On this page
- What does ECC-2 control 1-2-2 require?
- What changed in control 1-2-2 from ECC-1:2018 to ECC-2:2024?
- Who does ECC 1-2-2 apply to?
- Which roles count as cybersecurity positions under ECC 1-2-2?
- How do contractors and managed security providers fit with ECC 1-2-2?
- What evidence proves compliance with ECC 1-2-2?
- How do other NCA control sets treat Saudi staffing?
- How can organisations close an ECC 1-2-2 gap?
- How Sumrite helps
- Frequently asked questions
Delivered with a verified NCA-registered partner
Sumrite supports ECC programmes for Saudi organisations end to end with our verified NCA-registered partner firm, and has served 100+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. Talk to our team.
Control 1-2-2 is short, but it is one of the ECC-2:2024 changes with the longest lead time, because closing a gap can mean hiring, training or restructuring. This guide quotes the control as published, explains what changed, and sets out the evidence NCA’s own guide expects. Everything here is checked against the ECC-2:2024 document as of November 2026. For the full framework, see our pillar on NCA ECC compliance.
What does ECC-2 control 1-2-2 require?
ECC-2:2024 control 1-2-2 states: “All cybersecurity positions shall be filled out with full-time and qualified Saudi cybersecurity professionals.” The requirement has three parts, and an entity must meet all three for every cybersecurity position.
- All cybersecurity positions
- Every position in the cybersecurity function, not only leadership. ECC-2:2024 sets no seniority threshold.
- Full-time
- Positions filled by full-time staff, not part-time or ad-hoc arrangements.
- Qualified Saudi cybersecurity professionals
- Saudi nationals with the qualifications the role requires. ECC-2:2024 replaced the earlier word "experienced" with "qualified".
Control 1-2-2 sits in subdomain 1-2 (Cybersecurity Management), next to two related controls. ECC 1-2-1 requires a cybersecurity department within the entity, independent of the IT and communications department. ECC 1-2-3 requires a cybersecurity supervisory committee that includes the head of the cybersecurity department. Together they define who does cybersecurity work, where it reports and who oversees it.
What changed in control 1-2-2 from ECC-1:2018 to ECC-2:2024?
ECC-2:2024 widened control 1-2-2 from senior positions to all cybersecurity positions and changed “experienced” to “qualified”. Appendix C of the ECC-2:2024 document records the change and gives the rationale as cybersecurity enhancement.
| ECC-1:2018 | ECC-2:2024 | |
|---|---|---|
| Positions covered | Head of the cybersecurity function (for example the CISO) and related supervisory and critical positions | All cybersecurity positions |
| Nationality | Saudi cybersecurity professionals | Saudi cybersecurity professionals |
| Employment basis | Full-time | Full-time |
| Competence test | Experienced | Qualified |
The practical effect is large. An organisation that met ECC-1:2018 with a Saudi CISO and Saudi team leads may now have gaps among analysts, engineers and administrators in the cybersecurity function. Our guide to ECC-1:2018 vs ECC-2:2024 changes covers the other changes in the 2024 update.
Who does ECC 1-2-2 apply to?
ECC 1-2-2 applies to every entity in ECC-2:2024 scope: Saudi government agencies, their affiliated companies and entities inside and outside the Kingdom, and private-sector entities that own, operate or host Critical National Infrastructure (CNI). NCA encourages other entities to adopt the controls but does not require it.
Two scoping points matter for staffing:
- Affiliates abroad are in scope. ECC-2:2024 covers affiliated companies and entities outside Saudi Arabia, so a government-owned company’s foreign subsidiary should check its own cybersecurity positions against 1-2-2.
- Suppliers may inherit it. Companies outside ECC scope often meet ECC because government customers flow requirements down through contracts under ECC 4-1. Read the contract to see whether staffing requirements are included.
Which roles count as cybersecurity positions under ECC 1-2-2?
