Cybersecurity reports to IT
ECC requires a cybersecurity department independent of IT, reporting to the head of the entity or a delegate. A CISO who reports to the CIO is a governance finding before any technical control is tested.
Compliance service
Implement NCA ECC and CCC controls.
Limaz maps ECC 2-2024 and CCC 2-2024 to your systems, cloud services and owners, implements priority controls, builds the evidence, and closes the gaps.
What Limaz delivers
- ECC 2-2024 and CCC 2-2024 readiness and gap assessment
- Control-to-system, owner, and evidence mapping
- Cloud provider and tenant responsibility mapping
- Cloud control architecture and secure configuration
- Risk-prioritized implementation roadmap
- Technical and process control implementation
- Evidence readiness, validation, and remediation tracking
NCA ECC: the essential baseline
The Essential Cybersecurity Controls are the National Cybersecurity Authority's baseline requirements for covered national entities. ECC-2:2024 updates the earlier ECC-1:2018 text.
ECC-2:2024 is built from 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols. The four domains are Cybersecurity Governance, Cybersecurity Defense, Cybersecurity Resilience, and Third-Party and Cloud Computing Cybersecurity.
It covers government agencies in the Kingdom and their affiliated companies and entities, inside and outside the Kingdom, together with private-sector entities that own, operate or host Critical National Infrastructure.
NCA CCC: the cloud layer
CCC 2-2024 extends ECC for cloud computing, from the perspective of both cloud service providers and cloud service tenants. The responsibilities are related, and each side owns its own.
Limaz maps your cloud services, data, and providers, makes every shared control explicit between provider and tenant teams, and builds one evidence model across ECC and CCC.
How Limaz implements ECC and CCC
Baseline both frameworks
Establish which ECC and CCC controls apply to your entity, and which systems, cloud services and third parties they land on.
Map controls to reality
Which systems, processes, providers and tenants actually cover each applicable control.
Assign operating owners
Name the people responsible for each control, review routine, exception, and escalation.
Implement the gaps
Technical, cloud-configuration and process work sequenced so teams can finish it.
Keep evidence live
One evidence model across ECC and CCC, ready for the next assessment.
The ECC domains at a glance
- 1. Cybersecurity Governance (10 subdomains)
- Strategy, cybersecurity management, policies and procedures, roles and responsibilities, risk management, cybersecurity in IT projects, compliance with standards, laws and regulations, periodic review and audit, human resources, and the awareness and training programme. This domain decides who owns cybersecurity, who approves it and who checks it.
- 2. Cybersecurity Defense (15 subdomains)
- Asset management, identity and access management (IAM), protection of information systems and processing facilities, email protection, network security, mobile devices, data and information protection, cryptography, backup and recovery, vulnerability management, penetration testing, event logs and monitoring, incident and threat management, physical security, and web application security. Most of the technical work lives here.
- 3. Cybersecurity Resilience (1 subdomain)
- The cybersecurity side of business continuity management (BCM): keeping critical services running through a cyber incident and recovering them to plan.
- 4. Third-Party and Cloud Computing Cybersecurity (2 subdomains)
- Third-party cybersecurity, covering contracts, suppliers and outsourced services, and cloud computing and hosting cybersecurity. Subdomain 4-2 binds every covered entity that uses or plans to use cloud computing and hosting services, and it is the bridge into CCC.
Who ECC and CCC apply to
ECC applies to two groups. The first is government agencies in the Kingdom, including ministries, authorities and establishments, together with their affiliated companies and entities inside and outside the Kingdom. The second is every private-sector entity that owns, operates or hosts Critical National Infrastructure (CNI).
NCA defines CNI as essential infrastructure whose loss or compromise would cause significant harm to basic services, national security or the state economy. Banks, payment operators, telecom and energy operators should settle their position against that definition early, because the answer decides the whole control set.
CCC follows the same scope from the cloud side. Its tenant controls cover government and CNI entities when they consume cloud services. Its provider controls cover any Cloud Service Provider (CSP) that serves those tenants, wherever the provider is based. A provider that serves only non-Saudi entities outside the Kingdom, or private entities that operate no CNI, sits outside CCC.
Companies outside both groups, such as fintechs and technology suppliers, can adopt ECC as their baseline. It gives them the same control language their government and CNI customers are measured against, and those customers pass ECC requirements down through the third-party domain.
CCC for cloud providers vs cloud tenants
- Two control sets, one structure
- CCC-2:2024 contains a provider set and a tenant set. Both share the same main domains and subdomains and split at the control level. A "P" in the control code marks a provider control and a "T" marks a tenant control, for example 1-3-P-1-1.
- Cloud Service Provider (CSP)
- 4 main domains, 24 subdomains, 37 main controls and 94 subcontrols, across governance, defense, resilience and third-party cybersecurity. They cover the platform itself, including change management, key management, secure system development and the provider's own supply chain.
