NCA ECC Compliance
Navigate Saudi Arabia's Essential Cybersecurity Controls with confidence: 108 controls, 4 domains, one clear path to compliance.
What is NCA ECC-2:2024?
The Essential Cybersecurity Controls (ECC) is Saudi Arabia's mandatory cybersecurity framework issued by the National Cybersecurity Authority (NCA). Version 2:2024 restructures the original 2018 framework into 108 main controls and 92 subcontrols across 4 domains and 28 subdomains, spanning governance, defence, resilience, and third-party and cloud computing cybersecurity.
Compliance is not optional: NCA conducts periodic assessments of government entities, critical infrastructure operators, and designated private-sector organisations. Non-compliance carries regulatory penalties and can restrict an organisation's ability to operate.
4 ECC domains, 108 controls
Cybersecurity Governance
Domain 1Strategy, policies, roles and responsibilities, risk management, compliance, audit, human resources, and awareness and training.
Cybersecurity Defence
Domain 2Asset management, identity and access control, system and network security, application security, cryptography, and vulnerability and patch management.
Cybersecurity Resilience
Domain 3Business continuity and disaster recovery aspects of cybersecurity, and incident and threat management.
Third-Party & Cloud Computing Cybersecurity
Domain 4Supply chain and outsourcing controls, and cybersecurity requirements for cloud services and hosting.
Our 6-phase approach
Discovery & Scoping
2 weeksInventory assets, identify applicable ECC controls, and define assessment boundaries.
Gap Assessment
3–4 weeksEvaluate current controls against all 108 ECC main controls with a risk-rated gap report.
Remediation Roadmap
1 weekPrioritised action plan with quick wins, resource estimates, and timeline.
Control Implementation
6–12 weeksDeploy technical controls, draft policies, and configure monitoring tools.
Evidence & Documentation
2–3 weeksBuild evidence packages, control matrices, and prepare for NCA assessment.
Mock Assessment & Support
2 weeksSimulate NCA assessment, remediate findings, and provide on-site support during official review.
Common compliance challenges
Ready for your NCA assessment?
Start with a free compliance gap analysis to understand where you stand.
NCA ECC Compliance FAQ
Find answers to common questions about our services