On this page
- Can ISO 27001 controls be reused for NCA ECC-2?
- How do ISO 27001 and NCA ECC-2 differ in purpose and structure?
- How do ECC-2 domains map to ISO 27001 at a domain level?
- Which ECC-2 requirements does ISO 27001 not cover?
- Does an ISO 27001 certificate prove NCA ECC compliance?
- How do you build an ISO 27001 to ECC-2 mapping, step by step?
- Is there an official NCA mapping between ECC and ISO 27001?
- How Sumrite helps
- Frequently asked questions
Delivered with a verified NCA-registered partner
Sumrite supports ECC programmes for Saudi organisations end to end with our verified NCA-registered partner firm, and has served 100+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. Talk to our team.
Organisations that already hold ISO 27001 often ask how much of ECC-2:2024 they have already done. The answer is usually “a good share of the structure, not all of the specifics”. This guide maps the two at domain level, using the ECC-2:2024 document published by NCA, as of November 2026. It deliberately does not offer a control-by-control crosswalk, because NCA has not published one for ECC-2:2024. For the ECC framework itself, start with our pillar on NCA ECC compliance.
Can ISO 27001 controls be reused for NCA ECC-2?
Yes: ISO 27001 controls and evidence can be reused for NCA ECC-2:2024 wherever they meet the ECC requirement as written, and that overlap is largest in governance, risk management, asset management, human resources and supplier controls. Reuse is about evidence: the same approved policy or audit report can be filed against an ISO clause and an ECC control ID.
Reuse works because ECC follows a management-system rhythm that ISO users already know. Most ECC subdomains ask that requirements be defined, documented and approved, then implemented, then periodically reviewed. An ISMS built on ISO 27001 already produces approved documents, operating records and review evidence in that pattern.
Reuse fails when the ISO control is broader or more flexible than the ECC requirement. ECC often names a specific minimum, and an ISO control that leaves the method to your risk assessment may not evidence it.
How do ISO 27001 and NCA ECC-2 differ in purpose and structure?
ISO 27001 is a voluntary, certifiable international standard for running a risk-based ISMS, while NCA ECC-2:2024 is a mandatory national baseline of minimum controls for in-scope Saudi entities, assessed by NCA and not certifiable. The difference in purpose explains most of the mapping gaps.
| ISO/IEC 27001:2022 | NCA ECC-2:2024 | |
|---|---|---|
| Issued by | ISO and IEC | National Cybersecurity Authority, Saudi Arabia |
| Nature | Voluntary international standard | Mandatory for government entities, affiliates and CNI operators |
| Control set | 93 Annex A controls in 4 themes | 108 main controls and 92 subcontrols in 4 domains and 28 subdomains |
| Control selection | Risk-based, recorded in a Statement of Applicability | Minimum baseline; controls apply unless they do not apply to the entity |
| Outcome | Certificate from an accredited body | No certificate; NCA assesses through self-assessment, compliance-tool reports and/or audit visits |
| National specifics | None | Saudi staffing, in-Kingdom managed security centres, national references |
According to ISACA, ISO 27001:2022 reorganised Annex A into 93 controls across four themes (organisational 37, people 8, physical 14, technological 34), and the transition period for 2013-based certificates ended on 31 October 2025. If your mapping still references ISO 27001:2013 control numbers, update it first.
How do ECC-2 domains map to ISO 27001 at a domain level?
At domain level, ECC-2 Domain 1 (Governance) maps mainly to ISO 27001’s management-system clauses plus the organisational and people themes of Annex A, Domain 2 (Defense) maps to the technological and physical themes, and Domains 3 and 4 map to organisational controls on continuity and suppliers. Use this as a starting map, then confirm each ECC requirement against the actual ISO evidence.