ECC-2:2024 does not list the positions, but NCA’s implementation guide points to the Saudi Cybersecurity Workforce Framework (SCyWF) as the reference for cybersecurity job roles. Using SCyWF gives you a defensible, NCA-aligned definition of which roles are “cybersecurity positions”.
According to the SCyWF document published by NCA (version 1.5, 2026), the framework organises cybersecurity work into 5 categories, 12 specialty areas and 40 job roles:
| SCyWF category | Job roles |
|---|---|
| Cybersecurity Architecture, Research and Development (CARD) | 8 |
| Leadership and Workforce Development (LWD) | 6 |
| Governance, Risk, Compliance and Laws (GRCL) | 7 |
| Protection and Defense (PD) | 14 |
| Industrial Control Systems and Operational Technologies (ICS/OT) | 5 |
Each SCyWF job role is defined by tasks plus the knowledge and skills needed to perform them. That makes it useful twice: to decide which positions fall under 1-2-2, and to define what “qualified” means for each one.
How do contractors and managed security providers fit with ECC 1-2-2?
ECC 1-2-2 covers the entity’s cybersecurity positions, while outsourced services are governed separately by ECC subdomain 4-1 (Third-Party Cybersecurity); contractors doing cybersecurity work should still appear in the 1-2-2 evidence. NCA’s guide lists the expected deliverable for 1-2-2 as a personnel list covering “direct or indirect employees and contractors”.
ECC-2:2024 does not give an exception, transition period or alternative for 1-2-2. Where the text is silent, we suggest a cautious reading:
- Treat in-house roles as covered. Any role inside the cybersecurity department is a cybersecurity position.
- List every contractor. Include contractors and secondees doing cybersecurity work, with their contract type, so assessors can see the full picture.
- Govern services under 4-1. External services, such as penetration testing or managed monitoring, need the ECC 4-1 cybersecurity and non-disclosure clauses. ECC 4-1-3-2 also requires managed security operations centres that use remote access to be located fully inside the Kingdom.
- Confirm grey areas. If a long-term outsourced team effectively fills a position, take advice from your legal team or NCA before relying on it.
This is an interpretation, not NCA guidance. The control wording itself is the only binding text, and the Arabic version of ECC-2:2024 is the one that governs interpretation.
What evidence proves compliance with ECC 1-2-2?
NCA’s Guide to Essential Cybersecurity Controls Implementation (GECC-2:2026) lists the expected deliverable for ECC 1-2-2 as a detailed list of all personnel whose work relates to cybersecurity, with contract type, position titles, job roles, years of experience and qualifications. The GECC-2:2026 guide also recommends defining the academic qualifications and experience required for the head of the cybersecurity function.
- A personnel register of everyone doing cybersecurity work, direct employees and contractors, with nationality and contract type
- Position titles mapped to SCyWF job roles
- Job descriptions stating the qualifications each role requires
- Evidence of qualifications: degrees, certifications and training records
- Confirmation that each position is full-time
- Screening or vetting records for cybersecurity positions, as ECC 1-9-3-2 requires
- An approved organisation chart showing the independent cybersecurity department (ECC 1-2-1)
- For any gap: an approved hiring or development plan with dates, presented to the supervisory committee
Keep the register current. ECC-2:2024 expects continuous compliance, and staff turnover can reopen a gap at any time. Our NCA ECC-2:2024 compliance checklist shows where 1-2-2 fits among the other governance controls.
How do other NCA control sets treat Saudi staffing?
NCA’s cloud and critical-systems control sets add their own Saudi staffing requirements on top of ECC 1-2-2. If CCC or CSCC applies to you, check those controls as well.
| Control set | Control | Requirement (paraphrased) |
|---|---|---|
| ECC-2:2024 | 1-2-2 | All cybersecurity positions filled with full-time, qualified Saudi cybersecurity professionals |
| CCC-2:2024 | 1-4-P-1-1 | Positions of cybersecurity functions in a cloud provider’s data centres in the Kingdom filled with qualified Saudi nationals |
| CSCC-1:2019 | 1-5-1-2 | Technical support and development positions for critical systems filled with experienced Saudi professionals |
Sources: CCC-2:2024 and CSCC-1:2019, both published by NCA. Note that the CSCC requirement reaches beyond the cybersecurity function into technical support and development roles for critical systems. Our guides to NCA CCC-2:2024 and NCA CSCC cover both frameworks.
