On this page
- What does an NCA ECC-2:2024 checklist need to cover?
- What pattern repeats inside each ECC subdomain?
- What should you check in Domain 1, Cybersecurity Governance?
- What should you check in Domain 2, Cybersecurity Defense?
- What should you check in Domain 3, Cybersecurity Resilience?
- What should you check in Domain 4, Third-Party and Cloud Computing Cybersecurity?
- What evidence proves each ECC checklist item?
- How Sumrite helps
- Frequently asked questions
Delivered with a verified NCA-registered partner
Sumrite runs ECC testing and readiness work for Saudi organisations end to end with our verified NCA-registered partner firm, and has served 100+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. Talk to our team.
This checklist follows the structure of the ECC-2:2024 document published by NCA, subdomain by subdomain, with main-control counts taken from the published text as of November 2026. Control wording is paraphrased; always check the official text for the full requirement. For context on scope and assessment, start with our complete guide to NCA ECC compliance.
What does an NCA ECC-2:2024 checklist need to cover?
A complete NCA ECC-2:2024 checklist covers all 108 main controls and their 92 subcontrols, grouped into 28 subdomains under 4 main domains, with evidence and an owner recorded against each control ID. Anything less leaves gaps that an NCA self-assessment or field audit visit will find.
| Main domain | Subdomains | Main controls |
|---|---|---|
| 1. Cybersecurity Governance | 1-1 to 1-10 | 35 |
| 2. Cybersecurity Defense | 2-1 to 2-15 | 61 |
| 3. Cybersecurity Resilience | 3-1 | 4 |
| 4. Third-Party and Cloud Computing Cybersecurity | 4-1 to 4-2 | 8 |
| Total | 28 | 108 |
Use one row per main control, and add the subcontrols beneath the “minimum requirements” control in each subdomain. Useful columns are: control ID, requirement (paraphrased), status (met, partly met, not met, not applicable with justification), evidence reference, owner, last review date and next review date.
Want this as a spreadsheet?
We keep this checklist as a working spreadsheet with all 108 main controls, evidence columns and status formulas. Ask us for the checklist as a spreadsheet via our contact page, and we will send it over.
What pattern repeats inside each ECC subdomain?
Most ECC-2:2024 subdomains contain four main controls in the same order: requirements defined and approved, requirements implemented, minimum requirements listed, and implementation periodically reviewed. Recognising this pattern lets you build the evidence once per subdomain instead of reinventing it 28 times.
- Control 1: define
- Requirements are identified, documented and approved. Evidence: a signed policy or standard with version and approval date.
- Control 2: implement
- Requirements are put into practice. Evidence: tickets, configurations, logs, reports.
- Control 3: minimum requirements
- A list of specific subcontrols (for example ECC 2-11-3-1 scope, 2-11-3-2 periodic testing). Evidence: proof per subcontrol.
- Control 4: review
- Implementation is reviewed periodically. Evidence: review minutes or a short dated report.
Exceptions exist. Asset management (2-1) has six main controls because it adds an acceptable use policy; human resources (1-9) has six covering the employment lifecycle; and compliance with standards, laws and regulations (1-7) has a single control. NCA publishes policy and standard templates in its cybersecurity toolkits that help with the “define” control in many subdomains.
What should you check in Domain 1, Cybersecurity Governance?
Domain 1 has 10 subdomains and 35 main controls, and the checklist should confirm a strategy, an independent cybersecurity function, approved policies, a risk methodology, independent review and a working awareness programme. Governance gaps tend to cascade, so close these first.
- 1-1 Strategy (3): strategy documented and approved, action plan in progress, periodic review.
- 1-2 Cybersecurity management (3): a cybersecurity function separate from IT; all cybersecurity positions filled by full-time, qualified Saudi professionals (1-2-2); a supervisory committee that includes the head of cybersecurity.
- 1-3 Policies and procedures (4): documented and approved, implemented, supported by technical standards, periodically updated.
- 1-4 Roles and responsibilities (2): governance structure and roles assigned and periodically reviewed.
- 1-5 Risk management (4): methodology approved and applied; risk assessments at early stage of projects, before major infrastructure changes, when planning third-party services and before new services launch (1-5-3).
- 1-6 Cybersecurity in IT project management (4): requirements in project and change management; vulnerabilities fixed and hardening checked before go-live (1-6-2); secure coding for software projects.
