NCA Essential Cybersecurity Controls (ECC): who must comply, with a readiness checklist

The NCA Essential Cybersecurity Controls (ECC-2:2024) are mandatory for Saudi government agencies, their affiliated companies and entities inside and outside the Kingdom, and private entities that own, operate or host critical national infrastructure [1]. Other companies are strongly encouraged, not required, to use them [2]. Readiness starts with confirming your scope in writing.

This guide sets out the ECC's scope in the National Cybersecurity Authority's (NCA) own terms, how it relates to NCA's separate controls for other private companies, what changed in the 2024 version, which requirements surprise first-time readers, and a 12-point readiness checklist. It is general information; for a decision about your own entity, rely on NCA's official text or a licensed advisor.

What are the NCA Essential Cybersecurity Controls?

The ECC sets the minimum cybersecurity requirements for national entities within its scope [2]. NCA issued the first version, ECC-1:2018, and announced the update to the current version in October 2024 [3]. The current document, ECC-2:2024, contains [1]:

• 4 main domains;
• 28 subdomains;
• 108 main controls;
• 92 subcontrols.

The controls aim at three protection goals, confidentiality, integrity and availability, and build on four pillars: strategy, people, process and technology [2]. NCA publishes the document in Arabic and English, and states that the Arabic version is binding for any question of meaning or interpretation [2].

The legal basis is NCA's statute and High Order No. 57231 dated 10/11/1439H. Under Article 10(3) of the statute and that order, every entity within the scope must take the measures needed for ongoing and continuous compliance [2].

Who must comply with the ECC, in NCA's words

NCA defines the scope in one sentence. The controls apply to [1][2]:

• Government agencies in Saudi Arabia, including ministries, authorities, establishments and others;
• their affiliated companies and entities, inside and outside the Kingdom;
• all private-sector entities that own, operate or host critical national infrastructure (CNI).

NCA then "strongly encourages" all other entities in the Kingdom to use the controls to improve their cybersecurity [2]. Encouragement is not an obligation, which is why a statement such as "every Saudi company must comply with the ECC" is inaccurate.

The ECC defines critical national infrastructure as essential elements of infrastructure, meaning assets, facilities, systems, networks, processes and the key people who run them, whose loss or compromise could significantly affect the availability or delivery of basic services, cause serious loss of property or lives, or significantly affect national security, defence or the economy [2]. If you are unsure whether your company counts as a CNI operator, ask your sector regulator or NCA rather than deciding alone.

Within an entity in scope, every applicable control must be met [2]. Applicability varies with the business: for example, the cloud computing and hosting controls in subdomain 4-2 bind only entities that use, or plan to use, cloud or hosting services [2].

Does the ECC bind your private company? ECC, NCNICC or neither

Most private companies are not CNI operators and are not affiliated with a government agency. For them, NCA issued a separate document in 2025: the Non-CNI Private Sector Entities Cybersecurity Controls (NCNICC-1:2025), developed from the ECC as a version better suited to large, medium and small private entities [4].

NCNICC's size bands follow the definition of the Small and Medium Enterprises General Authority (Monsha'at) [4][5]. Two practical consequences follow. First, a notified small or medium company faces 26 defensive controls rather than the ECC's 108. Second, a company that serves government or CNI clients meets ECC requirements through its contracts even when the ECC does not bind it directly: control 4-1-2 requires in-scope entities to include non-disclosure, secure data removal at the end of service, incident communication procedures and an obligation to follow their cybersecurity requirements in third-party contracts [2].

Entities that run industrial control systems should also read NCA's Operational Technology Cybersecurity Controls (OTCC-1:2022), which extend the ECC to those systems [7].

ECC-2:2024 at a glance: four domains and 28 subdomains

Source: ECC-2:2024, subdomain list [2].