| ECC-2:2024 subdomains | Closest ISO 27001:2022 area | Typical reuse |
|---|---|---|
| 1-1 Strategy, 1-2 Management, 1-3 Policies, 1-4 Roles | Leadership and planning clauses; organisational theme (policies, roles) | High for policies and roles; ECC adds an independent department, Saudi staffing and a supervisory committee |
| 1-5 Risk Management | Planning and operation clauses (risk assessment and treatment) | High; ECC adds mandatory assessment triggers (1-5-3) |
| 1-6 Projects, 1-7 Compliance | Organisational theme (projects, legal and contractual requirements) | Medium |
| 1-8 Review and Audit | Performance evaluation clause (internal audit, management review) | High; ECC 1-8-2 requires review by parties outside the cybersecurity department |
| 1-9 Human Resources, 1-10 Awareness | People theme | High; ECC 1-10-3 names specific topics, including phishing |
| 2-1 to 2-13, 2-15 Defense | Technological theme | Medium; ECC sets specific minimums, for example for email, web applications and penetration testing |
| 2-14 Physical Security | Physical theme | High |
| 3-1 Business Continuity | Organisational theme (continuity) | Medium; ECC focuses on cybersecurity aspects of BCM |
| 4-1 Third Parties, 4-2 Cloud and Hosting | Organisational theme (suppliers, cloud services) | Medium; ECC specifies contract clauses and cloud requirements |
The “typical reuse” column is our practical judgement from ECC programmes, not an NCA rating. Your own reuse depends on how your ISMS was built and how current its evidence is.
Which ECC-2 requirements does ISO 27001 not cover?
ISO 27001 does not cover ECC-2:2024’s Saudi-specific organisational requirements or its prescriptive technical minimums, including Saudi staffing (1-2-2), an independent cybersecurity department (1-2-1), a supervisory committee (1-2-3), periodic penetration testing of all internet-facing services (2-11) and in-Kingdom managed security centres (4-1-3-2). These are the controls to plan for first, because several take months to close.
- ECC 1-2-1: a cybersecurity department independent of the IT and communications department
- ECC 1-2-2: all cybersecurity positions filled with full-time, qualified Saudi cybersecurity professionals; see our guide to ECC-2 Saudization of cybersecurity roles
- ECC 1-2-3: a cybersecurity supervisory committee established by the Authorized Official, including the head of the cybersecurity department
- ECC 1-5-3: risk assessments at defined triggers, including early in technology projects and before major infrastructure changes
- ECC 1-8-2: review and audit by parties other than the cybersecurity department
- ECC 2-11: periodic penetration testing of all services provided externally via the internet and their technical components; see NCA penetration testing requirements under ECC 2-11
- ECC 2-15: specific web application protections for external web applications
- ECC 4-1-3-2: cybersecurity managed service centres that use remote access located fully inside the Kingdom
ISO 27001 asks you to manage technical vulnerabilities (see our guide to ISO 27001 Annex A 8.8), but it does not prescribe periodic penetration testing of every internet-facing service. ECC does. Our guide to the ISO 27001 VAPT audit explains how one well-scoped test can serve both.
Does an ISO 27001 certificate prove NCA ECC compliance?
No: an ISO 27001 certificate does not prove NCA ECC compliance, because ECC-2:2024 is assessed by NCA against its own control text, and there is no ECC certificate for an ISO certificate to stand in for. The ECC-2:2024 document says NCA evaluates compliance through self-assessment, periodic reports from the compliance tool and/or field audit visits.
An ISO certificate is still useful evidence. It shows an operating ISMS, regular internal audits and management review, which supports ECC 1-8 and the governance controls. Present it as supporting evidence against specific ECC control IDs, not as a substitute for them. Our ISO 27001 compliance page and NCA ECC compliance page describe how we support each track.
How do you build an ISO 27001 to ECC-2 mapping, step by step?
Build an ISO 27001 to ECC-2 mapping by listing every ECC-2:2024 requirement, linking each to existing ISO evidence, scoring the fit, and planning work for every gap. Start from ECC, not from ISO, because ECC is the requirement you are proving.
- List ECC requirements. Use all 28 subdomains, 108 main controls and 92 subcontrols as rows; our NCA ECC-2:2024 checklist gives the order.
- Link ISO evidence. For each row, record the ISO clause or Annex A control and the specific document, record or report that might satisfy it.
- Test the fit. Check whether the ISO evidence meets the ECC wording, including any named minimum, frequency or scope.
- Score the result. Mark each row met, partly met, not met or not applicable, with a reason.
- Plan the gaps. Add ECC-only controls, extend scopes and update policies to cite ECC control IDs alongside ISO references.
