Saudi NCA ECC-2:2024 Guide: Domains, Scope, Compliance

Any Saudi government body, its companies, or a private operator of critical national infrastructure must meet the National Cybersecurity Authority's Essential Cybersecurity Controls, and the 2024 revision changed what that means. ECC-2:2024 replaced ECC-1:2018, moved industrial control systems out to a separate control set, and handed data localisation and privacy to the National Data Management Office. This guide explains who the ECC applies to, how its 4 domains and 28 subdomains are organised, what the identity, logging and third-party controls actually require, and how compliance is assessed. It also covers how the ECC relates to the NCA's cloud (CCC) and critical systems (CSCC) controls. It is written for CISOs, GRC leads and security architects working in or with Saudi entities, including vendors and managed service providers who inherit these requirements through contracts. Status was checked against nca.gov.sa in October 2026.

Key takeaways

ECC-2:2024 is the current version. It replaced ECC-1:2018, and the NCA's ECC page still listed ECC-2:2024 as current when checked in October 2026.
Scope is mandatory for government and CNI. Government entities inside and outside the Kingdom, their companies, and private entities that own, operate or host critical national infrastructure must comply; everyone else is strongly encouraged.
The structure is 4 domains and 28 subdomains. The introduction states 108 main controls and 92 subcontrols, organised as Governance, Defense, Resilience, and Third-Party and Cloud Computing.
Identity controls are short but demanding. Subdomain 2-2 requires MFA for remote access and privileged accounts, least privilege and segregation of duties, privileged access management and periodic access reviews, and 2-12 requires logging of privileged accounts with at least 12 months' retention.
Compliance is continuous, not a one-off audit. The NCA can assess through self-assessment, reports from its compliance tool and field audit visits, so evidence must be kept current.

What it is and who it applies to

The Essential Cybersecurity Controls are the NCA's baseline: minimum requirements, built on international standards and practice, to reduce internal and external threats to information and technology assets. The document is issued under Article 10(3) of the NCA's statute and High Order No. 57231, which require covered entities to maintain ongoing and continuous compliance. It is published as a public document (TLP: White) and the NCA tells readers to check nca.gov.sa for the latest version.

Entity type	Status under ECC-2:2024	Practical note
Saudi government agencies (ministries, authorities, establishments and others)	Mandatory	Applies inside and outside the Kingdom, including overseas offices
Companies and entities affiliated with government agencies	Mandatory	Includes state-owned companies and their subsidiaries, inside or outside the Kingdom
Private sector entities that own, operate or host critical national infrastructure (CNI)	Mandatory	Hosting is in scope, so data centre and managed service operators serving CNI should check carefully
Other private sector organisations	Strongly encouraged	Often required indirectly through contracts with in-scope customers
Suppliers to in-scope entities	Indirect	Subdomain 4-1 makes the entity push its cybersecurity requirements into contracts and SLAs

Applicability inside the framework also depends on what technology an entity uses. The document's own example is subdomain 4-2 (cloud computing and hosting), which applies only to entities that use or plan to use cloud or hosting services. An entity should therefore record, per subdomain, whether it applies and why, rather than marking controls "not applicable" without justification.

The ECC is a cybersecurity control set, not a privacy law. Personal data processing in the Kingdom is governed by the Personal Data Protection Law (PDPL), overseen by the Saudi Data and AI Authority (SDAIA), and ECC-2:2024 explicitly moved privacy and data localisation items to the National Data Management Office under SDAIA. Treat them as separate compliance tracks that share evidence.

Structure and key requirements

The ECC is organised around four pillars (strategy, people, process and technology) and four main domains. Domain 5 (Industrial Control Systems) from ECC-1:2018 was removed and its content moved to the Operational Technology Cybersecurity Controls (OTCC-1:2022).

