |
| saudi-nca-ecc::1-8-3 | 1-8-3 Audit results documented and presented |
1-9 Cybersecurity in Human Resources – Saudi NCA ECC
8 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::1-9-1 | 1-9-1 Personnel cybersecurity requirements defined |
| saudi-nca-ecc::1-9-2 | 1-9-2 Personnel cybersecurity requirements implemented |
| saudi-nca-ecc::1-9-3-1 | 1-9-3-1 Cybersecurity and non-disclosure clauses in employment contracts |
| saudi-nca-ecc::1-9-3-2 | 1-9-3-2 Screening or vetting for cybersecurity and privileged roles |
| saudi-nca-ecc::1-9-4-1 | 1-9-4-1 Awareness at onboarding and during employment |
| saudi-nca-ecc::1-9-4-2 | 1-9-4-2 Personnel comply with cybersecurity policies |
| saudi-nca-ecc::1-9-5 | 1-9-5 Access revoked at end of employment |
| saudi-nca-ecc::1-9-6 | 1-9-6 Personnel requirements reviewed |
2-1 Asset Management – Saudi NCA ECC
6 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::2-1-1 | 2-1-1 Asset management requirements defined and approved |
| saudi-nca-ecc::2-1-2 | 2-1-2 Asset management requirements implemented |
| saudi-nca-ecc::2-1-3 | 2-1-3 Acceptable use policy defined and communicated |
| saudi-nca-ecc::2-1-4 | 2-1-4 Acceptable use policy implemented |
| saudi-nca-ecc::2-1-5 | 2-1-5 Assets classified, labelled and handled |
| saudi-nca-ecc::2-1-6 | 2-1-6 Asset management requirements reviewed |
2-10 Vulnerabilities Management – Saudi NCA ECC
8 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::2-10-1 | 2-10-1 Vulnerability management requirements defined |
| saudi-nca-ecc::2-10-2 | 2-10-2 Vulnerability management implemented |
| saudi-nca-ecc::2-10-3-1 | 2-10-3-1 Periodic vulnerability assessment |
| saudi-nca-ecc::2-10-3-2 | 2-10-3-2 Vulnerability classification by severity |
| saudi-nca-ecc::2-10-3-3 | 2-10-3-3 Remediation by classification and risk |
| saudi-nca-ecc::2-10-3-4 | 2-10-3-4 Patching to remediate with pre-production testing |
| saudi-nca-ecc::2-10-3-5 | 2-10-3-5 Subscription to trusted vulnerability sources |
| saudi-nca-ecc::2-10-4 | 2-10-4 Vulnerability management implementation reviewed |
2-11 Penetration Testing – Saudi NCA ECC
5 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::2-11-1 | 2-11-1 Penetration testing requirements defined |
| saudi-nca-ecc::2-11-2 | 2-11-2 Penetration testing implemented |
| saudi-nca-ecc::2-11-3-1 | 2-11-3-1 Scope covers all internet-facing services |
| saudi-nca-ecc::2-11-3-2 | 2-11-3-2 Penetration tests conducted periodically |
| saudi-nca-ecc::2-11-4 | 2-11-4 Penetration testing implementation reviewed |
2-12 Cybersecurity Event Logs and Monitoring Management – Saudi NCA ECC
8 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::2-12-1 | 2-12-1 Event log and monitoring requirements defined |
| saudi-nca-ecc::2-12-2 | 2-12-2 Event log and monitoring implemented |
| saudi-nca-ecc::2-12-3-1 | 2-12-3-1 Event logs enabled on critical assets |
| saudi-nca-ecc::2-12-3-2 | 2-12-3-2 Logging of privileged accounts and remote access |
| saudi-nca-ecc::2-12-3-3 | 2-12-3-3 SIEM capability defined |
| saudi-nca-ecc::2-12-3-4 | 2-12-3-4 Continuous monitoring of event logs |
| saudi-nca-ecc::2-12-3-5 | 2-12-3-5 Log retention of at least 12 months |
| saudi-nca-ecc::2-12-4 | 2-12-4 Logging implementation reviewed |
2-13 Cybersecurity Incident and Threat Management – Saudi NCA ECC
8 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::2-13-1 | 2-13-1 Incident and threat management requirements defined |