- 1-7 Compliance (1): nationally approved international agreements with cybersecurity requirements identified and met.
- 1-8 Periodical review and audit (3): internal review; independent review by parties outside the cybersecurity department (1-8-2); results reported to the supervisory committee.
- 1-9 Human resources (6): requirements across hiring, employment and exit; access revoked immediately on termination.
- 1-10 Awareness and training (5): programme approved and delivered; covers phishing, devices, safe browsing and social media; specialist training for cybersecurity staff, developers and executives.
For 1-2-2, read our guide to staffing ECC cybersecurity roles with Saudi professionals. For 1-10-3, phishing simulations give measurable evidence that awareness works.
What should you check in Domain 2, Cybersecurity Defense?
Domain 2 has 15 subdomains and 61 main controls, and it is where most technical evidence lives: asset inventory, identity, email, network, data protection, cryptography, backups, vulnerability management, penetration testing, logging, incident response, physical security and web applications. Thirteen of the 15 subdomains follow the four-control pattern exactly.
- 2-1 Asset management (6): complete inventory, acceptable use policy approved and enforced, classification and labelling.
- 2-2 Identity and access management (4): MFA for remote and privileged access based on impact assessment, least privilege, periodic access reviews.
- 2-3 Systems and processing facilities (4): anti-malware, removable media controls, patching, time synchronisation.
- 2-4 Email protection (4): phishing filtering, MFA for remote and webmail access, archiving, SPF, DKIM and DMARC.
- 2-5 Network security (4): segmentation, environment separation, secure browsing, DDoS protection (2-5-3-9).
- 2-6 Mobile devices (4): encryption, restricted use, remote wipe, BYOD awareness.
- 2-7 Data and information protection (3): requirements defined per applicable laws and applied by classification level.
- 2-8 Cryptography (4): aligned with NCA’s National Cryptographic Standards.
- 2-9 Backup and recovery (4): critical assets covered, recovery tested periodically.
- 2-10 Vulnerability management (4): periodic assessment, severity classification, risk-based remediation, patches tested before production.
- 2-11 Penetration testing (4): all internet-facing services and components in scope, tests run periodically.
- 2-12 Event logs and monitoring (4): SIEM, privileged activity logged, retention of at least 12 months.
- 2-13 Incident and threat management (4): response plans, classification, reporting to NCA, threat intelligence.
- 2-14 Physical security (4): restricted access, CCTV, secure disposal.
- 2-15 Web application security (4): WAF, multi-tier architecture, HTTPS, risk-based authentication.
Subdomains 2-10, 2-11 and 2-15 are best evidenced by independent testing. Our guide to NCA penetration testing requirements under ECC 2-11 explains the scope line by line, and network VAPT and web application VAPT produce reports you can map directly to these control IDs.
What should you check in Domain 3, Cybersecurity Resilience?
Domain 3 has one subdomain, 3-1, with 4 main controls requiring cybersecurity to be built into business continuity management. The checklist should confirm that continuity requirements are defined, approved, implemented and periodically reviewed.
- 3-1-1: cybersecurity requirements for business continuity defined and approved.
- 3-1-2: those requirements implemented.
- 3-1-3: security systems kept running during disruption, incident response plans linked to continuity, and disaster recovery plans in place.
- 3-1-4: periodic review of the requirements.
A common gap is a disaster recovery plan that restores systems without restoring their security controls. Check that logging, EDR and access control come back with the service.
What should you check in Domain 4, Third-Party and Cloud Computing Cybersecurity?
Domain 4 has 2 subdomains and 8 main controls covering third-party contracts, IT and cybersecurity outsourcing, and cloud and hosting services. The checklist should confirm contract clauses, pre-contract risk assessments and cloud provider obligations.
- 4-1-1: cybersecurity requirements for third-party contracts defined and approved.
- 4-1-2: contracts include non-disclosure and secure data removal, incident communication procedures, and an obligation to follow your cybersecurity policies.
- 4-1-3: a risk assessment before outsourcing contracts; managed service centres for monitoring and operations that use remote access located fully inside Saudi Arabia (4-1-3-2).
- 4-1-4: periodic review of third-party requirements.
- 4-2-1 and 4-2-2: cloud and hosting requirements defined, approved and implemented.
