Skip to content
Emergency helpGet started
Compliance & Governance

What are the NCA Essential Cybersecurity Controls (ECC)?

NCA ECC-2:2024 sets 108 main controls in four domains for Saudi government entities and CNI operators. Scope, domains, assessment and evidence.
By VigilbasePublished
Read the guideMore Topics

The Essential Cybersecurity Controls (ECC) are the National Cybersecurity Authority's baseline cybersecurity requirements in Saudi Arabia. The current edition, ECC-2:2024, updates ECC-1:2018 and sets 108 main controls and 92 subcontrols across four domains: governance, defense, resilience, and third-party and cloud computing cybersecurity. It applies to government agencies and their affiliated companies and entities, inside and outside the Kingdom, and to private sector entities that own, operate, or host Critical National Infrastructures. The NCA strongly encourages every other entity in the Kingdom to use the controls too.

Who issued the ECC and when?

The National Cybersecurity Authority (NCA) issued the first edition as ECC-1:2018 and updated it as ECC-2:2024. The current document gives the year of the edition rather than an issue date. ECC-2:2024 cites the NCA's Statute, approved by Royal Order No. 6801 dated 11/02/1439H, and High Order No. 57231 dated 10/11/1439H, under which all national entities must take the measures needed for ongoing and continuous compliance with the ECC. The NCA publishes the controls in Arabic and English, and the Arabic version is binding on any question of meaning or interpretation.

Who must comply with the ECC?

The controls apply to three groups. The NCA strongly encourages all other entities in the Kingdom to apply them as good practice. Controls in subdomain 4-2, Cloud Computing and Hosting Cybersecurity, are binding on in-scope entities that use or plan to use cloud computing and hosting services.
1.Government agencies in the Kingdom, including ministries, authorities, and establishments.
2.Companies and entities affiliated with those agencies, inside and outside the Kingdom.
3.Private sector entities that own, operate, or host Critical National Infrastructures (CNIs).

What are the four ECC domains?

ECC-2:2024 has 4 main domains, 28 subdomains, 108 main controls, and 92 subcontrols. ECC-1:2018 had five domains and 114 controls. The fifth domain, Industrial Control Systems Cybersecurity, was removed, and its controls moved to the NCA's Operational Technology Cybersecurity Controls (OTCC).
1.Cybersecurity Governance: strategy, management, policies and procedures, roles, risk management, cybersecurity in IT projects, compliance with standards and regulations, periodic review and audit, human resources, and awareness and training.
2.Cybersecurity Defense: asset management, identity and access management, protection of systems and processing facilities, email protection, network security, mobile devices, data and information protection, cryptography, backup and recovery, vulnerability management, penetration testing, event logs and monitoring, incident and threat management, physical security, and web application security.
3.Cybersecurity Resilience: the cybersecurity aspects of business continuity management.
4.Third-Party and Cloud Computing Cybersecurity: third-party cybersecurity, and cloud computing and hosting cybersecurity.

Which ECC controls shape day-to-day security operations?

Most ECC controls follow the same pattern: requirements are identified, documented, and approved, then implemented, then periodically reviewed. A few subcontrols set specific minimums that decide how monitoring, incident handling, and the public edge are run.
1.2-12 Event logs and monitoring: activate event logs for critical information assets, privileged accounts, and remote access; identify the SIEM techniques used to collect them; monitor them continuously; and keep them for at least 12 months.
2.2-13 Incident and threat management: incident response plans and escalation procedures, incident classification, reporting incidents to the NCA, sharing incident information with the NCA, and handling threat intelligence feeds.
3.2-15 Web application security: protect external web applications with a web application firewall, a multi-tier architecture, and secure protocols such as HTTPS.
4.2-5 Network security management: includes protection against Distributed Denial of Service (DDoS) attacks.
5.4-1 Third-party cybersecurity: contracts for IT or cybersecurity outsourcing and managed services need a cybersecurity risk assessment before signing, and managed service centers for monitoring and operations that use remote access must be fully located in the Kingdom.

How is ECC compliance assessed?

The NCA evaluates compliance through several means, such as self-assessment by entities, periodic reports from its compliance tool, and field audit visits. ECC-2:2024 says the NCA will issue an ECC-2:2024 Assessment and Compliance Tool to organize that work. The ECC text does not set penalties or a compliance deadline of its own, so ask the NCA or your legal counsel how enforcement applies to your entity.

