Saudi Arabia

NCA Essential Cybersecurity Controls

The Essential Cybersecurity Controls are the Saudi National Cybersecurity Authority’s minimum baseline for government entities and the organisations that own or operate critical national infrastructure. First issued in 2018 and revised in 2024, the ECC organise over a hundred controls into five domains: governance, defence, resilience, third-party and cloud computing, and industrial control systems. Organisations assess their compliance and report it to the NCA.

The ECC ask whether each control is implemented and effective. DECIMA answers from the system, not the policy.

At a glance

Issued by

National Cybersecurity Authority (NCA), Saudi Arabia

Applies to

Government entities and organisations that own, operate or host critical national infrastructure, including private-sector operators

In force

ECC-1 since 2018; the revised ECC-2 issued in 2024

Supervised by

The NCA, through compliance assessments and reporting

What the mandate requires

The obligations as the regulation states them, in the order a programme meets them.

1. 01

   Cybersecurity governance

   Strategy, management, policies, roles, risk management, project and change security, compliance, audit, human-resources security and awareness.

2. 02

   Cybersecurity defence

   Asset management, identity and access, information-system and processing-facility protection, email and network security, mobile devices, data protection, cryptography, backup, vulnerability and penetration testing, event logging and monitoring, incident and threat management, and physical security.

3. 03

   Cybersecurity resilience

   Cybersecurity embedded in business continuity management, with recovery capabilities tested.

4. 04

   Third-party and cloud computing

   Cybersecurity requirements for third-party providers and for cloud services, including data-location and hosting conditions.

5. 05

   Industrial control systems

   Controls for operational technology and industrial control environments where the organisation operates them.

How DECIMA evidences it

Each requirement is answered from live systems with a dated, re-verifiable record, not from a questionnaire completed for the assessment.

• Defence controls read continuously

  Identity, network, endpoint, logging, backup and vulnerability controls are read from the systems that operate them on a schedule, each read stored with its timestamp and the ECC version applied.

• Assessment produced from the record

  The compliance assessment reported to the NCA is generated control by control from dated evidence rather than from a questionnaire completed for the assessment.

• Third-party and cloud conditions evidenced

  Provider assessments, hosting locations and contractual conditions are held as structured records linked to the controls they satisfy.

• Continuity tests recorded

  Recovery tests are recorded with scope, results and remediation, linked to the resilience controls they exercised.

04

Questions buyers ask

Short answers you can quote.