NCA ECC-2:2024 Explained: What Changed & What You Must Do | Sahl

What Is NCA ECC? (Quick Answer)

The National Cybersecurity Authority (NCA) issued NCA ECC (Essential Cybersecurity Controls) as Saudi Arabia’s cybersecurity baseline.

The framework establishes cybersecurity controls designed to help organizations protect information and technology assets and manage cybersecurity risks.

The current edition is ECC-2:2024, which replaced ECC-1:2018.

If your cybersecurity policies, gap assessments, vendor questionnaires, or compliance documentation still reference the 2018 version, it is important to review them against ECC-2:2024.

This guide explains what changed, who needs to pay attention to the framework, and what organizations can do to prepare for compliance assessments.

ECC-1:2018 vs ECC-2:2024 at a Glance

	ECC-1:2018	ECC-2:2024
Main domains	5	4
Subdomains	29	28
Main controls	114	108
Industrial Control Systems	Included as a domain	Addressed through separate NCA OT controls
Cybersecurity staffing	Previous Saudization requirements	Updated requirements for qualified Saudi cybersecurity professionals
Data localization	Referenced within ECC	Addressed through the relevant data governance framework

The reduction from 114 to 108 controls does not mean that organizations can simply do less.

ECC-2:2024 restructures and clarifies requirements, making it important to reassess existing control mappings rather than assuming ECC-1 evidence automatically satisfies ECC-2.

The Four NCA ECC-2:2024 Domains

1. Cybersecurity Governance

This domain establishes the management and governance foundation for cybersecurity.

It covers:

• Cybersecurity strategy
• Policies and procedures
• Roles and responsibilities
• Risk management
• Cybersecurity in IT projects
• Regulatory compliance
• Periodic review and audit
• Human resources
• Awareness and training

Governance gives cybersecurity controls clear ownership, accountability, and an evidence trail.

2. Cybersecurity Defense

This is the main technical area of the framework.

It covers areas such as:

• Asset management
• Identity and access management
• System and information protection
• Email protection
• Network security
• Mobile device security
• Data protection
• Cryptography
• Backup and recovery
• Vulnerability management
• Penetration testing
• Logging and monitoring
• Incident and threat management
• Physical security
• Web application security

Organizations should not treat these as isolated technical checkboxes. Each control should have an owner, defined processes, and evidence demonstrating that it operates effectively.

3. Cybersecurity Resilience

This domain focuses on cybersecurity within business continuity management.

The goal is to ensure that organizations consider cybersecurity risks when preparing for disruption, recovery, and continued operations.

4. Third-Party and Cloud Computing Cybersecurity

This domain addresses cybersecurity risks associated with suppliers, managed service providers, outsourcing, and cloud environments.

Organizations should assess:

• Third-party security risks
• Supplier requirements
• Contractual cybersecurity obligations
• Cloud security controls
• Ongoing supplier monitoring
• Third-party evidence

The Key Changes in ECC-2:2024

1. A Leaner Framework

ECC-2:2024 reduces the framework from 114 to 108 main controls.

This should not be interpreted as a reduction in cybersecurity expectations. Requirements have been reorganized and consolidated.

Organizations should therefore map their existing ECC-1 controls against ECC-2 rather than simply carrying forward the old assessment.

2. ICS/OT Is No Longer an ECC Domain

ECC-1:2018 included Industrial Control Systems (ICS) as a dedicated domain.

Under ECC-2:2024, NCA addresses OT/ICS requirements through its separate operational technology cybersecurity controls.

Organizations operating industrial environments should therefore assess the applicable IT and OT requirements separately.

3. Updated Cybersecurity Staffing Requirements

ECC-2:2024 includes updated expectations concerning cybersecurity personnel and qualified Saudi professionals.

Organizations should review their cybersecurity staffing models, roles, qualifications, and employment arrangements against applicable requirements.

4. Data Localization Is Addressed Through the Relevant Data Governance Framework

Data localization should not be treated as an ECC-only requirement.

Organizations should also consider applicable requirements and guidance from the National Data Management Office (NDMO) and other relevant Saudi authorities.

This makes it important to coordinate cybersecurity, data governance, privacy, and data residency programs.

5. Scope and Applicability Need to Be Assessed

ECC applicability depends on the organization’s type and regulatory status.

Relevant government entities and private-sector organizations that own, operate, or host Critical National Infrastructure should assess their obligations under the framework.

Suppliers and service providers may also encounter ECC requirements through contracts with organizations subject to the framework.

6. Stronger Focus on Authentication and Access Controls

ECC-2:2024 places continued emphasis on identity and access management.

