# NCA ECC: Saudi National Cybersecurity Authority Essential Cybersecurity Controls

> Mandatory baseline cybersecurity controls for Saudi government entities and critical infrastructure operators.

URL: https://securei3.com/standards/nca-ecc/
Category: GCC regulations: Law or regulation
Provider: Secure iQube (independent consultancy; ISO certificates are issued by accredited certification bodies; SOC and ISAE reports by licensed CPA and audit firms, which Secure iQube can arrange through partner firms)


The Essential Cybersecurity Controls issued by Saudi Arabia's National Cybersecurity Authority, now in their ECC-2:2024 edition, set minimum requirements across governance, defence, resilience, third-party and cloud security, and industrial control systems. We assess your current state, prioritise remediation and help you prepare compliance evidence.

## Who it is for

- Saudi government entities
- Operators of critical national infrastructure
- Vendors and service providers to those entities

## Benefits

- Meets mandatory national requirements
- Clear mapping to ISO 27001 controls
- Evidence ready for NCA assessments

## How Secure iQube helps

1. **Applicability and scoping**: Confirm whether and how the law applies to you, entities, data, systems, roles and territories.
2. **Data and process mapping**: Build a record of processing or control inventory so obligations can be tied to real systems and owners.
3. **Gap assessment**: Measure current practice against each obligation and rank the gaps by legal and business risk.
4. **Remediation roadmap**: Policies, notices, contracts, technical controls and governance, sequenced so the highest risks close first.
5. **Evidence and ongoing monitoring**: A compliance calendar, metrics and periodic reviews so you can demonstrate compliance to a regulator or customer at any time.

## Frequently asked questions

### How does NCA ECC relate to ISO 27001?

Both cover similar domains, but ECC is prescriptive and mandatory for in-scope entities. We map ECC controls to an ISO 27001 ISMS so one control set satisfies both.

Related: https://securei3.com/standards/iso-27001/, https://securei3.com/standards/sama-csf/, https://securei3.com/standards/ksa-pdpl/

Contact: https://securei3.com/contact/: info@securei3.com