Map your controls to Saudi Arabia's NCA ECC with less effort

NCA ECC-1:2018 is the first edition of the Essential Cybersecurity Controls issued by Saudi Arabia's National Cybersecurity Authority. It sets the minimum cybersecurity requirements for national entities in scope, with 114 controls across 29 subdomains in five domains: governance, defence, resilience, third-party and cloud computing, and industrial control systems. It was built from national and international standards, analysis of past incidents and consultation with national entities.

Government agencies in Saudi Arabia, including ministries, authorities and establishments, must comply, along with their companies and entities and private sector organisations that own, operate or host Critical National Infrastructure. The NCA encourages all other organisations in the Kingdom to use the controls as good practice. Suppliers to in-scope entities are often asked to meet relevant controls through contracts.

No. The NCA has published ECC-2:2024, which updates ECC-1:2018. The new edition has four main domains and 28 subdomains, because the industrial control systems domain moved to the Operational Technology Cybersecurity Controls (OTCC). It also removed data localisation and some data classification controls, which now sit with the National Data Management Office. Most governance and defence subdomains carry over.

The five main domains of ECC-1:2018 are Cybersecurity Governance (10 subdomains), Cybersecurity Defense (15 subdomains), Cybersecurity Resilience (1 subdomain), Third-Party and Cloud Computing Cybersecurity (2 subdomains) and Industrial Control Systems Cybersecurity (1 subdomain). Together they contain 29 subdomains and 114 main controls, many broken down further into sub-controls.

NCA ECC and ISO 27001 overlap heavily, covering risk management, access control, cryptography, logging, incident management, physical security and supplier security. ISO 27001 is a voluntary, certifiable international standard, while ECC is a mandatory national control set for in-scope Saudi entities. ECC also has local requirements, such as filling cybersecurity roles with qualified Saudi professionals, so ISO 27001 certification alone does not prove ECC compliance.

There is no ECC certificate in the way ISO 27001 has one. In-scope entities must implement the controls that apply to them, and the NCA monitors compliance of government and non-government entities. Many organisations run internal audits and periodic reviews, which ECC itself requires under subdomain 1-8, Periodical Cybersecurity Review and Audit, to show where they stand.

Start by confirming your entity is in scope and which controls apply, for example cloud controls only apply if you use cloud services. Then run a gap assessment against each subdomain, write the required policies, assign a cybersecurity function and roles, fix technical gaps, collect evidence and review compliance periodically. Most organisations now plan directly against ECC-2:2024.

Yes. ECC-1:2018 is supported in OneClickComply today. Your existing controls, policies and evidence can be traced to each ECC subdomain, and control mapping lets the same evidence count towards ISO 27001, SOC 2 and other frameworks you follow. Automated evidence collection and continuous monitoring show where gaps remain.