The short version
The National Cybersecurity Authority (NCA) published the second edition of its Essential Cybersecurity Controls, ECC-2:2024, replacing ECC-1:2018. The structure is tighter and some obligations moved to other regulations.
| Element | ECC-1:2018 | ECC-2:2024 |
|---|---|---|
| Main domains | 5 | 4 |
| Subdomains | 29 | 28 |
| Main controls | 114 | 108 |
| Industrial control systems | Domain 5 | Removed from ECC; operational technology follows NCA's Operational Technology Cybersecurity Controls (OTCC) |
| Hosting data inside the Kingdom | Stated in ECC | No longer stated in ECC; governed by national data management rules under SDAIA |
| Saudization | Required for leadership and key cybersecurity roles | Extended to all cybersecurity positions |
If your programme was built on ECC-1, most of your controls still stand. The work is re-mapping, not rebuilding.
Who ECC applies to
ECC is mandatory for:
- government entities in the Kingdom, including ministries, authorities and public establishments, and their companies and affiliated entities, inside and outside the Kingdom;
- private-sector organizations that own, operate or host critical national infrastructure (CNI).
ECC also reaches companies that are not directly in scope. Entities that must comply pass ECC requirements to their suppliers through the third-party domain, so a software or services vendor to a ministry or a CNI operator should expect ECC clauses in its contracts and requests for evidence.
The four domains of ECC-2:2024
| Domain | Subdomains | What it covers |
|---|---|---|
| 1. Cybersecurity Governance | 10 | Strategy, the cybersecurity function, policies, roles, risk management, cybersecurity in IT projects, compliance with legislation, periodic review, human resources, awareness and training |
| 2. Cybersecurity Defense | 15 | Asset management, identity and access, protection of systems, email, networks and mobile devices, data protection, cryptography, backup, vulnerability management, penetration testing, event logging and monitoring, incident and threat management, physical security, web application security |
| 3. Cybersecurity Resilience | 1 | Cybersecurity within business continuity management |
| 4. Third-Party and Cloud Computing Cybersecurity | 2 | Cybersecurity requirements for third parties, and for cloud computing and hosting |
Defense carries the bulk of the technical work. Governance carries the bulk of the evidence.
What changed in practice
The industrial control systems domain is gone
ECC-1 had a fifth domain for industrial control systems. ECC-2 removes it. Organizations with operational technology, such as utilities, manufacturing or building systems, now manage those controls through OTCC. If you run IT only, there is nothing to do here.
Data hosting moved out of ECC
ECC-1 stated that data must be hosted inside the Kingdom. ECC-2 no longer carries that requirement directly. Data location is now governed by the national data management rules issued through SDAIA's National Data Management Office, the PDPL transfer rules, and sector regulators. Do not delete your hosting controls. Re-map them to those sources. Our guide to transferring personal data outside the Kingdom covers the PDPL side.
Saudization covers every cybersecurity role
ECC-2 extends the requirement to fill cybersecurity positions with qualified Saudi professionals from leadership roles to all cybersecurity positions. Review your org chart and any managed security contracts against it.
Wording and numbering changed
Controls were merged, reworded and renumbered. Your policies, control library, evidence index and audit reports all reference ECC-1 numbers. Each reference needs updating, or the next assessment becomes a translation exercise.
How to update an ECC-1 programme
- Get the official ECC-2:2024 text in Arabic and English from NCA and use the Arabic as the reference version.
- Build a crosswalk. For every ECC-1 control, mark it unchanged, reworded, merged, moved or removed, and record the ECC-2 number.
- Re-index your evidence. Point each piece of evidence to its new control number. Most evidence carries over unchanged.
- Re-assess only what changed. Run the gap assessment on reworded and merged controls instead of repeating the whole exercise.
- Update policies and standards that quote ECC-1 numbering or the old hosting clause.
- Update supplier contracts so third-party clauses reference ECC-2.
- Report through NCA's channels. NCA verifies compliance through entity self-assessments, periodic reports from compliance tools and on-site audits, and provides an assessment and compliance tool for ECC-2.
Where programmes slip during the transition
- Running two control libraries, one per edition, and evidencing both.
- Removing data hosting controls because the clause left ECC, while sector rules still require them.
- Treating ECC as a documentation exercise. Defense controls are assessed on operation: scan results, log retention, access reviews and tested backups.
- Leaving suppliers on ECC-1 contract language.
ECC alongside SAMA CSF and CCC
Financial institutions designated as critical national infrastructure answer to both ECC and the SAMA Cyber Security Framework. Organizations using cloud services also fall under NCA's Cloud Cybersecurity Controls (CCC). Run one control library mapped to all three. We explain how in SAMA CSF vs NCA ECC.
Limaz implements NCA ECC and CCC with named owners, working controls and evidence. See our NCA ECC implementation service.