Domain	Subdomains	What it covers
1 Cybersecurity Governance	1-1 to 1-10	Strategy, cybersecurity management, policies and procedures, roles and responsibilities, risk management, cybersecurity in IT project management, compliance with laws and standards, periodic review and audit, human resources, awareness and training
2 Cybersecurity Defense	2-1 to 2-15	Asset management, identity and access management, system and processing facility protection, email protection, network security, mobile devices, data and information protection, cryptography, backup and recovery, vulnerability management, penetration testing, event logs and monitoring, incident and threat management, physical security, web application security
3 Cybersecurity Resilience	3-1	Cybersecurity resilience aspects of business continuity management
4 Third-Party and Cloud Computing Cybersecurity	4-1, 4-2	Third-party cybersecurity, cloud computing and hosting cybersecurity

Most subdomains follow the same pattern: requirements are defined, documented and approved; they are implemented; there is a list of minimum sub-controls; and implementation is reviewed periodically. The requirements most likely to need design work are:

Independent cybersecurity function (1-2): the cybersecurity department must be independent of the IT and communications department, with a recommendation that it reports directly to the head of the entity. Cybersecurity positions must be filled by full-time, qualified Saudi professionals, and a cybersecurity supervisory committee that includes the head of cybersecurity must be formed and documented.
Risk assessment triggers (1-5): at minimum, at the early stage of technology projects, before major infrastructure changes, when planning third-party services, and before releasing new technology services or products.
Independent review (1-8): the cybersecurity department reviews implementation, but audits must be carried out by parties independent of it, following Generally Accepted Auditing Standards, with results reported to the supervisory committee and the Authorized Official.
People (1-9): cybersecurity and non-disclosure clauses in contracts that survive termination, screening of staff in cybersecurity and critical or privileged technical roles, and immediate review and revocation of access when employment ends.
System protection (2-3) and network (2-5): malware protection, strict control of external storage, patch management, central time synchronisation with a trusted source such as SASO, segmentation with firewalls, isolation of production from test and development, IPS, secure DNS, APT protection and (new in ECC-2) DDoS protection under 2-5-3-9.
Cryptography (2-8): the National Cryptographic Standards are the minimum; approved cryptographic solutions, key management across the whole lifecycle, and encryption in transit and at rest according to classification.
Testing (2-10, 2-11): periodic vulnerability assessment with severity-based remediation and patch testing in non-production, plus periodic penetration tests covering every internet-facing service, including websites, mobile apps, email and remote access.
Incidents (2-13): response plans, classification and escalation, reporting cybersecurity incidents to the NCA, and sharing threat intelligence and indicators with it.
Web applications (2-15): web application firewall, multi-tier architecture, secure protocols such as HTTPS and authentication factors chosen by impact assessment.
Third parties (4-1): contracts must cover non-disclosure and secure removal of data at the end of service, incident communication procedures and the third party's obligation to apply the entity's policies. For IT or cybersecurity outsourcing, a risk assessment comes before signing, and managed service centres that use remote access must be fully located in Saudi Arabia (4-1-3-2).
Cloud and hosting (4-2): data protected according to classification and returned in a usable format at the end of service, and the entity's environment (especially virtual servers) separated from other tenants.

Related NCA control sets

Control set	Current version	Scope	Size
Essential Cybersecurity Controls (ECC)	ECC-2:2024	Baseline for all in-scope entities	4 domains, 28 subdomains; 108 main controls and 92 subcontrols per its introduction
Cloud Cybersecurity Controls (CCC)	CCC-2:2024	Cloud service providers (CSPs) serving in-scope tenants, and in-scope cloud service tenants (CSTs)	CSP: 37 main controls, 94 subcontrols; CST: 18 main controls, 26 subcontrols
Critical Systems Cybersecurity Controls (CSCC)	CSCC-1:2019	National critical systems inside in-scope entities	32 main controls, 73 subcontrols
Operational Technology Cybersecurity Controls (OTCC)	OTCC-1:2022	Industrial control systems (former ECC Domain 5)	See the NCA OTCC document

All three are described by the NCA as extensions of the ECC: an entity that is in scope for them must meet the ECC as well. CCC-2:2024 tiers its controls into four levels mapped to data classification (Level 1 top secret to Level 4 public), applies the highest level to mixed data sets, and also moved its former in-Kingdom hosting requirements to the NDMO. Cloud tenants should read the Cloud Security Guide alongside CCC, and OT owners the OT Security Guide.

