Introduction to NCA ECC
The Essential Cybersecurity Controls (ECC) is a comprehensive mandatory cybersecurity framework issued by the Saudi National Cybersecurity Authority (NCA) in 2018 and updated in 2024. It establishes minimum security requirements for protecting national cyberspace and critical information infrastructure in the Kingdom of Saudi Arabia.
About the National Cybersecurity Authority (NCA)
Established: Royal Decree in 2017
Mission: Protect Kingdom's vital interests, national security, and critical infrastructure
Authority: Reports directly to the King
NCA Responsibilities:
Develop national cybersecurity strategy
Issue cybersecurity regulations and frameworks
Monitor compliance across sectors
Coordinate national incident response
Build national cybersecurity capabilities
Why NCA ECC Matters
National Security:
Protects critical national infrastructure
Ensures government service continuity
Defends against nation-state threats
Supports Vision 2030 digital transformation
Regulatory Compliance:
Mandatory for covered entities
Subject to NCA audits and inspections
Non-compliance penalties apply
Certification requirements
Key Definitions
Cybersecurity:
The collection of tools, policies, security concepts, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies used to protect the organization's assets.
Essential Cybersecurity Controls:
Minimum mandatory cybersecurity requirements that must be implemented by covered entities.
Critical National Infrastructure (CNI):
Systems and assets vital to national security, economy, public health, and safety.
Information Assets:
All information, systems, networks, and related resources owned or operated by an organization.
Cybersecurity Incident:
Any event that actually or potentially jeopardizes the confidentiality, integrity, or availability of information systems.
Scope and Applicability
Mandatory Compliance:
All government entities
Government-owned companies
Critical National Infrastructure operators
Organizations processing government data
Service providers to government
Industry Sectors Covered:
Energy and utilities (oil, gas, electricity, water)
Finance and banking
Healthcare and medical services
Telecommunications
Transportation (aviation, maritime, land)
Government services
Defense and security
Education
Food and agriculture
Framework Structure
The ECC-1:2018 (Updated 2024) consists of:
5 Main Domains
29 Subdomains
114 Controls
3 Maturity Levels (Basic, Advanced, Optimized)
Core Principles
Seven Cybersecurity Principles
1. Risk-Based Approach:
Risk assessment driven
Proportionate controls
Business context consideration
Continuous risk evaluation
2. Defense in Depth:
Multiple security layers
Redundant controls
No single point of failure
Comprehensive protection
3. Least Privilege:
Minimum necessary access
Role-based permissions
Regular access reviews
Just-in-time access
4. Segregation of Duties:
Separation of critical functions
Dual control for sensitive operations
Prevention of fraud
Accountability mechanisms
5. Security by Design:
Built-in security
Secure architecture
Security in SDLC
Proactive protection
6. Continuous Monitoring:
Real-time visibility
Threat detection
Performance measurement
Compliance verification
7. Resilience:
Business continuity
Rapid recovery
Incident response
Crisis management
Domain 1: Cybersecurity Governance (1-x)
1-1: Cybersecurity Strategy
Control Requirement:
Develop and maintain a documented cybersecurity strategy aligned with organizational objectives and national cybersecurity requirements.
Implementation Requirements:
Board-approved cybersecurity strategy
Alignment with business objectives
Integration with Vision 2030
Annual review and update
Resource allocation plan
Evidence Required:
Approved strategy document
Board meeting minutes showing approval
Annual review records
Budget allocation documents
Implementation roadmap
1-2: Cybersecurity Policies
Control Requirement:
Establish comprehensive cybersecurity policies covering all aspects of information security.
Required Policies:
Information Security Policy
Acceptable Use Policy
Access Control Policy
Data Classification Policy
Incident Response Policy
Business Continuity Policy
Remote Access Policy
Mobile Device Policy
Third-Party Security Policy
Physical Security Policy
Evidence Required:
Policy documents with version control
Approval signatures
Communication records
Acknowledgment records
Review schedules
1-3: Cybersecurity Roles and Responsibilities
Control Requirement:
Define and assign cybersecurity roles and responsibilities across the organization.
