ECC-1:2018 vs ECC-2:2024: What Changed and What It Means for You Every change, checked by Sumrite.

NCA lists every change in Appendix C, Table 4 (“List of Updates”) of the ECC-2:2024 document. We checked each change in this guide against that table, as of November 2026. For the wider framework, read our complete guide to NCA ECC compliance.

What is the difference between ECC-1:2018 and ECC-2:2024?

ECC-2:2024 is a smaller, clarified version of ECC-1:2018: it has 4 main domains and 108 main controls instead of 5 domains and 114 main controls, moves industrial control systems to OTCC and hands data localisation and privacy topics to NDMO. NCA’s ECC-1:2018 page lists the five original domains and 114 main controls; the ECC-2:2024 introduction states 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols.

Area	ECC-1:2018	ECC-2:2024
Main domains	5	4
Main controls	114	108
Industrial control systems	Main domain 5 inside ECC	Deleted; moved to OTCC
In-Kingdom hosting (4-2-3-3)	Hosting and storage inside Saudi Arabia	Deleted; referred to NDMO
Saudization (1-2-2)	Senior and supervisory roles (per Clyde & Co)	All cybersecurity positions, full-time and qualified
DDoS protection	Not a named sub-control	Added as 2-5-3-9
Email domain validation (2-4-3-5)	General wording	Names SPF, DKIM and DMARC
Scope wording	Government entities and CNI	Adds affiliated companies inside and outside the Kingdom

Most changes in Table 4 are labelled “clarification”. Only a handful remove or add obligations, and those are the ones covered below.

Why did the control count fall from 114 to 108?

The control count fell from 114 to 108 because ECC-2:2024 deleted main controls rather than adding new ones: the Industrial Control Systems domain was removed, control 1-7-1 on compliance with national cybersecurity laws was removed, and control 2-7-3 on data ownership, classification and privacy was removed. Table 4 of ECC-2:2024 records each deletion and its rationale.

The reasons NCA gives are worth knowing because they tell you where the obligation went:

• Domain 5 (ICS): moved to OTCC.
• 1-7-1 (national laws): deleted for “regulatory maturity and compliance support”. The remaining compliance control, about nationally approved international agreements with cybersecurity requirements, is numbered 1-7-1 in the ECC-2:2024 body text.
• 2-7-3 (ownership, classification and privacy minimums): deleted because these topics fall under the mandates of NDMO at the Saudi Data & AI Authority (SDAIA).

Because 1-7 and 2-7 were renumbered, an evidence folder labelled with ECC-1 IDs can point to the wrong control. In ECC-2:2024, 2-7-3 is the periodic review control for data protection, not the old privacy minimums. Relabel before your next self-assessment.

Where did the Industrial Control Systems domain go?

The Industrial Control Systems Cybersecurity domain was deleted from ECC-2:2024 and moved to NCA’s Operational Technology Cybersecurity Controls (OTCC-1:2022). Table 4 also removes the ICS and SIS abbreviations from ECC for the same reason.

NCA’s OTCC page describes OTCC as an extension to the ECC, setting minimum requirements for organisations protecting their industrial control systems. NCA also publishes an OTCC methodology and mapping annex and an OTCC assessment and compliance tool in Excel on the same page.

What this means for you:

• If you run OT or ICS, your ICS evidence now maps to OTCC control IDs, not ECC domain 5. Keep meeting ECC for your IT estate as the base.
• If you have no OT, the deletion simply shrinks your ECC scope; record “not applicable” for OTCC with a short justification.
• Testing changes too. OT environments need different test methods from IT. Our IoT and hardware security testing covers devices and embedded systems; plan OT testing separately from your ECC 2-11 internet-facing tests.

Did ECC-2:2024 remove the in-country data hosting requirement?

Yes, ECC-2:2024 deleted sub-control 4-2-3-3, which said an entity’s information hosting and storage must be inside the Kingdom of Saudi Arabia, and moved data localisation to NDMO. Table 4 of the ECC-2:2024 document records the deletion and tells entities to consult NDMO on the topic.