Identity and NHI requirements

Subdomain 2-2 is only a few lines long, but each line is a significant programme. Sub-control 2-2-3 sets the minimum:

Sub-control	Requirement	What it means for non-human identities
2-2-3-1	Single-factor authentication based on username and password	Service accounts that still authenticate with static passwords are in scope; store and rotate those secrets in a vault
2-2-3-2	MFA for remote access and privileged accounts, with factors chosen by impact assessment	Privileged service accounts cannot do interactive MFA, so compensate with vaulting, short-lived credentials, workload identity and restricted logon rights, and record the decision
2-2-3-3	Authorisation by need-to-know and need-to-use, least privilege and segregation of duties	Scope API keys, cloud roles and automation accounts to single tasks; avoid one account deploying and approving
2-2-3-4	Privileged access management	Include machine credentials with admin rights (domain service accounts, cloud owner roles, CI/CD deploy keys) in PAM
2-2-3-5	Periodic review of identities and access rights	Every NHI needs an owner who can attest to it, or it cannot be reviewed

The ECC glossary defines privileged access management as managing high-risk authorisations on the entity's systems, but it does not define service accounts, so the entity's own policy must say how they are classified. Three other controls reach identities directly. Subdomain 2-12-3 requires event logging for critical and privileged accounts and remote access, SIEM collection, continuous monitoring and at least 12 months' log retention. Subdomain 2-8-3 requires secure key management across the lifecycle, which covers signing keys, TLS private keys and encryption keys held by applications. Subdomain 1-9 requires immediate revocation at the end of employment, which in practice includes the tokens, API keys and scheduled jobs a leaver created, not only their user account.

CCC-2:2024 is more explicit for cloud: generic account credentials must not be assigned to a named individual, MFA is required for privileged cloud users on both the provider and tenant side, tenants must manage all cloud credentials through their full lifecycle, and both parties must document key management with defined key ownership and recovery. Valid but stolen credentials (MITRE ATT&CK T1078, and T1078.004 for cloud accounts) and compromised suppliers (T1199 Trusted Relationship) are the attack paths these controls are built to close. See the Service Account Security Guide, the Privileged Access Management Guide and the Secrets Management Guide.

Implementation steps

Confirm scope and applicability. Record the legal basis for scope (government, affiliate or CNI), then mark each of the 28 subdomains as applicable or not with a reason. Decide at the same time whether CCC, CSCC or OTCC also apply.
Fix governance first. Establish the independent cybersecurity department, the supervisory committee and the roles in 1-2 and 1-4, because many later controls require their approval.
Run a gap assessment against ECC-2:2024, not ECC-1. Use the 31 changes listed in Appendix C to update any existing ECC-1 mapping, and drop the old Domain 5 items into an OTCC workstream.
Prioritise identity, logging and third parties. Inventory human and non-human accounts, enforce MFA for remote and privileged access, bring privileged machine credentials into PAM, and connect privileged and remote access logs to the SIEM with 12-month retention. These are the controls auditors test first and the ones attackers exploit first.
Pilot before enforcing. Apply MFA, conditional access and PAM changes to a pilot group and a small set of service accounts, monitor for broken jobs, then expand in rings. Keep a documented rollback (temporary exclusion with expiry and an approver) rather than disabling the control.
Update contracts. Add the 4-1-2 clauses to new and renewing contracts, and check that any managed SOC or support provider using remote access operates from inside the Kingdom.
Test and review. Schedule vulnerability scanning, penetration tests on internet-facing services, backup restore tests and BCM exercises, and document each periodic review the subdomains require.
Prepare for assessment. Map evidence to each control in the format the NCA's assessment and compliance tool expects, and arrange the independent audit required by 1-8.

Evidence and assessment

The NCA can evaluate compliance by any combination of entity self-assessment, periodic reports from its compliance tool and field audit visits, and it states it will issue an ECC-2:2024 assessment and compliance tool. The NCA also publishes an ECC implementation guide alongside the controls on its ECC page. Because compliance must be continuous, evidence that is a year old is weak evidence.

Control area	Evidence to keep	Metric that shows it works
2-2 Identity and access	Approved IAM policy, MFA configuration exports, PAM vault inventory, signed access review records	Percentage of privileged and remote access protected by MFA; percentage of privileged NHIs vaulted with a named owner
1-9 HR and leavers	Joiner, mover and leaver tickets with timestamps	Median time from termination to full access revocation
2-12 Logging and monitoring	SIEM source list, retention settings, use cases for privileged and remote access	Percentage of critical assets and privileged accounts sending logs; retention at or above 12 months
2-10, 2-11 Testing	Scan reports, penetration test reports and remediation tickets	Critical vulnerabilities remediated within the entity's defined timescale
4-1 Third parties	Contracts with required clauses, pre-contract risk assessments	Percentage of in-scope suppliers with ECC clauses in force
1-8 Review and audit	Independent audit reports, committee minutes, corrective action plans	Open audit findings past their due date

The ECC deliberately leaves many frequencies to the entity ("periodic"). Define them in policy, approve them through the supervisory committee and then meet them; an undefined frequency is itself a finding. See the Identity Security Metrics Guide for identity measures that fit these controls.

