NCA ECC Compliance in 2026: The Complete Guide to ECC-2:2024 The NCA pillar guide from Sumrite.

This is the hub of our NCA ECC series. It explains what ECC-2:2024 is, who it binds, how its 108 controls are organised and how NCA checks compliance, then links out to deeper guides on each part of the programme. Every figure below comes from the ECC-2:2024 document published by NCA, as of November 2026.

What is NCA ECC compliance?

NCA ECC compliance is the state of having implemented, and continuing to operate, the minimum cybersecurity requirements in the Essential Cybersecurity Controls (ECC-2:2024) issued by Saudi Arabia’s National Cybersecurity Authority. ECC-2:2024 replaced ECC-1:2018 and is the second version of the framework, issued in 2024.

ECC is a baseline, not a ceiling. NCA built it as the floor that every in-scope entity must reach, and then layered sector- and system-specific control sets on top for cloud, critical systems and operational technology. If you are only going to read one NCA document properly, read this one: the other control sets assume you already meet it.

Three features shape how ECC compliance works in practice:

• It is continuous. The ECC-2:2024 text says entities must ensure ongoing and continuous compliance, so a gap assessment from two years ago proves little.
• It is evidence-driven. Most controls ask you to define, implement and periodically review requirements, so a reviewer looks for approved documents, operating records and review minutes.
• It is national. ECC is published by NCA, the Kingdom’s cybersecurity regulator, and its current page is on the NCA controls list, alongside the English and Arabic versions of the document.

Who must comply with NCA ECC-2:2024?

NCA ECC-2:2024 is mandatory for Saudi government agencies, their affiliated companies and entities inside and outside the Kingdom, and private-sector entities that own, operate or host Critical National Infrastructure. The ECC-2:2024 document lists government ministries, authorities and establishments explicitly, and NCA encourages all other Saudi entities to adopt the controls voluntarily.

Two scoping details are easy to miss:

• Affiliated companies outside the Kingdom are in. ECC-2:2024 clarified that the scope covers affiliated companies and entities inside and outside Saudi Arabia. A government-owned company’s foreign subsidiary cannot assume ECC stops at the border.
• Subdomain 4-2 depends on what you use. The cloud computing and hosting controls bind entities that use, or plan to use, cloud and hosting services.

Private companies that are not CNI now have their own NCA baseline. According to Al Tamimi & Company’s analysis, the Non-CNI Private Sector Entities Cybersecurity Controls (NCNICC-1:2025) apply 65 mandatory controls to larger companies and 26 to small and medium-sized ones. Many suppliers to government buyers still meet ECC because their customers flow it down through contracts under ECC 4-1.

How is ECC-2:2024 structured?

ECC-2:2024 is organised into 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols, with control IDs written as domain-subdomain-control, for example ECC 2-11-3. Counting the main controls per subdomain in the published text gives the split below.

Main domain	Subdomains	Main controls	Examples
1. Cybersecurity Governance	10 (1-1 to 1-10)	35	Strategy, cybersecurity function, policies, risk management, review and audit, HR, awareness
2. Cybersecurity Defense	15 (2-1 to 2-15)	61	Asset management, IAM, email, network, data protection, cryptography, vulnerability management, penetration testing, logging, incidents, web applications
3. Cybersecurity Resilience	1 (3-1)	4	Cybersecurity aspects of business continuity
4. Third-Party and Cloud Computing Cybersecurity	2 (4-1, 4-2)	8	Third-party contracts, outsourcing, cloud and hosting
Total	28	108	92 subcontrols sit beneath the main controls

Most subdomains follow the same four-step rhythm: requirements are defined, documented and approved (control 1), implemented (control 2), meet a list of minimum requirements (control 3), and are periodically reviewed (control 4). Once you see that pattern, ECC becomes much easier to plan. Our NCA ECC-2:2024 compliance checklist walks through all 28 subdomains in that order.

The controls that most often decide an assessment

• ECC 1-2-2: all cybersecurity positions filled by full-time, qualified Saudi cybersecurity professionals. See our guide to ECC-2 Saudization of cybersecurity roles.
• ECC 1-8-2: independent review and audit of control implementation by parties outside the cybersecurity department.
• ECC 2-1: an asset inventory that every other control, including penetration test scope, is reconciled against.
• ECC 2-10 and 2-11: vulnerability management and penetration testing, which produce the most concrete technical evidence.
• ECC 4-1-3-2: cybersecurity managed service centres for monitoring and operations that use remote access must be located fully inside Saudi Arabia.

Is there an NCA ECC certificate?

No. There is no NCA ECC certificate, and ECC-2:2024 is not certifiable in the way ISO 27001 is. The ECC-2:2024 text says NCA evaluates compliance through several methods, including self-assessment by the entity, periodic reports from the compliance tool, and/or field audit visits.

That has practical consequences:

• You cannot “pass” once. Compliance is a running state that NCA can check at any time through any of those methods.
• Third-party “ECC certificates” have no NCA standing. An auditor can give you a report, and a consultancy can issue an attestation letter, but neither is an NCA certificate.
• Evidence beats badges. The same ECC-2:2024 text says NCA will issue an ECC-2:2024 Assessment and Compliance Tool to organise assessment. Build your evidence so that it maps cleanly to that structure: control ID, requirement, evidence, owner, date.