Required Roles:
Chief Information Security Officer (CISO)
Cybersecurity Manager
Security Operations Center (SOC) Team
Incident Response Team
Security Architects
Security Analysts
Compliance Officers
Responsibilities Matrix:
Executive leadership accountability
Department-level responsibilities
Individual user responsibilities
Third-party responsibilities
1-4: Cybersecurity Risk Management
Control Requirement:
Implement a comprehensive risk management framework for identifying, assessing, and treating cybersecurity risks.
Risk Management Process:
Risk identification methods
Risk assessment methodology
Risk treatment options
Risk acceptance criteria
Risk monitoring procedures
Documentation Requirements:
Risk register
Risk assessment reports
Treatment plans
Acceptance records
Monitoring reports
1-5: Cybersecurity Awareness and Training
Control Requirement:
Establish and maintain a cybersecurity awareness and training program for all personnel.
Training Requirements:
New employee security orientation
Annual security awareness training
Role-specific technical training
Phishing simulation exercises
Incident response drills
Training Topics:
Password security
Phishing awareness
Social engineering
Data handling
Incident reporting
Mobile security
Physical security
1-6: Cybersecurity in Project Management
Control Requirement:
Integrate cybersecurity requirements into all project management processes.
Implementation:
Security requirements in project initiation
Security design reviews
Security testing before deployment
Change management security
Post-implementation review
1-7: Compliance Management
Control Requirement:
Ensure compliance with applicable laws, regulations, and contractual requirements.
Compliance Areas:
NCA regulations
Sector-specific regulations (SAMA, CITC, etc.)
Data protection requirements
International standards
Contractual obligations
Domain 2: Cybersecurity Defense (2-x)
2-1: Asset Management
Control Requirement:
Maintain a complete and accurate inventory of all information assets.
Asset Categories:
Hardware assets (servers, workstations, network devices)
Software assets (applications, operating systems)
Data assets (databases, files, records)
Network assets (IP addresses, domains)
Cloud assets (services, instances)
People assets (skills, knowledge)
Inventory Requirements:
Unique asset identifier
Asset type and category
Location (physical/logical)
Owner and custodian
Classification level
Criticality rating
Lifecycle status
2-2: Data Classification and Protection
Control Requirement:
Implement data classification scheme and protection controls based on sensitivity.
Classification Levels:
Top Secret (سري للغاية):
National security impact
Strictest controls
Limited access
Encryption required
Secret (سري):
Significant harm potential
Strong access controls
Audit logging
Secure transmission
Confidential (محظور):
Internal use only
Standard access controls
Controlled distribution
Public (عام):
No restrictions
Basic integrity controls
Protection Controls by Level:
Encryption requirements
Access restrictions
Handling procedures
Transmission security
Storage requirements
Disposal methods
2-3: Identity and Access Management
Control Requirement:
Implement comprehensive identity and access management controls.
IAM Components:
User Provisioning:
Formal request process
Manager approval
HR verification
Automated provisioning
Timely deprovisioning
Authentication:
Strong password policy (minimum 12 characters)
Multi-factor authentication (MFA) required
Biometric options
Single Sign-On (SSO)
Certificate-based authentication
Authorization:
Role-based access control (RBAC)
Attribute-based access control (ABAC)
Need-to-know principle
Segregation of duties
Access Reviews:
Quarterly access reviews
Annual recertification
Automated detection of orphan accounts
Privileged access reviews
2-4: Privileged Access Management
Control Requirement:
Implement enhanced controls for privileged accounts and access.
PAM Requirements:
Privileged account inventory
Dedicated privileged workstations
Just-in-time access
Session recording
Password vaulting
Emergency access procedures
Privileged Account Types:
System administrators
Database administrators
Network administrators
Application administrators
Service accounts
Emergency accounts
2-5: Cryptography
Control Requirement:
Implement cryptographic controls to protect data confidentiality and integrity.