- Cloud Service Tenant (CST)
- 18 main controls and 26 subcontrols. They sit on top of the full ECC, so a tenant carries both: every ECC control plus the tenant controls for the cloud services it consumes.
- Four levels, set by data classification
- Level 1 applies to data classified top secret and Level 4 to public data. Each control is marked mandatory or optional for each level, for providers and tenants, so the classification of the data in a service sets the controls it needs.
- Both sets extend ECC
- NCA states that CCC extends and complements ECC. Tenants must stay compliant with both. Providers must comply with both ECC and CCC too, whether or not they fall under ECC on their own.
- Data localisation moved to NDMO
- CCC-2:2024 removed the data localisation controls that CCC-1:2020 carried and transferred them to the National Data Management Office (NDMO) at SDAIA. ECC-2:2024 made the same change. Data residency questions now go to NDMO requirements.
Evidence NCA assessments look for
- An approved cybersecurity strategy with its initiatives and implementation roadmap, signed by the head of the entity or a delegate
- An organisation chart showing a cybersecurity department independent of IT, reporting to the head of the entity or a delegate, plus the decision that established it
- The cybersecurity supervisory committee's charter, membership and minutes
- Approved policies, procedures and technical standards, with proof they reached staff
- A cybersecurity risk register, treatment plan and assessment reports, including assessments at the start of technology projects
- A current asset register, ideally fed by a configuration management database (CMDB), with every asset classified
- System configuration screenshots proving IAM controls, including multi-factor authentication (MFA) for remote access and privileged accounts
- Cybersecurity event logs retained for at least 12 months, with monitoring of critical assets and privileged accounts
- Incident records, including the reports submitted to NCA
- Backup restore test results and periodic penetration test reports with remediation
- Third-party contracts carrying cybersecurity requirements, and cloud provider evidence mapped to CCC
- Review and audit reports from parties other than the cybersecurity department
Common ECC and CCC gaps
These findings hold up ECC and CCC assessments, and each one has a clear fix.
MFA stops at the VPN
MFA covers remote access and every privileged account. Admin consoles, cloud root accounts and emergency accounts are where it gets missed.
Logs expire too early
ECC sets a 12-month minimum for cybersecurity event logs. Cloud logging and SIEM retention defaults are often shorter, so the gap only shows when an auditor asks for last year's records.
Unsigned policies
Drafts in a shared folder count for nothing. Policies need approval by the entity's authorised official, a review cycle and proof they reached staff.
Self-marked homework
The cybersecurity team reviews its own controls and stops there. ECC also requires review and audit by parties other than the cybersecurity department.
Cloud duties left implicit
Tenants assume the provider covers controls that sit on the tenant side, and provider evidence never gets mapped to CCC. Every cloud control needs a named owner on one side or the other.
Running ECC and CCC as one programme
One control register, one owner list and one evidence store. This is how Limaz runs ECC and CCC together.
Fix your position
Confirm whether you are a government entity, a CNI operator, a cloud tenant, a cloud provider or several of these. Record the data classification level of every cloud service.
Build one register
Load the 108 ECC main controls, the CCC provider or tenant controls for each level, and any sector framework such as SAMA CSF into one register. Map each control to systems, services and suppliers.
Split cloud ownership
For every cloud control, record whether the provider, the tenant or both own it, and which contract clause or provider report proves it.
Close governance gaps first
Department, supervisory committee, strategy and approved policies come first, because every other control depends on them. Then move to IAM and MFA, logging, vulnerability management, backups and incident reporting.
Collect evidence at source
Link each control to the system that produces its proof: identity provider settings, SIEM retention, ticketing records, test reports. Evidence stays current without a scramble before each assessment.
Prepare for NCA assessment
NCA measures compliance through self-assessment, periodic reports from its ECC-2:2024 and CCC-2:2024 assessment and compliance tools, and field audit visits. Keep submissions and evidence ready for all three.
Review on a cycle
Run periodic internal reviews and independent audits, and update the register after every significant change to systems, suppliers or cloud services.
Mapping to SAMA CSF, ISO 27001 and other NCA controls
- SAMA Cyber Security Framework (SAMA CSF)
- The Saudi Central Bank's framework (version 1.0, May 2017) applies to banks, insurance and reinsurance companies, financing companies, credit bureaus and the financial market infrastructure. Its four domains are leadership and governance, risk management and compliance, operations and technology, and third-party security, and institutions must operate at maturity level 3 or higher. The domains line up closely with ECC, so an institution under both runs one register: SAMA CSF adds maturity scoring, and ECC adds national requirements such as incident reporting to NCA and full-time Saudi cybersecurity staff.
