NCA ECC

What it means

The Essential Cybersecurity Controls, or ECC, are a baseline set of cyber security controls issued by Saudi Arabia’s National Cybersecurity Authority (NCA). They apply to government bodies and to private organisations that own, operate or host critical national infrastructure. The document has been revised since its first release.

The controls are grouped into main domains and subdomains, covering governance, defence, resilience, and third-party and cloud security. Industrial control systems have their own related controls. Each control is written as a requirement the organisation must be able to demonstrate, not as a suggestion.

Why it matters

If you build software for a Saudi government body or an operator of critical infrastructure, expect the ECC to reach you in the contract. Customers have to show their suppliers and cloud services meet the relevant controls, so your security evidence becomes part of their compliance file.

Data location often comes up beside it. Customers may need data kept inside the Kingdom, which affects hosting and support access. Questions about data residency and about how you find and fix vulnerabilities tend to arrive together, often in the same review meeting, so prepare both answers before the call.

How it shows up

In an application, the controls translate into familiar work: identity and access management, logging and monitoring, vulnerability management, secure configuration and penetration testing. The framework includes controls on vulnerability management and penetration testing, and expects them to be documented and repeated.

The usual mistakes are treating the framework as a one-off checklist, scoping out the supplier’s part of the chain, and keeping evidence in people’s heads. Build a table that maps each requirement to a control, an owner and a document, then keep test reports and retest results where an assessor can find them.