Encryption Requirements:
Data at rest encryption (AES-256)
Data in transit encryption (TLS 1.2+)
Key management procedures
Certificate management
Hardware security modules (HSM)
Key Management:
Key generation procedures
Key distribution security
Key storage protection
Key rotation schedules
Key destruction procedures
2-6: Physical Security
Control Requirement:
Implement physical security controls to protect information processing facilities.
Physical Controls:
Secure perimeter
Access control systems
CCTV surveillance
Environmental controls
Visitor management
Clean desk policy
Data Center Security:
Restricted access zones
Biometric access
Mantrap entries
24/7 monitoring
Fire suppression
Power redundancy
2-7: Network Security
Control Requirement:
Implement comprehensive network security controls.
Network Security Controls:
Network Segmentation:
DMZ architecture
VLAN segregation
Microsegmentation
Network access control
Perimeter Security:
Next-generation firewalls
Intrusion prevention systems
Web application firewalls
DDoS protection
Email security gateways
Internal Security:
Internal firewalls
Network monitoring
Traffic analysis
Anomaly detection
Wireless Security:
WPA3 encryption
RADIUS authentication
Rogue AP detection
Guest network isolation
2-8: Endpoint Security
Control Requirement:
Implement endpoint security controls for all devices.
Endpoint Controls:
Endpoint detection and response (EDR)
Antimalware protection
Host-based firewall
Application whitelisting
Device encryption
USB control
Patch management
Mobile Device Management:
MDM/UEM solution
Remote wipe capability
Container separation
App management
Compliance enforcement
2-9: Application Security
Control Requirement:
Implement secure application development and deployment practices.
Secure SDLC:
Security requirements
Threat modeling
Secure coding standards
Code review
Security testing
Vulnerability management
Application Security Testing:
Static analysis (SAST)
Dynamic analysis (DAST)
Software composition analysis (SCA)
Penetration testing
API security testing
2-10: Security Operations
Control Requirement:
Establish security operations capabilities for continuous monitoring and response.
SOC Capabilities:
24/7 monitoring
SIEM deployment
Threat intelligence
Incident detection
Initial response
Escalation procedures
Security Monitoring:
Log collection and analysis
Alert management
Correlation rules
Threat hunting
Reporting dashboards
2-11: Vulnerability Management
Control Requirement:
Implement systematic vulnerability identification and remediation.
Vulnerability Process:
Asset discovery
Vulnerability scanning (weekly for critical)
Penetration testing (annual)
Risk prioritization
Remediation tracking
Verification testing
Remediation Timelines:
Critical: 24-72 hours
High: 7 days
Medium: 30 days
Low: 90 days
Domain 3: Cybersecurity Resilience (3-x)
3-1: Business Continuity Management
Control Requirement:
Establish business continuity management to ensure organizational resilience.
BCM Components:
Business impact analysis (BIA)
Recovery strategies
Business continuity plans
Testing and exercises
Plan maintenance
BIA Requirements:
Critical process identification
Recovery time objectives (RTO)
Recovery point objectives (RPO)
Resource requirements
Dependencies mapping
3-2: Disaster Recovery
Control Requirement:
Implement disaster recovery capabilities for critical systems.
DR Requirements:
DR site (hot/warm/cold)
Replication mechanisms
Failover procedures
Recovery procedures
DR testing (minimum annual)
DR Documentation:
DR plan
Recovery procedures
Contact lists
Vendor information
Test results
3-3: Backup Management
Control Requirement:
Implement comprehensive backup and recovery procedures.
Backup Requirements:
Backup policy
Backup schedules
Offsite storage
Encryption of backups
Regular restoration testing
Backup Schedule:
Daily incremental
Weekly full
Monthly archives
Annual retention
3-2-1 Rule:
3 copies of data
2 different media types
1 offsite location
3-4: Incident Response
Control Requirement:
Establish incident response capability for detecting, responding to, and recovering from cybersecurity incidents.
