SAMA CSF implementation
When SAMA supervision also applies.
SAMA CSF implementationCompliance service
Assess and implement NCA ECC 2-2024 controls.
Limaz assesses the current state, maps ECC 2-2024 to systems and owners, implements priority controls, organizes evidence, and tracks remediation.
What Limaz delivers
- ECC 2-2024 readiness and gap assessment
- Control-to-system, owner, and evidence mapping
- Risk-prioritized implementation roadmap
- Technical and process control implementation
- Evidence readiness, validation, and remediation tracking
What ECC is
The Essential Cybersecurity Controls are NCA's baseline cybersecurity requirements for in-scope national entities. ECC-2:2024 updates the earlier ECC-1:2018 text.
ECC-2:2024 is built from 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols. The four domains are Cybersecurity Governance, Cybersecurity Defense, Cybersecurity Resilience, and Third-Party and Cloud Computing Cybersecurity.
Scope covers government agencies in the Kingdom and their affiliated companies and entities, inside and outside the Kingdom, together with private-sector entities that own, operate or host Critical National Infrastructure.
Implementation maps each applicable control to systems, owners, procedures, evidence, and remediation work.
How Limaz implements ECC
01
Baseline against ECC 2-2024
Establish which controls apply to your entity and which systems, processes and third parties they land on.
02
Map controls to reality
Which systems, processes, and third parties actually cover each applicable control.
03
Assign operating owners
Name the people responsible for each control, review routine, exception, and escalation.
04
Implement the gaps
Technical and process work sequenced so teams can finish it.
05
Keep evidence live
So the next assessment does not require a forensic reconstruction.
Related Limaz pages
Cybersecurity and regulatory engineering
The Limaz delivery model for control programs.
Cybersecurity and regulatory engineeringSecurity control implementation
Identity, logging, encryption, and related technical work.
Security control implementationQuestions
ECC 2-2024 is the current public version of the National Cybersecurity Authority's Essential Cybersecurity Controls. It updates ECC-1:2018.
Map controls to systems and owners, design the target operating model, implement technical and process controls, then keep evidence current. Limaz delivers that program.
NCA ECC is a national cybersecurity baseline for in-scope entities. SAMA CSF is a cybersecurity framework for SAMA-supervised financial institutions. Some organizations need both.
Limaz designs, implements and validates the controls. The NCA issues and maintains the framework.
Last reviewed: Sep 12, 2026
Official sources
Discuss your requirements with Limaz
Tell us which system, control, or requirement you are working on. We’ll review the scope and suggest the next step.