- ISO/IEC 27001:2022
- A certifiable standard for establishing, implementing, maintaining and continually improving an information security management system (ISMS). ECC was built from a study of national and international standards, so ISO 27001 risk assessment, policies and Annex A controls map across well. Certification proves the management system works. ECC compliance still needs evidence against each NCA control, including the national ones.
- CSCC (Critical Systems Cybersecurity Controls)
- CSCC-1:2019 extends ECC for national critical systems, with 32 main controls and 73 subcontrols in four domains.
- DCC (Data Cybersecurity Controls)
- DCC-1:2022 extends ECC with minimum requirements to protect data across its entire lifecycle.
- OTCC (Operational Technology Cybersecurity Controls)
- OTCC-1:2022 extends ECC to industrial control systems. It took over the fifth domain that ECC-1:2018 carried for industrial control systems.
- TCC and OSMACC
- NCA also publishes the Telework Cybersecurity Controls (TCC) and the Organizations' Social Media Accounts Cybersecurity Controls (OSMACC). Limaz adds whichever of these apply to the same register, so one control can satisfy several frameworks with one piece of evidence.
Further reading
NCA ECC-2:2024: what changed from ECC-1, and what to update
The second edition of the Essential Cybersecurity Controls is shorter, not easier. Here is what moved, what was removed, and how to update an existing ECC programme without starting over.
SAMA CSF vs NCA ECC: which applies to you, and how to run both
Many Saudi financial institutions answer to both frameworks. The fastest route is one control library with two mappings, not two parallel programmes.
Questions
ECC 2-2024 is the current version of the National Cybersecurity Authority's Essential Cybersecurity Controls. It updates ECC-1:2018.
CCC 2-2024 is the National Cybersecurity Authority's Cloud Cybersecurity Controls framework for cloud service providers and cloud service tenants. It extends ECC for cloud computing.
If you provide or use cloud services, yes. CCC builds on ECC, so Limaz implements both as one program with one control map and one evidence model.
NCA ECC is the national cybersecurity baseline for covered entities. SAMA CSF is the cybersecurity framework for SAMA-supervised financial institutions. Many organizations need both.
ECC-2:2024 applies to government agencies in Saudi Arabia, including ministries, authorities and establishments, and their affiliated companies and entities inside and outside the Kingdom. It also applies to every private-sector entity that owns, operates or hosts Critical National Infrastructure (CNI). Suppliers to covered entities meet ECC requirements through their contracts, because the third-party domain requires covered entities to write cybersecurity requirements into them.
ECC-2:2024 has 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols. The domains are Cybersecurity Governance (10 subdomains), Cybersecurity Defense (15), Cybersecurity Resilience (1), and Third-Party and Cloud Computing Cybersecurity (2). The cloud subdomain binds any covered entity that uses or plans to use cloud computing and hosting services.
NCA evaluates compliance through several means: self-assessment by the entity, periodic reports from its ECC-2:2024 Assessment and Compliance Tool, and field audit visits, using whichever mechanism NCA deems appropriate. Covered entities must maintain ongoing, continuous compliance, so evidence has to stay current between assessments rather than being assembled for each one.
Yes, when they serve covered tenants. CCC-2:2024 applies to any cloud service provider that provides cloud services to government entities or to private entities owning, operating or hosting Critical National Infrastructure. A provider that serves only non-Saudi entities outside the Kingdom, or private entities that operate no CNI, sits outside CCC. Providers under CCC must comply with both ECC and CCC.
CCC-2:2024 uses four levels tied to data classification. Level 1 applies to top secret data, Level 4 applies to public data, and the two levels between them cover the classifications in between. Each provider and tenant control is marked mandatory or optional per level, so the classification of the data a cloud service handles decides which controls it must meet.
ECC-2:2024 now has 4 domains, 28 subdomains, 108 main controls and 92 subcontrols. The fifth domain of ECC-1:2018, covering industrial control systems, moved to the Operational Technology Cybersecurity Controls (OTCC). The data localisation control in the cloud subdomain was removed and referred to the National Data Management Office (NDMO) at SDAIA. CCC-2:2024 made the same localisation change.
ISO 27001 certification gives you a working information security management system, and much of it maps onto ECC. NCA assesses against its own controls, though, including national requirements such as a cybersecurity department independent of IT, full-time Saudi cybersecurity staff, incident reporting to NCA and 12-month log retention. Map ISO evidence to each ECC control and close the national gaps.
ECC-2:2024 requires cybersecurity event logs to be retained for at least 12 months. Logging and monitoring must cover critical information assets, privileged and critical accounts, and remote access. Check your SIEM and cloud logging retention settings against the 12-month minimum, because platform defaults are often shorter.
Discuss your requirements with Limaz
Tell us which system, control, or requirement you are working on. We’ll come back with a clear next step.