IR Plan Components:
Incident classification
Response procedures
Escalation matrix
Communication plan
Evidence handling
Post-incident review
Incident Categories:
Category 1 - Critical:
Data breach affecting >1000 records
Ransomware attack
APT compromise
Critical system outage
NCA notification required within 2 hours
Category 2 - High:
Limited data exposure
Malware outbreak
Denial of service
Unauthorized access
NCA notification within 24 hours
Category 3 - Medium:
Contained incidents
Policy violations
Single system compromise
Internal reporting required
Category 4 - Low:
Minor security events
False positives
Informational alerts
3-5: Crisis Management
Control Requirement:
Establish crisis management procedures for major cybersecurity incidents.
Crisis Management:
Crisis management team
Communication procedures
Decision authority
External communication
Legal coordination
3-6: NCA Incident Reporting
Control Requirement:
Report cybersecurity incidents to NCA as required.
Reporting Requirements:
Critical incidents: 2 hours
High incidents: 24 hours
Detailed report: 72 hours
Final report: 30 days
Report Contents:
Incident description
Impact assessment
Timeline of events
Response actions
Root cause analysis
Remediation measures
Domain 4: Third-Party Cybersecurity (4-x)
4-1: Third-Party Risk Management
Control Requirement:
Implement third-party risk management program.
TPRM Process:
Vendor identification
Risk assessment
Due diligence
Contract negotiation
Ongoing monitoring
Offboarding
Risk Assessment Criteria:
Data access level
System connectivity
Service criticality
Geographic location
Security maturity
4-2: Vendor Security Assessment
Control Requirement:
Assess security posture of third parties before engagement.
Assessment Methods:
Security questionnaires
Documentation review
On-site assessments
Penetration testing
Certification verification
Continuous monitoring
Assessment Frequency:
Critical vendors: Annual
High-risk vendors: Every 2 years
Standard vendors: Every 3 years
4-3: Contract Security Requirements
Control Requirement:
Include cybersecurity requirements in all third-party contracts.
Contract Clauses:
Security requirements
Compliance obligations
Incident notification
Audit rights
Data protection
Liability provisions
Termination procedures
Return/destruction of data
4-4: Third-Party Access Management
Control Requirement:
Control and monitor third-party access to organizational systems.
Access Controls:
Dedicated accounts
Limited permissions
Time-bound access
Activity monitoring
Regular reviews
Immediate revocation capability
4-5: Cloud Security
Control Requirement:
Implement security controls for cloud services.
Cloud Security Requirements:
Cloud security policy
Provider assessment
Data residency compliance
Encryption requirements
Access management
Monitoring and logging
Incident response
Data Residency:
Government data must remain in Saudi Arabia
NCA approval for exceptions
Cross-border transfer restrictions
Domain 5: Industrial Control Systems Security (5-x)
5-1: ICS Governance
Control Requirement:
Establish governance framework for ICS/OT security.
Governance Elements:
OT security policy
Roles and responsibilities
Risk management
Compliance requirements
Performance metrics
5-2: ICS Asset Management
Control Requirement:
Maintain complete inventory of ICS/OT assets.
Asset Types:
PLCs and RTUs
HMI systems
SCADA servers
Engineering workstations
Historians
Network devices
Field devices
5-3: ICS Network Security
Control Requirement:
Implement network security controls for ICS environments.
Network Controls:
IT/OT segmentation
Industrial DMZ
Unidirectional gateways
Industrial firewalls
Network monitoring
Remote access security
Purdue Model Implementation:
Level 0: Process (field devices)
Level 1: Basic control (PLCs)
Level 2: Area supervisory (HMI)
Level 3: Site operations (historians)
Level 3.5: Industrial DMZ
Level 4-5: Enterprise IT
5-4: ICS Access Control
Control Requirement:
Implement access controls specific to ICS environments.
