How to Run an NCA ECC Gap Assessment, Step by Step A practical method from Sumrite.

A gap assessment is the first real piece of work in any ECC programme. It tells you how far you are from the baseline, what to fix first and what evidence you already hold. This guide sets out the method we use, built on the ECC-2:2024 document published by NCA and NCA’s own implementation guide, as of November 2026. For the full framework, start with our pillar on NCA ECC compliance.

What is an NCA ECC gap assessment?

An NCA ECC gap assessment is a structured review that scores each ECC-2:2024 control as met, partly met or not met, backed by evidence, and turns the gaps into a prioritised plan. It answers two questions: where does the organisation stand today, and what must change before NCA checks?

An ECC gap assessment is different from an NCA assessment. The ECC-2:2024 text says NCA evaluates compliance through multiple means, including self-assessment by the entity, periodic reports from the compliance tool and/or field audit visits. A gap assessment is your preparation for all three. It is also different from a certification audit: ECC is not certifiable, and there is no ECC certificate to obtain at the end.

	ECC gap assessment	NCA compliance assessment
Who runs it	The entity, internal audit or a consultant	The National Cybersecurity Authority
Purpose	Find and prioritise gaps	Evaluate compliance
Method	Interviews, document review, technical testing	Self-assessment, compliance-tool reports, audit visits
Output	Scored control register and roadmap	NCA findings and required actions
Certificate	None	None

When should you run an ECC gap assessment?

Run an NCA ECC gap assessment when ECC first applies to you, after moving from ECC-1:2018 to ECC-2:2024, before a planned NCA self-assessment or audit visit, and after major organisational or technology change. Because ECC-2:2024 requires ongoing and continuous compliance, a gap assessment older than your last major change proves little.

Common triggers we see:

• A new mandate. A company becomes a government affiliate, starts operating Critical National Infrastructure, or signs a government contract that flows ECC down through ECC 4-1.
• The ECC-2:2024 transition. Control IDs moved and several controls changed wording, so an ECC-1:2018 register needs remapping. Our guide to ECC-1:2018 vs ECC-2:2024 changes lists them.
• Independent review under ECC 1-8-2. ECC-2:2024 requires review and audit of control implementation by parties other than the cybersecurity department. A gap assessment shortly before that review lets you close easy gaps first.

What do you need before you start an ECC gap assessment?

Before an ECC gap assessment starts, you need an agreed scope, a named sponsor, a current asset inventory, and access to the people who own each control. Without those four, the assessment turns into a document hunt.

If you already hold an ISO 27001 certificate, much of that evidence exists. Our guide to mapping ISO 27001 to NCA ECC-2 explains what carries over and what does not.

How do you run an NCA ECC gap assessment, step by step?

Run an NCA ECC gap assessment in seven steps: confirm applicability, baseline assets, gather evidence, interview owners, score each control, test technical controls, and report with a roadmap. The order matters because governance controls such as the cybersecurity function (ECC 1-2) and risk management (ECC 1-5) underpin almost everything else.

Our NCA ECC-2:2024 compliance checklist lists all 28 subdomains in order, which makes a useful working index for step 5.

How should you score each ECC control?

Score each ECC control on a four-value scale (met, partly met, not met, not applicable) and record the evidence, owner and date beside it. A simple scale scored consistently is worth more than a complex maturity model scored loosely.

Met

The requirement is documented, approved, implemented and periodically reviewed, and current evidence proves each part.

Partly met

Some parts exist, for example an approved policy with no implementation records, or a control applied to some systems but not all.

Not met

The requirement is missing, or the evidence is too old or too thin to show it operates.

Not applicable

The control does not apply, for example 4-2 for an entity that neither uses nor plans to use cloud or hosting services. Record the reason.

Most ECC subdomains follow the same rhythm: requirements are defined, documented and approved; implemented; meet a list of minimum requirements; and are periodically reviewed. Score each of those parts. A subdomain often fails on the last one, because review records are the first thing to lapse.

What evidence do assessors expect for ECC controls?

