Get audit-ready for NCA ECC
NCA Essential Cybersecurity Controls (ECC-2:2024) · Saudi National Cybersecurity Authority
Saudi Arabia's National Cybersecurity Authority baseline cybersecurity controls, mandatory for government entities, government-affiliated organizations, and critical infrastructure operators under Royal Decree 6801/57231.
NCA ECCWhat is NCA ECC?
Saudi Arabia's National Cybersecurity Authority baseline cybersecurity controls, mandatory for government entities, government-affiliated organizations, and critical infrastructure operators under Royal Decree 6801/57231.
Who it applies to
Government entities, government-affiliated organisations and critical national infrastructure operators in Saudi Arabia, under Royal Decree 6801/57231, and in practice the suppliers that serve them.
How the standard is organised
Baseline cybersecurity controls grouped into four main domains: cybersecurity governance, cybersecurity defence, cybersecurity resilience, and third-party and cloud computing cybersecurity. The 2024 edition (ECC-2) dropped the industrial control systems domain that ECC-1:2018 had.
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
NCA ECC on the Bitkosh platform
The 108 NCA ECC controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- 2-4-3Filter phishing, enforce MFA and validate email domains (SPF, DKIM, DMARC)
The cybersecurity requirements for protecting the email service must include at the least the following: (1) analyzing and filtering email messages (specifically phishing emails and spam) using…
Cybersecurity Defense - 1-2-2Staff all cybersecurity positions with qualified Saudi professionals
All cybersecurity positions, not only the function head and its supervisory and critical roles, must be filled with full-time, qualified Saudi cybersecurity professionals.
Cybersecurity Governance - 2-5-3Segment networks and deploy IPS, DNS, wireless and DDoS protections
The cybersecurity requirements for network security management must include at least the following: (1) logical or physical segregation and segmentation of network segments using firewalls and…
Cybersecurity Defense - 4-1-3Risk-assess outsourcing contracts and keep remote-access managed SOCs in the Kingdom
The cybersecurity requirements for contracts and agreements with third parties providing IT or cybersecurity outsourcing or managed services must include at least the following: (1) conducting a…
Third-Party and Cloud Computing Cybersecurity - 1-7-1Comply with nationally-approved international cybersecurity agreements
Where nationally approved international agreements or commitments contain cybersecurity requirements, the organization must identify those requirements and comply with them.
Cybersecurity Governance - 4-1-2Require NDAs, incident communication and compliance in third-party SLAs
The cybersecurity requirements for contracts and agreements with third-parties (e.g., Service Level Agreement (SLA)) -which may affect, if impacted, the organization's data or services- must include…
Third-Party and Cloud Computing Cybersecurity
More information security & cybersecurity frameworks
Frequently Asked Questions
Who publishes NCA ECC, and who does it apply to?
How is NCA ECC conformance demonstrated?
How is NCA ECC structured?
Ready to get audit-ready for NCA ECC?
See how the Bitkosh Readiness Platform gets you audit-ready for NCA ECC — and the other 47 ready frameworks — from a single control library.