If an ISO 27001 certificate is what a buyer needs, our ISO 27001 compliance page covers that track. Our guide to mapping ISO 27001 to NCA ECC-2 shows how much of that work you can reuse.

What changed from ECC-1:2018 to ECC-2:2024?

ECC-2:2024 reduced the framework from 5 main domains and 114 main controls to 4 main domains and 108 main controls, moved industrial control systems to the Operational Technology Cybersecurity Controls (OTCC), and deleted the in-Kingdom hosting sub-control. NCA’s ECC-1:2018 page lists the five original domains and 114 main controls; Appendix C of ECC-2:2024 lists every update.

The changes that matter most for planning:

• Domain 5 (Industrial Control Systems Cybersecurity) was deleted and its controls moved to OTCC-1:2022.
• Sub-control 4-2-3-3, which required hosting and storage inside the Kingdom, was deleted, with data localisation referred to the National Data Management Office (NDMO).
• Control 1-2-2 now covers all cybersecurity positions, not only leadership and supervisory roles.
• DDoS protection (2-5-3-9) was added, and email domain validation now names SPF, DKIM and DMARC.

Our full comparison, ECC-1:2018 vs ECC-2:2024, covers each change and what it means for an existing programme.

Which ECC controls require technical security testing?

Penetration testing (ECC 2-11) and vulnerability management (ECC 2-10) require testing directly, and several other controls, including ECC 1-6-2, 2-15 and 1-8, are far easier to evidence with test results. These are the controls where a report from a qualified tester carries the most weight.

ECC 2-11 Penetration Testing

Periodic tests of all internet-facing services: infrastructure, websites, web apps, mobile apps, email and remote access. See [ECC 2-11 explained](/blog/nca-ecc-penetration-testing-requirements).

ECC 2-10 Vulnerability Management

Periodic vulnerability assessment, severity classification, risk-based remediation and tested patching.

ECC 1-6-2

Projects must remediate vulnerabilities and check hardened configuration before go-live, which a pre-release test evidences.

ECC 2-15 Web Application Security

WAF, multi-tier architecture, HTTPS and risk-based authentication for external web apps; a [web application VAPT](/services/web-application-vapt) shows whether they hold.

ECC 1-10-3

Awareness must cover phishing, which [phishing simulations](/services/phishing-simulations) measure.

ECC 4-2

Cloud and hosting controls, checked by a [cloud security assessment](/services/cloud-security-assessment).

ECC-2:2024 says penetration tests must be conducted “periodically” and leaves the interval to your approved policy. NCA’s own published penetration testing policy template uses at least once a year for internet-facing services and at least every six months for critical systems; the ECC 2-11 guide covers this in detail. For the wider Saudi testing picture, including SAMA, read our pillar on penetration testing in Saudi Arabia.

How do you achieve NCA ECC compliance, step by step?

Achieving NCA ECC compliance means confirming scope, running a gap assessment against all 108 main controls, building the governance documents, implementing the technical controls, testing them and keeping evidence current. The order matters, because governance controls such as the cybersecurity function (1-2) and risk methodology (1-5) are prerequisites for almost everything else.

Treat step 7 as the start of the next cycle, not the end of the project.

How does ECC relate to other NCA control sets?

ECC is the foundation, and other NCA control sets either extend it for specific environments or replace it for entities outside its scope. NCA describes OTCC on its OTCC page as an extension to ECC, and the same model applies to the cloud and critical-systems controls.

Control set	Who it is for	Relationship to ECC	Our guide
ECC-2:2024	Government entities, affiliates, CNI operators	The baseline	This page
CCC-2:2024	Cloud service providers and cloud tenants	Adds cloud-specific controls	NCA CCC guide
CSCC-1:2019	Owners and operators of critical systems	Adds stricter controls; ECC compliance is a prerequisite	NCA CSCC guide
OTCC-1:2022	Organisations running industrial control systems	Extension to ECC; took over the former ECC Domain 5	See the ECC-1 vs ECC-2 guide
NCNICC-1:2025	Private companies that are not CNI	A separate, tiered baseline	See the ECC 2-11 guide

Map shared requirements once, then evidence them against each control ID. A single well-scoped penetration test, for example, can serve ECC 2-11 and the matching CSCC control if the scope and frequency meet the stricter of the two. Our NCA ECC compliance page and NCA CCC page summarise how we support each framework.

How Sumrite helps

Sumrite delivers ECC testing with our verified NCA-registered partner firm and manages the engagement end to end. We scope penetration tests and vulnerability assessments against your ECC 2-1 asset inventory, test networks, web applications, mobile apps and cloud estates, map every finding to its ECC control ID, support remediation, retest, and hand over an evidence pack built for self-assessment and NCA audit visits. If you need a reference point, see what our sample VAPT report looks like. For a Saudi-specific starting point, our Saudi Arabia page explains how we deliver the VAPT report for Saudi reviews in 48 hours.