| saudi-nca-ecc::2-13-2 | 2-13-2 Incident and threat management implemented |
| saudi-nca-ecc::2-13-3-1 | 2-13-3-1 Incident response plans and escalation |
| saudi-nca-ecc::2-13-3-2 | 2-13-3-2 Incident classification |
| saudi-nca-ecc::2-13-3-3 | 2-13-3-3 Reporting incidents to NCA |
| saudi-nca-ecc::2-13-3-4 | 2-13-3-4 Sharing notifications, threat intelligence and indicators with NCA |
| saudi-nca-ecc::2-13-3-5 | 2-13-3-5 Collecting and handling threat intelligence |
| saudi-nca-ecc::2-13-4 | 2-13-4 Incident management implementation reviewed |
2-14 Physical Security – Saudi NCA ECC
8 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::2-14-1 | 2-14-1 Physical protection requirements defined |
| saudi-nca-ecc::2-14-2 | 2-14-2 Physical protection implemented |
| saudi-nca-ecc::2-14-3-1 | 2-14-3-1 Authorised access to critical areas |
| saudi-nca-ecc::2-14-3-2 | 2-14-3-2 Access and monitoring logs (CCTV) |
| saudi-nca-ecc::2-14-3-3 | 2-14-3-3 Protection of access and monitoring log information |
| saudi-nca-ecc::2-14-3-4 | 2-14-3-4 Secure destruction and reuse of assets holding classified information |
| saudi-nca-ecc::2-14-3-5 | 2-14-3-5 Security of devices and equipment inside and outside facilities |
| saudi-nca-ecc::2-14-4 | 2-14-4 Physical protection requirements reviewed |
2-15 Web Application Security – Saudi NCA ECC
8 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::2-15-1 | 2-15-1 External web application protection requirements defined |
| saudi-nca-ecc::2-15-2 | 2-15-2 External web application protection implemented |
| saudi-nca-ecc::2-15-3-1 | 2-15-3-1 Web application firewall |
| saudi-nca-ecc::2-15-3-2 | 2-15-3-2 Multi-tier architecture |
| saudi-nca-ecc::2-15-3-3 | 2-15-3-3 Secure protocols such as HTTPS |
| saudi-nca-ecc::2-15-3-4 | 2-15-3-4 Secure usage policy published for users |
| saudi-nca-ecc::2-15-3-5 | 2-15-3-5 User authentication by impact assessment |
| saudi-nca-ecc::2-15-4 | 2-15-4 Web application requirements reviewed |
2-2 Identity and Access Management – Saudi NCA ECC
8 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::2-2-1 | 2-2-1 Identity and access management requirements defined and approved |
| saudi-nca-ecc::2-2-2 | 2-2-2 Identity and access management requirements implemented |
| saudi-nca-ecc::2-2-3-1 | 2-2-3-1 Single-factor authentication with username and password |
| saudi-nca-ecc::2-2-3-2 | 2-2-3-2 Multi-factor authentication for remote access and privileged accounts |
| saudi-nca-ecc::2-2-3-3 | 2-2-3-3 Authorisation on need-to-know, least privilege and segregation of duties |
| saudi-nca-ecc::2-2-3-4 | 2-2-3-4 Privileged access management |
| saudi-nca-ecc::2-2-3-5 | 2-2-3-5 Periodic review of identities and access rights |
| saudi-nca-ecc::2-2-4 | 2-2-4 IAM implementation reviewed |
2-3 Information System and Processing Facilities Protection – Saudi NCA ECC
7 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::2-3-1 | 2-3-1 System and processing facility protection requirements defined |
| saudi-nca-ecc::2-3-2 | 2-3-2 System and processing facility protection implemented |
| saudi-nca-ecc::2-3-3-1 | 2-3-3-1 Advanced malware protection on workstations and servers |
| saudi-nca-ecc::2-3-3-2 | 2-3-3-2 Strict restriction of external storage media |
| saudi-nca-ecc::2-3-3-3 | 2-3-3-3 Patch management for systems, applications and devices |
| saudi-nca-ecc::2-3-3-4 | 2-3-3-4 Central clock synchronisation to a trusted source |