ICS Access Controls:
Role-based access
Strong authentication
Limited remote access
Physical access restrictions
Vendor access management
Emergency procedures
5-5: ICS Monitoring and Detection
Control Requirement:
Implement monitoring and threat detection for ICS environments.
Monitoring Capabilities:
Network traffic analysis
Anomaly detection
Asset behavior monitoring
Protocol analysis
Alert management
5-6: ICS Incident Response
Control Requirement:
Develop ICS-specific incident response procedures.
ICS IR Considerations:
Safety priority
Operational impact
Specialized skills
Vendor coordination
Evidence preservation
Recovery procedures
Compliance Requirements
Registration with NCA
Registration Process:
1Entity identification
2Online portal registration
3Point of contact designation
4Sector classification
5Compliance commitment
Compliance Officer Requirements:
Saudi national (preferred)
Cybersecurity expertise
Management authority
NCA liaison
Self-Assessment
Annual Self-Assessment:
Complete control review
Maturity level assessment
Gap identification
Remediation planning
Evidence compilation
Self-Assessment Tool:
NCA online portal
Control-by-control assessment
Evidence upload
Score calculation
Report generation
External Audit
Audit Requirements:
NCA-approved auditors
Annual audit for CNI
Biennial for government entities
Audit scope coverage
Findings remediation
Audit Process:
1Planning and scoping
2Documentation review
3Technical assessment
4Interview sessions
5Control testing
6Report issuance
7Remediation tracking
Certification
Compliance Levels:
Level 1 - Basic Compliance:
Minimum controls implemented
Documented policies
Basic security measures
Foundation established
Level 2 - Advanced Compliance:
Comprehensive controls
Mature processes
Advanced capabilities
Continuous monitoring
Level 3 - Optimized Compliance:
Industry-leading practices
Continuous improvement
Innovation adoption
Benchmarking participation
Enforcement and Penalties
NCA Enforcement Powers
Investigation Authority:
Access to premises
Document requests
System access
Interview personnel
Evidence collection
Corrective Actions:
Compliance orders
Remediation directives
Implementation deadlines
Progress monitoring
Verification audits
Penalty Framework
Administrative Penalties:
Minor Violations:
Written warnings
Compliance notices
Mandatory training
Enhanced monitoring
Moderate Violations:
Financial penalties
Public disclosure
Leadership accountability
Certification suspension
Severe Violations:
Significant fines
Operating restrictions
Leadership removal
Criminal referral
Penalty Considerations:
Violation severity
Impact scope
Organization size
Compliance history
Remediation efforts
Cooperation level
Reporting Violations
Mandatory Reporting:
Security incidents (within 2-24 hours)
Compliance gaps
Material changes
Third-party breaches
Failure to Report:
Additional penalties
Aggravating factor
Leadership liability
Enhanced scrutiny
Implementation Roadmap
Phase 1: Foundation (Months 1-3)
Objectives:
Establish governance
Complete gap assessment
Develop roadmap
Secure resources
Key Activities:
Executive sponsorship
Compliance team formation
Current state assessment
Gap analysis
Budget approval
Project planning
Deliverables:
Gap assessment report
Implementation roadmap
Resource plan
Budget allocation
Project charter
Phase 2: Governance (Months 4-6)
Objectives:
Implement governance controls
Establish policy framework
Define organization structure
Implement risk management
Key Activities:
Strategy development
Policy creation
Role assignments
Risk assessment
Awareness program launch
Deliverables:
Cybersecurity strategy
Policy framework
Organization structure
Risk register
Training materials
Phase 3: Defense - Part 1 (Months 7-10)
Objectives:
Implement asset management
Deploy IAM controls
Establish data protection
Enhance network security
Key Activities:
Asset inventory completion
IAM solution deployment
Data classification
Network segmentation
Encryption implementation
Deliverables:
Asset inventory
IAM system
Classification scheme