Organizations should review:

• Privileged accounts
• Administrative access
• Authentication mechanisms
• Access reviews
• Credential management
• Multi-factor authentication
• Business-based access requirements

The goal is not simply to deploy MFA, but to demonstrate that access controls are properly governed, implemented, reviewed, and supported by evidence.

Who Must Comply With NCA ECC?

Organizations that should assess ECC applicability include:

• Government ministries, authorities, and establishments within the framework’s scope
• Relevant subsidiaries and affiliates where applicable
• Private-sector organizations that own, operate, or host Critical National Infrastructure
• Organizations subject to ECC through applicable regulatory or contractual obligations

Vendors, cloud providers, managed service providers, and other third parties may also be required to demonstrate cybersecurity alignment when serving in-scope organizations.

Why Organizations Struggle With ECC Compliance

Organizations often struggle with ECC assessments not because cybersecurity controls are completely missing, but because they cannot prove that those controls operate effectively over time.

For example, an organization may have MFA, vulnerability management, security monitoring, backups, and incident-response procedures.

But an assessment may still require evidence showing:

• Who owns the control
• When it was implemented
• When it was reviewed
• Which systems are covered
• What exceptions exist
• What remediation was completed
• Whether the control operated consistently

This makes compliance an ongoing evidence-management process, rather than a project that starts shortly before an audit.

How to Prepare for NCA ECC-2:2024 Compliance

Step 1: Confirm Applicability

Determine whether ECC-2:2024 applies to your organization and identify any additional regulatory or contractual requirements.

Step 2: Build Your ECC-2 Control Register

For each applicable control, assign:

• An owner
• A status
• Required evidence
• Review frequency
• Risk or remediation information

Step 3: Perform a Gap Assessment

Compare your current cybersecurity environment against ECC-2:2024 and identify missing or partially implemented controls.

Step 4: Build an Evidence Library

Maintain evidence such as:

• Policies and procedures
• Risk assessments
• Access reviews
• Vulnerability reports
• Penetration-testing reports
• Training records
• Incident records
• Audit reports
• Vendor assessments

Step 5: Monitor Controls Continuously

Track evidence collection, control reviews, remediation activities, and compliance status throughout the year.

Step 6: Prepare Audit-Ready Reports

Your compliance process should clearly connect:

Control → Owner → Status → Evidence → Review History → Gap → Remediation

How Sahl Helps With NCA ECC-2:2024 Compliance

Sahl is an AI-powered GRC platform built for organizations operating in the MENA regulatory environment.

Control Mapping

Map ECC-2:2024 requirements to internal controls, assign owners, and track implementation status.

Continuous Evidence Collection

Collect and maintain evidence throughout the year instead of preparing everything immediately before an assessment.

Real-Time Compliance Visibility

Monitor control status, evidence coverage, gaps, and remediation activities from a centralized dashboard.

Cross-Framework Mapping

Map overlapping requirements across frameworks such as:

• NCA ECC
• ISO 27001
• SAMA CSF
• PDPL

This helps reduce duplicate compliance work and reuse relevant evidence.

Audit-Ready Reporting

Quickly access controls, owners, evidence, status, and review history when preparing for an assessment.

NCA ECC-2:2024 Compliance Checklist

Before your next assessment, ask:

• Have we confirmed whether ECC-2:2024 applies to us?
• Have we mapped our controls to ECC-2:2024?
• Does every applicable control have an owner?
• Have we completed a gap assessment?
• Is evidence linked to each applicable control?
• Are policies reviewed regularly?
• Are privileged accounts reviewed?
• Are vulnerabilities tracked through remediation?
• Are security events monitored?
• Are incident-response processes tested?
• Are third-party and cloud risks assessed?
• Are cybersecurity staffing requirements addressed?
• Are applicable OT/ICS requirements assessed?
• Can we produce an audit-ready evidence trail?

If several answers are “no,” your organization may have a compliance visibility or evidence-management gap even when the underlying security controls already exist.

Frequently Asked Questions

Final Takeaway

ECC-2:2024 is more than a new compliance checklist.

Organizations transitioning from ECC-1:2018 should review their governance, technical controls, third-party risks, staffing, and evidence-management processes against the updated framework.

The key question is not simply:

“Do we have the control?”

It is:

“Can we continuously demonstrate that the control is implemented, owned, reviewed, and working?”

Sahl helps organizations centralize ECC-2:2024 requirements, connect controls to evidence, monitor readiness continuously, and generate audit-ready reports without relying on disconnected spreadsheets.

Ready to see where your organization stands? Book a demo with Sahl and manage your ECC-2:2024 readiness from one dashboard.

Sources

• National Cybersecurity Authority (NCA), Essential Cybersecurity Controls (ECC-2:2024)
• Clyde & Co, Saudi Arabia’s Essential Cybersecurity Controls 2024 (ECC-2): Key Updates and Implications, January 2025