Compliance guide · Saudi Arabia
NCA ECC-2:2024: a practical compliance guide
The Essential Cybersecurity Controls (ECC) are the National Cybersecurity Authority's baseline for organisations in Saudi Arabia. The current edition, ECC-2:2024, replaces ECC-1:2018. This guide explains in plain terms who it applies to, how to prepare, and how it lines up with ISO/IEC 27001. It does not reproduce the controls. Use the official document from NCA for the requirement text; NCA states that the Arabic version is binding.
What it is and who must comply
Regulator and edition
ECC is issued by the National Cybersecurity Authority (NCA). ECC-2:2024 is the second edition; the first was ECC-1:2018. NCA reviews and republishes the controls periodically, so always check nca.gov.sa for the latest version.
Who must comply
- Government agencies in the Kingdom, including ministries, authorities and establishments, and their affiliated companies and entities, inside and outside the Kingdom.
- Private-sector entities that own, operate or host Critical National Infrastructure (CNI).
NCA strongly encourages every other organisation in the Kingdom to use the controls as good practice.
How it is structured
ECC-2:2024 has 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols. The domains cover governance (domain 1), defence (domain 2), resilience (domain 3), and third-party and cloud security (domain 4). The industrial control systems domain from ECC-1 is no longer in ECC; NCA moved it to its separate Operational Technology Cybersecurity Controls (OTCC).
Some controls only apply if you use certain technology. For example, subdomain 4-2 applies only to entities that use, or plan to use, cloud computing and hosting services.
How compliance is checked
NCA evaluates compliance through self-assessment by the entity, periodic reports from its compliance tool, and field audit visits, using whichever mechanism it considers appropriate.
How to comply
- Confirm you are in scope and record why: government entity, affiliate, or CNI owner, operator or host.
- Obtain the official text of ECC-2:2024 from nca.gov.sa. Work from the Arabic version for interpretation questions.
- Decide applicability control by control. Mark technology-dependent controls (such as cloud, subdomain 4-2) as applicable or not, with the reason.
- Run a gap assessment against every applicable control, domain by domain.
- Assign an owner and a due date to every gap, and track remediation to closure.
- Collect evidence per control and set an expiry date, so stale evidence is visible before an assessment.
- Prepare for NCA's assessment mechanisms: keep your self-assessment current and your evidence ready for a field audit.
- Review periodically and whenever NCA publishes an update.
Evidence checklist
- Approved cybersecurity strategy, policies and procedures, with review dates
- Cybersecurity function, roles and responsibilities, and the authorising official's approval
- Cybersecurity risk assessments and treatment plans
- Asset inventory
- Identity and access records: access requests, privileged account list, periodic access reviews, MFA configuration
- Vulnerability scans, penetration test reports and remediation records
- Log monitoring and incident records
- Backup and restore test results
- Business continuity plans that cover cybersecurity, with test results
- Third-party and cloud provider contracts and security assessments
- Awareness and training records
How it maps to ISO/IEC 27001:2022
Domain-level only. This table is Pravitrust's interpretation for planning evidence reuse; it is not a mapping published by the regulator or by ISO.
| NCA ECC-2:2024 | ISO/IEC 27001:2022 |
|---|---|
| Domain 1: governance | Clauses 4-10 (ISMS); A.5 organisational controls such as policies, roles, risk, compliance; A.6 people controls |
| Domain 2: defence | A.5 (asset, access, information transfer), A.7 physical controls, A.8 technological controls |
| Domain 3: resilience | A.5.29 and A.5.30 (security during disruption, ICT readiness for business continuity) |
| Domain 4: third-party and cloud | A.5.19 to A.5.23 (supplier relationships and cloud services) |
How to choose software for NCA ECC-2:2024
These criteria are neutral: they apply to any tool you evaluate, including Pravitrust.
- Regulator mapping you can trace. The tool should hold the framework's own identifiers and structure, and show which version it carries. Ask how it is updated when the regulator issues a revision.
- Licence-known content. Ask where the control content came from and on what terms. A vendor that cannot answer has a problem you will inherit.
- Evidence reuse. One piece of evidence should be attachable to every control it supports, across frameworks, without uploading it twice.
- Arabic support. Check the user interface, reports and exports separately; support in one does not imply the others.
- Hosting location. Ask where data and backups are stored, and match that against your own data-residency obligations and any sector rules.
- Honest status. A control with no test or evidence should never display as compliant.
- Exit. Confirm you can export everything, including history, in an open format.
- Edition handling. ECC-1:2018 and ECC-2:2024 differ in structure. A tool should let you hold both during a transition without merging their results.
Where Pravitrust stands today
- Adopt a framework pack into your control library at the scope that applies to you, with the pack version recorded so later assessments stay tied to the revision you assessed against.
- Attach evidence to each control, with an expiry date and reminders when evidence goes stale.
- Show a control with no test result as untested, never as healthy.
- Keep an append-only, hash-chained audit trail of changes.
- Export registers to CSV or Excel.
Moving from ServiceNow or Archer
Pravitrust does not import data from ServiceNow, Archer or any other GRC platform today. An import and migration feature is in design and is not available yet; this page will say so when it ships.
What you can do today:
- Export your current register from the existing tool so you hold a complete copy, including history, before you change anything.
- Adopt the framework pack in Pravitrust at your scope.
- Record control status and attach evidence against each control. Evidence you already hold for ISO/IEC 27001 can be attached to the controls it supports.
- Run both systems in parallel until your next assessment cycle closes, then retire the old one.
Frequently asked questions
Is ECC-2:2024 mandatory?
It is mandatory for government agencies, their affiliated companies and entities, and private-sector entities that own, operate or host Critical National Infrastructure. NCA encourages all other organisations in Saudi Arabia to use it.
What changed from ECC-1:2018?
ECC-2:2024 has 4 main domains instead of 5. The industrial control systems domain moved to NCA's Operational Technology Cybersecurity Controls (OTCC). NCA's document lists the full set of updates in an appendix.
How big is ECC-2:2024?
4 main domains, 28 subdomains, 108 main controls and 92 subcontrols.
Which language is authoritative?
NCA states that the Arabic version is binding for any question of meaning or interpretation.
How does NCA check compliance?
Through self-assessment by the entity, periodic reports from NCA's compliance tool, and field audit visits, as NCA considers appropriate.
Do the cloud controls apply to everyone?
No. Subdomain 4-2 applies to entities that use, or plan to use, cloud computing and hosting services.
Does ISO/IEC 27001 certification mean I comply with ECC?
No. There is substantial overlap, so ISO evidence can be reused, but ECC has its own requirements and NCA assesses against ECC, not ISO.