NCA ECC Implementation Guide for Saudi Organizations

The Essential Cybersecurity Controls (ECC-1:2018) issued by NCA form the backbone of institutional cybersecurity in the Kingdom. Government, semi-government, and critical private sector entities are required to comply. Non-mandated organizations often adopt them as best practice — especially when bidding on government tenders.

The five control families: (1) Cybersecurity governance — strategy, policies, designated officer, budget. (2) Cybersecurity strengthening — asset management, identity management, patching, encryption, network segmentation. (3) Cyber resilience — vulnerability management, response plans, continuity, backup. (4) Third-party security — vendor assessment, contract terms. (5) Industrial control systems (ICS/OT) security when applicable.

Maturity levels: NCA expects controls to be implemented at a maturity level appropriate to the entity's sensitivity. Level 1 — initial; 2 — developing; 3 — defined; 4 — managed. Sensitive entities are expected to reach Level 3 or 4.

ECC controls are not a one-time checklist — they are an integrated framework requiring ongoing governance, documentation, and operational evidence.

Audit preparation: the audit requires documentary and operational evidence. Approved policies, meeting minutes, assessment results, patching records, awareness records, response test records — all serve as evidence. Common gap: written policies without evidence of actual implementation.

Common gaps include: absence of approved cybersecurity strategy, no formally designated security officer, missing MFA on critical systems, no tested incident response plan, inadequate backup (3-2-1). Priority is usually given to controls 1, 2, and 3 before expansion.

Evidence collection: each control needs proof that the policy exists and is communicated and that practice is implemented. Evidence may include: screenshots, tool reports, training logs, meeting minutes. Organizing evidence by control family speeds auditor review.

Integration with ISO 27001: ECC controls overlap significantly with ISO 27001. Organizations building an ISMS under ISO 27001 often achieve ECC compliance in parallel — one set of documentation serves both purposes.