| saudi-nca-ecc::2-3-4 | 2-3-4 System protection implementation reviewed |
2-4 Email Protection – Saudi NCA ECC
8 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::2-4-1 | 2-4-1 Email protection requirements defined |
| saudi-nca-ecc::2-4-2 | 2-4-2 Email protection implemented |
| saudi-nca-ecc::2-4-3-1 | 2-4-3-1 Advanced filtering of phishing and spam |
| saudi-nca-ecc::2-4-3-2 | 2-4-3-2 MFA for remote and webmail access |
| saudi-nca-ecc::2-4-3-3 | 2-4-3-3 Email archiving and backup |
| saudi-nca-ecc::2-4-3-4 | 2-4-3-4 Email protection against APTs and zero-day malware |
| saudi-nca-ecc::2-4-3-5 | 2-4-3-5 Domain validation with SPF, DKIM and DMARC |
| saudi-nca-ecc::2-4-4 | 2-4-4 Email protection implementation reviewed |
2-5 Networks Security Management – Saudi NCA ECC
12 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::2-5-1 | 2-5-1 Network security requirements defined |
| saudi-nca-ecc::2-5-2 | 2-5-2 Network security requirements implemented |
| saudi-nca-ecc::2-5-3-1 | 2-5-3-1 Secure segmentation with firewalls and defence in depth |
| saudi-nca-ecc::2-5-3-2 | 2-5-3-2 Production isolated from test and development |
| saudi-nca-ecc::2-5-3-3 | 2-5-3-3 Secure browsing with restrictions on risky sites |
| saudi-nca-ecc::2-5-3-4 | 2-5-3-4 Wireless network security |
| saudi-nca-ecc::2-5-3-5 | 2-5-3-5 Restriction and management of network services, protocols and ports |
| saudi-nca-ecc::2-5-3-6 | 2-5-3-6 Intrusion prevention systems |
| saudi-nca-ecc::2-5-3-7 | 2-5-3-7 DNS security |
| saudi-nca-ecc::2-5-3-8 | 2-5-3-8 Browsing channel protection against APTs |
| saudi-nca-ecc::2-5-3-9 | 2-5-3-9 DDoS protection |
| saudi-nca-ecc::2-5-4 | 2-5-4 Network security implementation reviewed |
2-6 Mobile Devices Security – Saudi NCA ECC
7 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::2-6-1 | 2-6-1 Mobile device and BYOD requirements defined |
| saudi-nca-ecc::2-6-2 | 2-6-2 Mobile device and BYOD requirements implemented |
| saudi-nca-ecc::2-6-3-1 | 2-6-3-1 Separation and encryption of entity data on devices |
| saudi-nca-ecc::2-6-3-2 | 2-6-3-2 Controlled use based on business need |
| saudi-nca-ecc::2-6-3-3 | 2-6-3-3 Wipe of entity data on loss or termination |
| saudi-nca-ecc::2-6-3-4 | 2-6-3-4 Security awareness for device users |
| saudi-nca-ecc::2-6-4 | 2-6-4 Mobile and BYOD implementation reviewed |
2-7 Data and Information Protection – Saudi NCA ECC
3 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::2-7-1 | 2-7-1 Data and information protection requirements defined |
| saudi-nca-ecc::2-7-2 | 2-7-2 Data protection implemented by classification |
| saudi-nca-ecc::2-7-3 | 2-7-3 Data protection implementation reviewed |
2-8 Cryptography – Saudi NCA ECC
6 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::2-8-1 | 2-8-1 Cryptography requirements defined |
| saudi-nca-ecc::2-8-2 | 2-8-2 Cryptography requirements implemented |
| saudi-nca-ecc::2-8-3-1 | 2-8-3-1 Approved cryptographic solutions and their restrictions |
| saudi-nca-ecc::2-8-3-2 | 2-8-3-2 Secure key management across the lifecycle |
| saudi-nca-ecc::2-8-3-3 | 2-8-3-3 Encryption in transit and at rest by classification |
| saudi-nca-ecc::2-8-4 | 2-8-4 Cryptography implementation reviewed |
2-9 Backup and Recovery Management – Saudi NCA ECC
6 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::2-9-1 | 2-9-1 Backup and recovery requirements defined |
