# NCA Essential Cybersecurity Controls — ECC-2:2024

Current version: **ECC-2:2024** (supersedes ECC-1:2018). Issued by the National Cybersecurity Authority (NCA); official English text at nca.gov.sa.

## Structure

**4 main domains · 28 subdomains · 108 main controls + 92 subcontrols.** Control IDs use domain-subdomain-control format (e.g., 1-1-1).

| # | Domain | Focus |
|---|---|---|
| 1 | Cybersecurity Governance | Strategy, management commitment, policies, roles, risk management, HR security, awareness, in-project cybersecurity, compliance review |
| 2 | Cybersecurity Defense | Asset management, identity & access, system/information protection, email, network, mobile devices, data protection, cryptography, backup, vulnerability & patch management, penetration testing, logging & monitoring, incident & threat management, physical security, web application security |
| 3 | Cybersecurity Resilience | Business continuity aspects of cybersecurity (resilience of cybersecurity in BCM) |
| 4 | Third-Party & Cloud Computing Cybersecurity | Supplier/outsourcing cybersecurity, cloud computing cybersecurity |

Change from ECC-1:2018 (5 domains, 29 subdomains, 114 controls): the standalone ICS/OT domain was removed — OT environments are now covered by **OTCC-1:2022**.

## Applicability

- **Mandatory**: government entities (ministries, authorities, establishments) and their companies/subsidiaries; private-sector entities that own, operate, or host **Critical National Infrastructure (CNI)**.
- **Recommended**: all other entities in the Kingdom.
- Entities remain accountable for ECC compliance of outsourced/cloud services (see CCC).

## Compliance mechanics

- Entity **self-assessment** against ECC, with periodic compliance reporting to NCA via NCA's compliance tool, plus NCA audits/on-site assessments.
- Implementation evidence per control: policy artifacts, technical configuration evidence, review records, Arabic governance documents where required.
- Assessment ratings follow implemented / partially implemented / not implemented / not applicable with justification.

## Citation discipline

Cite control IDs only in the N-N-N format and only where confident of the specific control; otherwise cite domain/subdomain by name and direct the user to the official ECC-2:2024 document. Never invent IDs.