- 4-2-3: providers protect data by classification, return it in a usable format at the end of service, and separate your environment from other tenants.
- 4-2-4: periodic review of cloud and hosting requirements.
ECC-2:2024 no longer contains the old in-Kingdom hosting sub-control; our comparison of ECC-1:2018 vs ECC-2:2024 explains where that requirement went. Cloud tenants should also check the NCA Cloud Cybersecurity Controls and our vendor risk and TPRM page.
What evidence proves each ECC checklist item?
Each ECC checklist item is proven by an approved document, operating records and a dated review, and technical controls also need independent test results. The ECC-2:2024 text says NCA assesses through self-assessment, compliance-tool reports and/or field audit visits, so evidence has to stand on its own without someone there to explain it.
| Checklist item type | Evidence that holds up | Common weak evidence |
|---|---|---|
| “Define and approve” controls | Signed policy or standard, version history, approval minutes | Unsigned drafts, templates with placeholders left in |
| “Implement” controls | Configurations, tickets, logs, training records | A statement that “this is in place” |
| Penetration testing (2-11) | Approved policy, test plan, scope reconciled to the 2-1 inventory, report, remediation tracker, retest | A scan report labelled as a pentest |
| Vulnerability management (2-10) | Scan outputs over time, severity-based SLAs, patch records | One scan from the week before the audit |
| “Periodic review” controls | Dated review minutes with actions | No record, or a review that never changed anything |
Keep evidence in a folder structure that mirrors the control IDs. When the assessor asks for 2-11-3-1, you hand over one folder, not a search.
How Sumrite helps
Sumrite delivers the testing side of ECC with our verified NCA-registered partner firm, end to end. We run vulnerability assessments for ECC 2-10, penetration tests for ECC 2-11 scoped against your asset inventory, web application testing for ECC 2-15 and cloud security assessments for ECC 4-2, then map every finding to its control ID, retest fixes and hand over an evidence pack ready for self-assessment. If you are starting from zero, our guide to running an NCA ECC gap assessment shows how to use this checklist in practice, and our NCA ECC compliance page summarises our approach.
Get the ECC-2:2024 checklist as a spreadsheet
Ask us for the full 108-control checklist as a spreadsheet, and we will walk through the technical controls with you and scope the testing evidence you still need. Book a scoping call.
Frequently asked questions
How many controls are on the NCA ECC-2:2024 checklist?
The NCA ECC-2:2024 checklist covers 108 main controls and 92 subcontrols across 4 main domains and 28 subdomains. Domain 1 (Cybersecurity Governance) has 35 main controls, Domain 2 (Cybersecurity Defense) 61, Domain 3 (Cybersecurity Resilience) 4, and Domain 4 (Third-Party and Cloud Computing Cybersecurity) 8.
Does NCA publish an official ECC checklist in Excel?
The National Cybersecurity Authority states in ECC-2:2024 that it will issue an ECC-2:2024 Assessment and Compliance Tool to organise assessment, and NCA already publishes Excel assessment tools for other control sets such as OTCC. Until you have the official tool, a working checklist built from the ECC-2:2024 control text, with evidence and owner columns, is the practical substitute.
What evidence proves an NCA ECC control is met?
An NCA ECC control is usually proven by three kinds of evidence: an approved document that defines the requirement, operating records that show it is implemented, and a dated record of the periodic review. Technical controls such as ECC 2-10 and ECC 2-11 also need scan outputs, penetration test reports, remediation trackers and retest results.
Is completing the NCA ECC checklist the same as getting certified?
Completing an NCA ECC checklist does not produce a certificate, because ECC-2:2024 is not a certifiable standard. The National Cybersecurity Authority assesses compliance through self-assessment, compliance-tool reports and/or field audit visits, so the checklist is a tool for readiness and continuous compliance, not a certification step.
How often should the NCA ECC checklist be reviewed?
An NCA ECC checklist should be reviewed at least as often as the periodic reviews it records, and in any case before each self-assessment or audit. Most ECC-2:2024 subdomains end with a control requiring periodic review of their own implementation, so an annual full pass with quarterly updates for technical controls is a sensible rhythm.
Faisal Khan is a Director at Sumrite, where he oversees penetration testing, risk assessment and compliance engagements for SaaS and enterprise clients. Case studies are anonymised and published with client permission.