What changed from ECC-1:2018

NCA's appendix of updates lists the changes against the 2018 version [2]. The ones with the most practical effect:

The last change matters for any entity choosing a cloud provider. Data location questions now go to the National Data Management Office rather than being settled by the ECC alone [2]; our guide to data residency in Saudi Arabia covers the related personal data rules.

Requirements that surprise first-time readers

Several ECC controls go further than a typical commercial security standard. All of the following come from ECC-2:2024 [2]:

• An independent department (1-2-1). The cybersecurity department must be independent of the IT and communications department, as High Order No. 37140 dated 14/08/1438H requires, and NCA recommends that it report to the head of the entity.
• Saudi staffing (1-2-2). Every cybersecurity position must be filled by full-time, qualified Saudi professionals.
• A supervisory committee (1-2-3) that includes the head of the cybersecurity department.
• Independent audit (1-8-2). Parties other than the cybersecurity department must review and audit the controls, following generally accepted auditing standards.
• Risk assessments at set moments (1-5-3): early in technology projects, before major infrastructure changes, when planning third-party services, and before launching new technology services.
• Secure development (1-6-3): secure coding standards, trusted and licensed sources for development tools and libraries, and compliance testing before release.
• Trusted time (2-3-3-4): central clock synchronisation with an accurate source, such as those of the Saudi Standards, Metrology and Quality Organization.
• Twelve months of logs (2-12-3): security event logging for critical assets and privileged accounts, continuous monitoring, and retention of at least 12 months.
• Reporting to NCA (2-13-3): incidents must be reported to NCA, and incident notifications and threat intelligence shared with it.
• Testing the outside (2-11-3): periodic penetration tests covering every internet-facing service, including websites, mobile apps, email and remote access.
• Monitoring inside the Kingdom (4-1-3-2): managed security operations centres that use remote access must be located entirely in Saudi Arabia.

Personal data breaches add a separate duty. The PDPL's Implementing Regulation requires notice to the competent authority within 72 hours where harm is likely, and states that this does not affect any duty to report incidents under NCA's rules [11].

How NCA checks compliance

NCA assesses compliance through self-assessment by the entity, periodic reports from its compliance tool, field audit visits, or any mechanism it considers appropriate [2]. ECC-2:2024 also announces an assessment and compliance tool to organise how entities measure their compliance [2]. NCA's ECC page publishes the controls together with a Guide to ECC Implementation [8].

In practice, this means evidence matters as much as controls: approved documents, records of reviews, test results and audit reports. The checklist below lists the evidence to keep for each area.

ECC readiness checklist: 12 points

Use it as a first gap assessment. Mark each row yes, partly or no, and attach the evidence.

To draft missing documents, NCA publishes free templates for policies, standards, procedures and registers, which it describes as intended for government, private and other entities [9].

How to choose cybersecurity companies to help

Most entities bring in outside help for gap assessments, monitoring or penetration testing. A few checks narrow the field:

• Registration or licence. In October 2026, NCA reminded providers of cybersecurity services, products and solutions in the Kingdom that they must register on the national cybersecurity portal, Haseen, for activities that do not require an NCA licence [10]. Ask every candidate for its registration or licence.
• Location. If the service is a managed security operations centre with remote access, it must be located entirely in Saudi Arabia [2].
• Contract terms. Before signing, run a cybersecurity risk assessment, and include the clauses that control 4-1 requires [2].
• Accountability. An outside firm can do the work, but NCA's statute states that no entity is relieved of responsibility for its own cybersecurity [2].

Our guide to choosing a software development company in Saudi Arabia offers a written-question method that also works for security providers.

Your next step

This week, write a one-page scoping memo: which sentence of the ECC's scope applies to you, or why it does not, and whether NCNICC or a client contract applies instead. If the ECC does apply, run the 12-point readiness table as a first gap assessment and attach the evidence to each row. The NCA Essential Cybersecurity Controls reward entities that can show their work, not only do it. You can read about O AI, a software and AI company in Al Khobar, on our home page.