Assessors expect evidence that each ECC control is approved, operating and reviewed, and NCA’s Guide to Essential Cybersecurity Controls Implementation lists the expected deliverables for every control. That guide, published by NCA as GECC-2:2026, sets out each control’s objective, suggested implementation steps and expected deliverables.

The guide describes itself as illustrative: entities must not rely on it alone, and assessors may request other evidence. It is still the best checklist of what “good” looks like. Some examples from GECC-2:2026:

ECC control	Expected deliverables (GECC-2:2026)
1-2-1 Cybersecurity department	Organisation chart showing the function, the decision establishing it and its mandate
1-2-2 Cybersecurity positions	A detailed list of all personnel whose work relates to cybersecurity, with contract type, roles, experience and qualifications
1-2-3 Supervisory committee	Approved charter, approved member list, meeting agendas and minutes
1-5-3 Risk assessment	Risk reports for early-stage projects, major changes, third-party services and pre-release products
1-8-2 Independent review	The requirements document, an approved audit plan and audit reports

For Domain 2, reports carry the most weight. ECC 2-11 requires periodic penetration testing of all services provided externally via the internet and their technical components; our guide to NCA penetration testing requirements under ECC 2-11 covers scope and frequency. A sample VAPT report shows how findings can be mapped to control IDs so they double as gap evidence.

Which ECC gaps are hardest to close?

The ECC gaps that take longest to close are usually structural: Saudization of all cybersecurity positions (ECC 1-2-2), an independent cybersecurity function separate from IT (ECC 1-2-1), independent review (ECC 1-8-2), and third-party contract clauses (ECC 4-1). Technical gaps are often faster to fix than gaps that need hiring, reorganisation or contract renegotiation.

• ECC 1-2-2 Saudization. ECC-2:2024 requires all cybersecurity positions to be filled with full-time, qualified Saudi cybersecurity professionals. Our guide to ECC-2 Saudization of cybersecurity roles explains how to evidence it.
• ECC 1-2-1 independence. The cybersecurity department must be independent of the IT and communications department.
• ECC 1-5-3 risk triggers. Risk assessments are required at least early in technology projects, before major infrastructure changes, when planning to obtain third-party services, and before releasing new services or products.
• ECC 4-1 third parties. Existing contracts may lack the cybersecurity and non-disclosure clauses ECC 4-1-2 requires, and they only change at renewal.
• ECC 2-11 coverage. Testing that covers the main website but not mobile apps, email or remote access leaves the control partly met.

Flag these in the first week of the assessment, not the last, so owners can start long-lead work while the rest of the review continues.

How do you turn gap findings into a remediation roadmap?

Turn ECC gap findings into a roadmap by ranking each gap on risk and effort, assigning an owner and date, and sequencing governance foundations before technical fixes. The roadmap is what the supervisory committee approves and what NCA will expect to see progressing.

1. 1

   First 30 days

   Approve the cybersecurity function, committee charter and policy set (ECC 1-2, 1-3); fix critical external findings from testing.

2. 2

   30 to 90 days

   Close quick technical gaps such as MFA, email domain validation and logging; launch awareness and phishing training (ECC 1-10).

3. 3

   90 to 180 days

   Run risk assessments (ECC 1-5), update third-party contracts (ECC 4-1) and complete cloud requirements (ECC 4-2).

4. 4

   Ongoing

   Periodic reviews, vulnerability assessments, penetration tests and the independent review under ECC 1-8-2.

Two habits keep the roadmap credible. First, retest every technical fix and attach the retest to the control record. Second, rescore the register at a fixed interval so you can show the trend. For how often to test, see how often you should run a penetration test.

How Sumrite helps

Sumrite runs ECC gap assessments with our verified NCA-registered partner firm and manages the work end to end. We score all 108 main controls and 92 subcontrols against GECC-2:2026 deliverables, verify Domain 2 with network, web application and cloud testing, map every finding to its ECC control ID and hand over a scored register and roadmap your supervisory committee can approve. Our NCA ECC compliance page summarises the full service, and our Saudi Arabia page explains how we deliver the VAPT report for Saudi reviews in 48 hours. Want the scoring template? Ask us for the ECC gap assessment register as a spreadsheet on your scoping call.