How can organisations close an ECC 1-2-2 gap?
Close an ECC 1-2-2 gap by mapping every cybersecurity position, identifying non-compliant ones, and approving a dated plan to fill each with a full-time, qualified Saudi professional. The plan, not just the end state, is what shows the supervisory committee and NCA that the gap is being managed.
- Map positions to SCyWF roles. List every cybersecurity position and match it to an SCyWF job role.
- Assess each position. Record nationality, employment basis and qualifications against the role definition.
- Separate positions from services. Decide which work is a position and which is an outsourced service under ECC 4-1.
- Plan hiring and development. Use SCyWF knowledge and skills to define training paths for Saudi staff moving into cybersecurity roles.
- Use specialists to carry peaks. Engage external testers for specialist, periodic work such as penetration testing (ECC 2-11), under ECC 4-1 contracts, so your in-house team focuses on running the programme.
- Report progress. Track the plan through the supervisory committee and include it in your NCA ECC gap assessment.
How Sumrite helps
Sumrite does not supply staff for your cybersecurity positions. We work alongside your Saudi cybersecurity team as a third-party testing provider under ECC 4-1, delivered with our verified NCA-registered partner firm. We run network, web application and cloud testing for ECC 2-10 and 2-11, phishing simulations for awareness under ECC 1-10, and include knowledge transfer so your team understands every finding. Our NCA ECC compliance page and Saudi Arabia page explain how we deliver.
Give your Saudi cybersecurity team specialist support
Tell us which systems need testing evidence this year, and we will scope an ECC-mapped programme your in-house team can own. Book a scoping call.
Frequently asked questions
What does NCA ECC control 1-2-2 require?
NCA ECC-2:2024 control 1-2-2 requires that all cybersecurity positions be filled with full-time and qualified Saudi cybersecurity professionals. The control sits in subdomain 1-2 (Cybersecurity Management) of the National Cybersecurity Authority's Essential Cybersecurity Controls and applies to every entity in ECC scope.
What changed in ECC 1-2-2 between ECC-1:2018 and ECC-2:2024?
ECC-1:2018 control 1-2-2 required the head of the cybersecurity function and related supervisory and critical positions to be filled with full-time and experienced Saudi cybersecurity professionals. ECC-2:2024 extended the requirement to all cybersecurity positions and changed 'experienced' to 'qualified', according to Appendix C of the ECC-2:2024 document.
Does ECC 1-2-2 apply to private companies?
ECC 1-2-2 applies to every entity within ECC-2:2024 scope: Saudi government agencies, their affiliated companies and entities inside and outside the Kingdom, and private-sector entities that own, operate or host Critical National Infrastructure. Other private companies are encouraged, but not required, to adopt the Essential Cybersecurity Controls.
What evidence proves compliance with ECC 1-2-2?
NCA's Guide to Essential Cybersecurity Controls Implementation (GECC-2:2026) lists the expected deliverable for ECC 1-2-2 as a detailed list of all personnel, direct or indirect employees and contractors, whose work relates to cybersecurity. The list should show contract type, position titles, job roles, years of experience and academic and professional qualifications.
Can an organisation use an external penetration testing firm under ECC 1-2-2?
ECC 1-2-2 governs the entity's own cybersecurity positions, while third-party services such as penetration testing are governed by ECC subdomain 4-1 (Third-Party Cybersecurity). Organisations should still record any contractors doing cybersecurity work in the 1-2-2 personnel list, apply the 4-1 contract and screening requirements, and confirm the treatment of specific outsourced roles with their legal adviser or the National Cybersecurity Authority.
Faisal Khan is a Director at Sumrite, where he oversees penetration testing, risk assessment and compliance engagements for SaaS and enterprise clients. Case studies are anonymised and published with client permission.
