Saudi Arabia · Regulation guide
NCA Essential Cybersecurity Controls (ECC)
Issued by National Cybersecurity Authority (NCA)
Applies to: Government organisations in Saudi Arabia, their companies and entities, and private-sector organisations that own, operate or host critical national infrastructure.
The ECC are the baseline cybersecurity controls issued by Saudi Arabia’s National Cybersecurity Authority. They are organised into main domains covering cybersecurity governance, defence, resilience, third-party and cloud security, and industrial control systems.
Organisations in scope implement the controls, assess compliance and report to the NCA. Other NCA control sets, for cloud, critical systems, data and operational technology, build on the ECC.
General guidance, not legal advice. Always confirm scope and current requirements with the issuing authority.
Discuss NCA ECC with us
Gap assessment, control mapping or evidence tracking.
How we help
- ✓Gap assessment against the current ECC edition
- ✓Combined control set with ISO/IEC 27001 to avoid duplicate work
- ✓Policy and procedure development
- ✓Evidence tracking and self-assessment in GRC software
- ✓Awareness and technical training for staff
Related ISO standards
NCA ECC questions
Does ISO 27001 certification mean we comply with NCA ECC?+
No. They overlap substantially, but the ECC contains specific requirements of its own. A combined control set lets one programme produce evidence for both.
Is this legal advice?+
No. This is a general overview. Confirm scope, the current edition and your obligations with the issuing authority and your legal or compliance advisers.
Next step
Where does your programme stand?
The GRC maturity check takes three minutes and shows which areas to fix first.