- Verify technical controls. Use vulnerability assessments and penetration tests to confirm Domain 2 rows rather than relying on policy statements.
- Maintain one evidence store. Tag each artefact with both ISO and ECC references so audits for either framework draw from the same source.
This is the same method as a full NCA ECC gap assessment, with your ISMS as the starting evidence. If you also answer to the Saudi Central Bank, our guide to NCA ECC vs SAMA CSF covers the second mapping.
Is there an official NCA mapping between ECC and ISO 27001?
The ECC-2:2024 document does not include a mapping to ISO 27001 or any other international standard, so any ISO-to-ECC crosswalk you use is a third-party or in-house interpretation. The ECC-2:2024 text says only that the controls are linked to relevant national and international legislative and regulatory requirements.
NCA has published mappings for other control sets. Its CSCC page says the Critical Systems Cybersecurity Controls (CSCC-1:2019) were mapped to ISO 27001:2013, NIST CSF v1.1, PCI DSS v3.2.1 and the CIS Controls. That mapping targets an older ISO edition and a different control set, so treat it as a reference point, not as ECC-2 evidence. Our NCA CSCC guide covers that framework. Vendor crosswalks to NIST or ISO can speed up the first draft, but check each line against the ECC-2:2024 text, and the Arabic version, which governs interpretation.
How Sumrite helps
Sumrite helps ISO 27001-certified organisations close the ECC-2:2024 gaps with our verified NCA-registered partner firm. We review your ISMS evidence against ECC control by control, run the network, web application and cloud testing ECC 2-10 and 2-11 require, add phishing simulations for ECC 1-10, and tag every finding with both ISO and ECC references so one report serves both audits. Our Saudi Arabia page explains how we deliver the VAPT report for Saudi reviews in 48 hours. Working with an ISO or SOC 2 auditor already? We can coordinate with them on shared evidence; ask us for the mapping register as a spreadsheet.
Turn your ISO 27001 evidence into ECC-2 evidence
Share your Statement of Applicability and ECC scope, and we will show which ECC-2:2024 controls you can evidence today and which need work. Book a scoping call.
Frequently asked questions
Can ISO 27001 controls be reused for NCA ECC compliance?
ISO 27001 controls can be reused for NCA ECC-2:2024 compliance where they meet the ECC requirement, because both frameworks cover governance, risk, people, technical controls, continuity and suppliers. ISO 27001 evidence such as policies, risk registers, asset inventories and internal audit reports often supports ECC controls directly, but ECC adds Saudi-specific and prescriptive requirements that ISO 27001 does not contain.
Does an ISO 27001 certificate mean an organisation is NCA ECC compliant?
An ISO 27001 certificate does not mean an organisation is NCA ECC compliant. ECC-2:2024 is a mandatory national baseline assessed by the National Cybersecurity Authority through self-assessment, compliance-tool reports and audit visits, and it includes requirements such as Saudi staffing of all cybersecurity positions (ECC 1-2-2) that ISO 27001 does not address.
Has NCA published an official ISO 27001 to ECC-2 mapping?
The ECC-2:2024 document published by the National Cybersecurity Authority does not include a mapping to ISO 27001 or other international standards. NCA has published framework mappings for some other control sets; its page for the Critical Systems Cybersecurity Controls (CSCC-1:2019) says those controls were mapped to ISO 27001:2013, NIST CSF v1.1, PCI DSS v3.2.1 and the CIS Controls.
Which NCA ECC requirements are not covered by ISO 27001?
NCA ECC-2:2024 requirements that ISO 27001 does not cover include full-time, qualified Saudi professionals in all cybersecurity positions (ECC 1-2-2), a cybersecurity department independent of IT (ECC 1-2-1), a cybersecurity supervisory committee (ECC 1-2-3), periodic penetration testing of all internet-facing services (ECC 2-11), and in-Kingdom location of remote-access managed security operations centres (ECC 4-1-3-2).
How many controls are in ISO 27001:2022 and NCA ECC-2:2024?
ISO 27001:2022 Annex A contains 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34), according to ISACA. NCA ECC-2:2024 contains 108 main controls and 92 subcontrols across 4 main domains and 28 subdomains. The two sets are structured differently, so a mapping should be done requirement by requirement, not by count.