| saudi-nca-ecc::2-9-2 | 2-9-2 Backup and recovery requirements implemented |
| saudi-nca-ecc::2-9-3-1 | 2-9-3-1 Backups cover critical assets |
| saudi-nca-ecc::2-9-3-2 | 2-9-3-2 Quick recovery after incidents |
| saudi-nca-ecc::2-9-3-3 | 2-9-3-3 Periodic testing of backup recovery |
| saudi-nca-ecc::2-9-4 | 2-9-4 Backup implementation reviewed |
3-1 Cybersecurity Resilience Aspects of Business Continuity Management – Saudi NCA ECC
6 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::3-1-1 | 3-1-1 Cybersecurity requirements in business continuity defined |
| saudi-nca-ecc::3-1-2 | 3-1-2 Cybersecurity requirements in business continuity implemented |
| saudi-nca-ecc::3-1-3-1 | 3-1-3-1 Continuity of cybersecurity systems and procedures |
| saudi-nca-ecc::3-1-3-2 | 3-1-3-2 Response plans for incidents affecting continuity |
| saudi-nca-ecc::3-1-3-3 | 3-1-3-3 Disaster recovery plans |
| saudi-nca-ecc::3-1-4 | 3-1-4 Business continuity requirements reviewed |
4-1 Third-Party Cybersecurity – Saudi NCA ECC
7 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::4-1-1 | 4-1-1 Third-party contract requirements defined |
| saudi-nca-ecc::4-1-2-1 | 4-1-2-1 Non-disclosure and secure data removal clauses |
| saudi-nca-ecc::4-1-2-2 | 4-1-2-2 Incident communication procedures |
| saudi-nca-ecc::4-1-2-3 | 4-1-2-3 Third party bound to the entity's requirements |
| saudi-nca-ecc::4-1-3-1 | 4-1-3-1 Risk assessment before signing |
| saudi-nca-ecc::4-1-3-2 | 4-1-3-2 Managed security centres located in the Kingdom |
| saudi-nca-ecc::4-1-4 | 4-1-4 Third-party requirements reviewed |
4-2 Cloud Computing and Hosting Cybersecurity – Saudi NCA ECC
5 controls
| Code | Title |
|---|---|
| saudi-nca-ecc::4-2-1 | 4-2-1 Cloud and hosting requirements defined |
| saudi-nca-ecc::4-2-2 | 4-2-2 Cloud and hosting requirements implemented |
| saudi-nca-ecc::4-2-3-1 | 4-2-3-1 Provider protects data by classification and returns it |
| saudi-nca-ecc::4-2-3-2 | 4-2-3-2 Separation of the entity's cloud environment |
| saudi-nca-ecc::4-2-4 | 4-2-4 Cloud and hosting requirements reviewed |
What is Saudi NCA ECC and who does it apply to?
Saudi NCA ECC is a compliance framework from Saudi Arabia with 28 domains and 176 controls. The Saudi National Cybersecurity Authority's Essential Cybersecurity Controls, second edition (ECC-2:2024): the mandatory minimum cybersecurity requirements for government agencies, their affiliates and private operators of critical national infrastructure, in four domains (governance, defense, resilience, third-party and cloud), 28 subdomains, 108 main controls and 92 subcontrols. 176 leaves read against the complete NCA text; replaces ECC-1:2018. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Saudi NCA ECC actually require?
Saudi NCA ECC has 176 controls organised across 28 domains. The largest domains are 2-5 Networks Security Management – Saudi NCA ECC (12 controls), 1-10 Cybersecurity Awareness and Training Program – Saudi NCA ECC (10 controls), 1-6 Cybersecurity in Information and Technology Project Management – Saudi NCA ECC (9 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Saudi NCA ECC do I already cover?
Saudi NCA ECC does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Saudi NCA ECC?
Start your Saudi NCA ECC compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Saudi NCA ECC requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 176 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required