Security Lights the Way

Cybersecurity frameworks & operations

NCA ECC

Essential Cybersecurity Controls (ECC), National Cybersecurity Authority, Kingdom of Saudi Arabia

Saudi Arabia's baseline cybersecurity controls for government bodies and operators of critical national infrastructure, issued by the National Cybersecurity Authority.

Law / regulation Legally binding where it applies Saudi Arabia

Official source: National Cybersecurity Authority ↗

Written by
MajorCyber™ Editorial
Last reviewed
Reading time
1 min

Researched and drafted with AI assistance from the official sources listed on this page. See our editorial policy.

Profile. A short orientation to NCA ECC: what it is, who it applies to and its key duties. A full MajorCyber™ guide is on the research roadmap; until then, rely on the official source for detail.

What are the NCA’s Essential Cybersecurity Controls?

The Essential Cybersecurity Controls (ECC) are the minimum cybersecurity requirements set by Saudi Arabia’s National Cybersecurity Authority (NCA). They were first published in 2018 and updated in 2024. They are a national baseline, and the NCA builds more specific control sets on top of them.

Who does it apply to?

Government organisations in Saudi Arabia, including ministries, authorities and public bodies, and their companies and entities. They also apply to private-sector organisations that own, operate or host critical national infrastructure. Many other organisations adopt the ECC voluntarily or because customers require it.

The five domains

  1. Cybersecurity governance: strategy, management, policies, roles, risk management, cybersecurity in projects, compliance, periodic review, human resources and awareness.
  2. Cybersecurity defence: asset management, identity and access, protection of systems and devices, email and network security, mobile security, data protection, cryptography, backup, vulnerability management, penetration testing, event logging and monitoring, incident and threat management, physical security and web application security.
  3. Cybersecurity resilience: cybersecurity within business continuity.
  4. Third-party and cloud computing cybersecurity: requirements for suppliers, outsourcing and cloud use.
  5. Industrial control systems cybersecurity: protection of OT and ICS environments.

The NCA also publishes the Cloud Cybersecurity Controls (CCC), Critical Systems Cybersecurity Controls (CSCC), Operational Technology Cybersecurity Controls (OTCC), and controls for data, telework and social media accounts. Organisations in scope apply these in addition to the ECC.

How does it relate to other frameworks?

The ECC’s structure is comparable to ISO/IEC 27001 Annex A and NIST CSF, but compliance is assessed against the NCA’s own text and tools. Personal data protection in Saudi Arabia is governed separately by the PDPL.

Sources and official references

  1. National Cybersecurity Authority — National Cybersecurity Authority (official source)

Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.

This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with National Cybersecurity Authority (NCA), Kingdom of Saudi Arabia.

Keep exploring

Voluntary framework

NIST CSF 2.0

NIST's voluntary, outcome-based framework for understanding, assessing, prioritising and communicating cybersecurity risk, organised into six functions including the new Govern function.

United States · International

Law / regulation Profile

CERT-In Directions

India's mandatory cyber incident reporting rules: specified incidents must be reported to CERT-In within six hours, with log retention and clock synchronisation duties.

India

Law / regulation Profile

Cyber Resilience Act

The EU regulation that requires hardware and software products with digital elements to be secure by design and supported with security updates for their lifetime.

European Union

Voluntary framework Profile

Essential Eight

The Australian Signals Directorate's eight prioritised mitigation strategies against cyber threats, with a maturity model from level zero to three.

Australia

Law / regulation Profile

NIS2

The EU directive that sets cybersecurity risk-management, governance and incident-reporting duties for essential and important entities in critical sectors.

European Union