How do organizations evidence the ECC?

Because most controls ask for requirements to be documented and approved, implemented, and periodically reviewed, evidence usually comes in three layers: the approved document, a record showing the control operates, and the record of its last review. The operating records are the hardest part to produce on demand.
1.Approved strategy, policies, procedures, and the roles that own them.
2.Asset inventories, access reviews, and privileged account records.
3.Event log configuration, continuous monitoring records, and logs kept for at least 12 months.
4.Incident records showing classification, escalation, and reporting to the NCA.
5.Web application firewall and DDoS protection settings, with change records.
6.Third-party contracts, risk assessments, and periodic reviews.

Where does Vigilbase help with ECC evidence?

Vigilbase supplies operating evidence, not a certificate. Vigilbase OS connects the security tools you already pay for and keeps their logs and events auditable and queryable in one place. Each investigation records the evidence, the action taken, and the verification result, which helps you produce evidence for event log monitoring (2-12) and incident management (2-13). Managed Cloudflare operates WAF and DDoS controls within the agreed scope, relevant to web application security (2-15) and DDoS protection (2-5). Two limits matter. Default retention is set per dataset, typically 30 to 90 days, so agree where the 12-month log archive lives. And because 4-1-3-2 requires managed monitoring centers that use remote access to be fully located in the Kingdom, raise it during scoping and confirm where any monitoring is performed before you sign.

About this guide

This guide summarizes the ECC-2:2024 text published by the NCA, as available in October 2026. It is not legal advice. The Arabic text is binding, and the NCA's own publications take precedence over this summary. Your legal and compliance owners decide how the controls apply to your entity.

Key Takeaways

✓ECC-2:2024 is the NCA's baseline: 4 domains, 28 subdomains, 108 main controls, and 92 subcontrols.
✓It binds government agencies, their affiliated entities, and private operators of Critical National Infrastructures; other entities are encouraged to adopt it.
✓Cybersecurity event logs must be kept for at least 12 months, and external web applications need a web application firewall.
✓Vigilbase helps produce operating evidence for monitoring, incidents, WAF, and DDoS; it does not certify ECC compliance.

Sources

Related Solutions

Vigilbase services related to this guide

Managed SOC

Learn more

Managed Cloudflare

Learn more

Get started with Vigilbase OS

Learn more

Cybersecurity in Saudi Arabia

Learn more

Frequently Asked Questions

What changed between ECC-1:2018 and ECC-2:2024?

ECC-2:2024 has four domains instead of five, with 108 main controls and 92 subcontrols. The Industrial Control Systems domain moved to the NCA's Operational Technology Cybersecurity Controls, and the ECC-1 subcontrol requiring information hosting and storage inside the Kingdom was removed, with data localization controls transferred to the National Data Management Office at SDAIA.

Does the ECC apply to private companies?

It applies to private sector entities that own, operate, or host Critical National Infrastructures, and to companies affiliated with government agencies. The NCA strongly encourages all other entities in the Kingdom to apply the controls to improve their cybersecurity.

How long must cybersecurity event logs be kept under the ECC?

At least 12 months, under subcontrol 2-12-3-5. The ECC also asks for event logs on critical information assets, privileged accounts, and remote access, and for continuous monitoring of those logs.Vigilbase OS sets default retention per dataset, typically 30 to 90 days. If you use it for ECC monitoring, decide where the 12-month archive lives before you consolidate.What a SIEM doesSecurity operations responsibilities

Who checks ECC compliance?

The NCA. It evaluates compliance through self-assessment by entities, periodic reports from its compliance tool, and field audit visits.

Can Vigilbase make us ECC compliant?

No provider can do that for you. Vigilbase supports the operating side: investigations, authorized changes, and verification are recorded, and connected logs stay queryable. Your compliance owners and the NCA's assessment decide compliance.How agentic cybersecurity worksDiscuss your scope with Vigilbase

Related Topics

Security Basics

What is SIEM?

Network Security

What is WAF?

Compliance & Governance

NCA CSCC

Compliance & Governance

SAMA Cyber Security Framework

Compliance & Governance

Saudi PDPL

Get Started

Ready to Improve Your Security?

Our team can help you implement the security measures discussed in this guide. Get expert guidance tailored to your organization.
Get started Continue Learning