NCA Essential Cybersecurity Controls (ECC-2:2024)
Saudi Arabia’s baseline cybersecurity controls, issued by the National Cybersecurity Authority and revised in 2024.
Saudi Arabia · National Cybersecurity AuthorityWho it applies to
Government entities, operators of critical national infrastructure and other organisations the NCA supervises.
Key areas
- Four domains: governance, defence, resilience, and third-party and cloud
- Roughly 108 main controls plus subcontrols, so confirm against the NCA text
- Replaced ECC-1:2018, with industrial control systems moved to the OTCC
- The base layer beneath the NCA’s specialised control sets
How Nigehban helps
- Gap assessment against the requirements
- Remediation roadmap and implementation support
- Independent audit and evidence review
- Monitoring that proves controls keep working
Related standards
NCA Cloud Cybersecurity Controls (CCC-2:2024)
Controls for cloud services that extend the ECC, for both cloud service providers and their customers.
Saudi ArabiaNCA Critical Systems Cybersecurity Controls (CSCC)
Additional controls for systems whose failure would seriously affect national interests.
Saudi ArabiaNCA Operational Technology Cybersecurity Controls (OTCC-1:2022)
Controls for industrial and operational technology environments.
Saudi Arabia