Network architecture
Encryption deployment
Phase 4: Defense - Part 2 (Months 11-14)
Objectives:
Implement endpoint security
Deploy security operations
Establish vulnerability management
Enhance application security
Key Activities:
EDR deployment
SOC establishment
Vulnerability scanning
SAST/DAST implementation
Penetration testing
Deliverables:
Endpoint protection
SOC operations
Vulnerability program
AppSec program
Pentest reports
Phase 5: Resilience (Months 15-18)
Objectives:
Implement business continuity
Establish incident response
Deploy backup/DR
Test and validate
Key Activities:
BIA completion
BCP development
IR capability building
DR implementation
Testing and exercises
Deliverables:
Business continuity plan
Incident response plan
DR capability
Test results
Exercise reports
Phase 6: Third-Party & ICS (Months 19-22)
Objectives:
Implement TPRM
Secure cloud services
OT security program
Vendor assessments
Key Activities:
TPRM program establishment
Cloud security controls
OT/IT segmentation
Vendor assessments
Contract updates
Deliverables:
TPRM program
Cloud security
OT security controls
Vendor assessments
Updated contracts
Phase 7: Certification (Months 23-24)
Objectives:
Complete self-assessment
Address remaining gaps
External audit
Certification achievement
Key Activities:
Self-assessment completion
Gap remediation
Evidence compilation
External audit
Certification submission
Deliverables:
Self-assessment report
Audit report
Certification
Continuous improvement plan
Integration with Other Frameworks
SAMA Cybersecurity Framework
Applicability:
Financial sector organizations
Banks and insurance
Payment providers
Integration Approach:
Common control mapping
Unified assessment
Consolidated reporting
Shared evidence
ISO 27001:2022
Benefits:
International recognition
Certification pathway
Mature framework
Third-party assurance
Mapping:
80%+ control overlap
Annex A alignment
Risk-based approach
Continuous improvement
NIST Cybersecurity Framework
Alignment:
Five functions mapping
Maturity model compatibility
Best practice guidance
Implementation tiers
NCA OTCC
OT-Specific Controls:
Operational Technology Cybersecurity Controls
ICS/SCADA requirements
Critical infrastructure focus
Complementary to ECC
Tools and Technologies
Required Security Tools
Governance:
GRC platform
Risk management tool
Policy management system
Compliance tracking
Identity and Access:
IAM solution
PAM platform
MFA solution
SSO system
Security Operations:
SIEM platform
EDR/XDR solution
SOAR platform
Threat intelligence
Vulnerability Management:
Vulnerability scanner
Penetration testing tools
Application security testing
Configuration assessment
Data Protection:
DLP solution
Encryption tools
Classification tools
Rights management
Best Practices
Success Factors
Executive Support:
Board-level commitment
Resource allocation
Strategic alignment
Accountability
Program Management:
Dedicated team
Clear governance
Regular reporting
Risk-based prioritization
Technical Excellence:
Skilled resources
Right-sized tools
Integrated architecture
Automation focus
Culture:
Security awareness
Accountability
Continuous learning
Improvement mindset
Common Pitfalls
Avoid:
Checkbox compliance
Underestimating effort
Siloed implementation
Neglecting culture
Tool over process focus
Conclusion
NCA ECC compliance is mandatory for Saudi government and critical infrastructure organizations. The framework establishes comprehensive cybersecurity requirements across governance, defense, resilience, third-party management, and industrial control systems. Success requires executive commitment, adequate resources, and a systematic approach to implementing and maintaining all 114 controls. Organizations should begin with a thorough gap assessment, develop a phased implementation roadmap, and establish continuous compliance monitoring to achieve and maintain certification. Integration with related frameworks like SAMA CSF and ISO 27001 can optimize compliance efforts while ensuring robust cybersecurity posture aligned with national requirements.