Mapping to other frameworks

Many in-scope entities also hold ISO/IEC 27001 certification or report against NIST. The mapping below is indicative, written by NHI Mgmt Group rather than published by the NCA, and should be used to reuse evidence, not to claim equivalence.

ECC-2:2024 subdomain	NIST CSF 2.0	NIST SP 800-53 Rev. 5
1-5 Risk management	GV.RM	RA-3 Risk Assessment
1-8 Periodic review and audit	GV.OV	CA-2 Control Assessments
2-1 Asset management	ID.AM	CM-8 System Component Inventory
2-2 Identity and access management	PR.AA	AC-2 Account Management, AC-6 Least Privilege, IA-2 Identification and Authentication, IA-5 Authenticator Management
2-8 Cryptography	PR.DS	SC-12 Cryptographic Key Establishment and Management
2-9 Backup and recovery	PR.DS, RC.RP	CP-9 System Backup
2-12 Event logs and monitoring	DE.CM	AU-6 Audit Record Review, AU-11 Audit Record Retention
2-13 Incident and threat management	RS.CO	IR-6 Incident Reporting
4-1 Third-party cybersecurity	GV.SC	SR-3 Supply Chain Controls and Processes

For an ISO/IEC 27001:2022 Annex A view, the identity controls in 2-2 sit closest to A.5.15 to A.5.18 and A.8.2, and logging to A.8.15 and A.8.16. The ECC adds national requirements no international standard has: the National Cryptographic Standards, Saudi staffing of cybersecurity roles, in-Kingdom managed service centres and reporting to the NCA. Organisations operating across the Gulf will also meet the UAE regime; see the UAE Information Assurance Standards Guide, and the Global Cybersecurity Regulatory Map for a wider view. See also the ISO 27001 Certification Guide and the CIS Controls Guide.

Common pitfalls

Working from ECC-1:2018. Mappings, policies and tool templates built for 2018 still contain Domain 5 and the old data localisation sub-control. Rebase them on ECC-2:2024 and its Appendix C.
MFA for people, nothing for machines. Privileged service accounts, cloud automation roles and CI/CD credentials are privileged accounts too. Leaving them as static passwords outside PAM fails the intent of 2-2-3-2 and 2-2-3-4, and valid account abuse (T1078) is the result.
Logging without retention or coverage. A SIEM that keeps 90 days, or that does not receive remote access and privileged session logs, does not meet 2-12-3.
Supplier remote access left out of scope. Offshore support desks and managed SOCs with remote access conflict with 4-1-3-2, and contracts without incident communication clauses leave the entity unable to meet its own 2-13 reporting duty.
Self-review presented as audit. The cybersecurity department reviewing its own controls does not satisfy the independence required by 1-8.
Treating ECC compliance as PDPL compliance. Privacy, data classification mechanisms and localisation now sit with SDAIA and the NDMO, so an ECC assessment will not show PDPL compliance.

Practitioner checklist

Document the legal basis for being in scope and an applicability decision for each of the 28 subdomains.
Confirm whether CCC-2:2024, CSCC-1:2019 or OTCC-1:2022 also apply, and plan them as extensions of the ECC.
Rebase all mappings and policies from ECC-1:2018 to ECC-2:2024 using Appendix C.
Establish an independent cybersecurity function and supervisory committee before approving policies.
Enforce MFA for all remote access and privileged accounts, and record compensating controls for privileged service accounts.
Bring privileged human and machine credentials into PAM, each with a named owner and periodic review.
Log privileged and remote access to a SIEM, monitor continuously and retain logs for at least 12 months.
Apply the National Cryptographic Standards and document key lifecycle management for application keys.
Add 4-1-2 clauses to supplier contracts and confirm remote-access managed services operate inside the Kingdom.
Keep evidence current for self-assessment, the NCA compliance tool and field audits, and arrange independent audits.

Standards and references

Related NHI Mgmt Group resources: Identity Security Regulatory Map · Critical Infrastructure Identity Security Guide · NIS2 Directive Guide · Global Privacy Regulatory Map. This guide summarises the Saudi NCA Essential Cybersecurity Controls and related NCA control sets as published in October 2026 and is not legal advice.

Saudi NCA Essential Cybersecurity Controls Guide: Domains, Scope and Compliance