NCA Essential Cybersecurity Controls (ECC-2:2024)
National Cybersecurity Authority · Saudi Arabia · Updated July 30, 2026
The Essential Cybersecurity Controls are the minimum cybersecurity requirements for national entities in Saudi Arabia, issued by the National Cybersecurity Authority. They are structured around four pillars — strategy, people, process and technology — and aim at the confidentiality, integrity and availability of entities’ information and technology assets.
The current edition, ECC-2:2024, replaced ECC-1:2018 in October 2024. The consolidation reduced the control count and merged overlapping requirements; it did not relax them. Several areas moved out of the ECC entirely because another national authority now owns them.
Structure at a glance
- Main domains
- 4
- Subdomains
- 28
- Main controls
- 108
- Subcontrols
- 92
- Current version
- ECC-2:2024 (replaced ECC-1:2018)
Structure verified against the NCA's published ECC-2:2024 document (classification Public, TLP White).
Who is in scope
- Government agencies in Saudi Arabia, including ministries, authorities and establishments
- Their affiliated companies and entities, inside and outside the Kingdom
- Private sector entities owning, operating or hosting Critical National Infrastructure
- All other entities in the Kingdom are strongly encouraged to adopt the controls as best practice
How compliance is assessed
The NCA evaluates compliance through entity self-assessment, periodic reports from its compliance tool, and field audit visits. It issues its own ECC-2:2024 Assessment and Compliance Tool as the authoritative instrument.
Go deeper on NCA ECC
What changed from ECC-1:2018
Control-level changes read from the NCA’s own change log — the new DDoS control, the DMARC requirement, and what moved to SDAIA.
ECC to ISO 27001 mapping
All 28 subdomains mapped to ISO 27001:2022 Annex A, with the five places the mapping breaks down.
Free ECC self-assessment
Rate all 28 subdomains, get a readiness score per domain, export your gap list. No signup.
ECC compliance software
What to check before buying a platform for ECC, and which questions separate real content from a dropdown entry.
Compare compliance platforms
Every platform scored on regional framework content, data residency and Arabic support.