Do not read this as permission to move data abroad. Three things still apply:

1. NDMO and SDAIA rules. Data localisation now sits with NDMO, and personal data transfers fall under the Personal Data Protection Law (PDPL). See our Saudi PDPL compliance guide.
2. Other regulations. Clyde & Co’s analysis notes that the removal does not necessarily ease localisation, because government data hosting and sector-specific rules may still require it.
3. ECC 4-1-3-2 still has a location rule. Cybersecurity managed service centres for monitoring and operations that use remote access must be located fully inside Saudi Arabia.

The cloud controls that remain in ECC 4-2-3 now focus on how providers protect your data: protection by classification, return of data in a usable format at the end of service, and separation from other tenants’ environments. Cloud tenants should also read our guide to NCA CCC cloud cybersecurity controls.

What changed for Saudization under control 1-2-2?

ECC-2:2024 control 1-2-2 requires all cybersecurity positions to be filled by full-time, qualified Saudi cybersecurity professionals. Table 4 marks 1-2-2 as modified for “cybersecurity enhancement”, and the wording changed from “experienced” to “qualified”.

According to Clyde & Co, ECC-1:2018 applied the Saudi-nationals requirement only to senior positions, so ECC-2:2024 widens it to the whole cybersecurity function. That affects hiring plans, contractor use and how you document roles under 1-4. Our guide to ECC-2 control 1-2-2 and cybersecurity Saudization covers practical options, including how outsourced services are treated.

What other controls were modified in ECC-2:2024?

ECC-2:2024 also modified controls on multi-factor authentication, email security, network security, data protection, cryptography, web application authentication, third parties and cloud providers. Most changes clarify existing obligations, but several make expectations more specific.

2-2-3-1 and 2-2-3-2 (IAM)

Single-factor authentication wording clarified; MFA factors, number and techniques set by impact assessment, covering remote and privileged access.

2-4-3-2 (email MFA)

MFA for remote and webmail access, with factors set by impact assessment.

2-4-3-5 (email domain validation)

Now names SPF, DKIM and DMARC explicitly.

2-5-3-9 (network, added)

New sub-control requiring protection against distributed denial-of-service (DDoS) attacks.

2-7-2 (data protection)

Protection requirements applied based on each data classification level.

2-8-3 (cryptography)

References NCA's National Cryptographic Standards.

2-15-3-5 (web apps)

User authentication factors set by impact assessment.

4-1 and 4-1-3 (third parties)

Objective and contract requirements reworded around IT outsourcing, cybersecurity outsourcing and managed services.

4-2-3-1 (cloud)

Providers protect data by classification and return it in a usable format at the end of service.

Several definitions changed too. “Confidential” data became “Sensitive”, a cyber attack is now an intentional attempt whether successful or not, and the scope statement now names affiliated companies inside and outside the Kingdom.

Two of these changes are testable from the outside. Email authentication (SPF, DKIM, DMARC) can be checked in minutes, and DDoS exposure and remote-access MFA show up in an external network VAPT. Authentication factors on web apps (2-15-3-5) are tested in a web application VAPT.

What should you do if your programme was built on ECC-1:2018?

If your programme was built on ECC-1:2018, remap it to ECC-2:2024 control IDs, update policies for the modified controls, move ICS evidence to OTCC and re-confirm hosting decisions with NDMO rules. Most of your existing evidence still counts.

How Sumrite helps

Sumrite delivers ECC testing with our verified NCA-registered partner firm and manages the work end to end. We update your test scope for the controls ECC-2:2024 changed, test internet-facing services for ECC 2-11 and web applications for ECC 2-15, check email authentication and remote-access MFA, map every finding to its ECC-2:2024 control ID, and retest until the evidence is clean. See our NCA ECC compliance page for how we support the framework, and our ECC 2-11 penetration testing guide for the testing detail.