Two regulators, two frameworks
The SAMA Cyber Security Framework (SAMA CSF) and the National Cybersecurity Authority's Essential Cybersecurity Controls (NCA ECC) cover much of the same ground. They come from different regulators, apply to different organizations and measure compliance differently.
| SAMA CSF | NCA ECC | |
|---|---|---|
| Issuer | Saudi Central Bank (SAMA) | National Cybersecurity Authority (NCA) |
| Applies to | Member organizations supervised by SAMA: banks, insurers, finance companies, payment service providers and other regulated financial institutions | Government entities and their companies, and private organizations that own, operate or host critical national infrastructure |
| Current version | Version 1.0, May 2017 | ECC-2:2024, replacing ECC-1:2018 |
| Structure | 4 domains, 32 subdomains | 4 main domains, 28 subdomains, 108 controls |
| How it is measured | Maturity levels 0 to 5, with level 3 as the minimum | Compliance with each control |
| How it is assessed | Periodic self-assessment, reviewed and audited by SAMA | Self-assessment, periodic reports from compliance tools, and on-site audits by NCA |
Which one applies to you
- Supervised by SAMA, not a government entity or CNI operator. SAMA CSF is your framework. ECC can still reach you through contracts if you serve government clients or CNI operators.
- A financial institution designated as critical national infrastructure, or government-owned. Both apply. Banks and financial market infrastructure can be designated CNI, and government-owned financial entities fall under ECC directly.
- A government entity or CNI operator outside the financial sector. ECC applies. SAMA CSF does not.
- A technology vendor. Neither applies directly, but both arrive through contracts. Banks pass SAMA CSF third-party requirements to vendors, and government entities pass ECC requirements to theirs.
If you are unsure whether you are designated CNI, ask NCA and your sector regulator before you scope the programme. The answer changes the work.
Where they overlap
The two frameworks line up domain by domain.
| SAMA CSF | NCA ECC-2:2024 | Shared control areas |
|---|---|---|
| Leadership and Governance; Risk Management and Compliance | 1. Cybersecurity Governance | Strategy, policies, roles, committee oversight, risk management, compliance, reviews and audits, awareness and training |
| Operations and Technology | 2. Cybersecurity Defense | Asset management, identity and access, network and system protection, cryptography, logging and monitoring, incident, threat and vulnerability management, physical security |
| Operations and Technology (incident and continuity elements) | 3. Cybersecurity Resilience | Cybersecurity in business continuity |
| Third Party Cyber Security | 4. Third-Party and Cloud Computing Cybersecurity | Vendor requirements, outsourcing, cloud |
Most controls satisfy both frameworks once they are written precisely enough: one access review procedure, one vulnerability management standard, one incident plan.
Where they differ
- Maturity versus compliance. SAMA scores each subdomain on maturity, so a control that exists but is not measured stays at level 3. NCA asks whether each control is implemented. The same evidence serves both, but the reporting is different.
- Sector-specific content. SAMA CSF has subdomains for payment systems and electronic banking. ECC has explicit subdomains for email protection, mobile devices, penetration testing and web application security.
- Continuity. ECC places cybersecurity in business continuity in its own domain. SAMA covers business continuity through its separate Business Continuity Management Framework.
- Reporting. Different regulators, different assessment cycles, different submission channels.
How to run one programme for both
- Build one control library. Write each control once, in your own words, at the level of detail an auditor can test.
- Map each control to both frameworks. Record the SAMA CSF subdomain and the ECC control number it satisfies.
- Apply the stricter requirement. Where the two differ, for example on retention periods or testing frequency, implement the stricter one and you meet both.
- Keep one evidence repository. Each piece of evidence is filed once and referenced by every framework it supports.
- Give every control one owner. Ownership by framework creates two teams doing the same work.
- Report twice, from the same source. Generate the SAMA self-assessment and the NCA submission from the same library, so the two never contradict each other.
The same library extends to NCA's Cloud Cybersecurity Controls (CCC), the PDPL and SAMA's Counter-Fraud Framework. Our compliance and assurance service builds exactly this.
For the detail of each framework, see our SAMA CSF implementation and NCA ECC implementation pages, and our guide to what changed in ECC-2:2024.