NCA ECC vs SAMA CSF: Dual Compliance for Saudi Financial Institutions A dual-compliance playbook from Sumrite.

Saudi compliance teams often run two parallel programmes, one for NCA and one for SAMA, with two control registers, two testing calendars and two sets of reports. That doubles effort without adding assurance. This guide compares the frameworks using their own text and shows how to merge the work. For each framework on its own, see our SAMA Cyber Security Framework guide and our NCA ECC compliance guide.

What is the difference between NCA ECC and SAMA CSF?

NCA ECC-2:2024 is a national cybersecurity baseline for government entities and CNI operators, while the SAMA Cyber Security Framework is a sector framework for SAMA-regulated financial institutions assessed against a maturity model. ECC is measured by control compliance; SAMA CSF is measured by maturity level, with level 3 as the minimum.

Dimension	NCA ECC-2:2024	SAMA Cyber Security Framework
Issuer	National Cybersecurity Authority (NCA)	Saudi Central Bank (SAMA)
Current text	ECC-2:2024	Issued under Circular 381000091275, 24 May 2017
Who it covers	Government entities, their affiliates, and private entities that own, operate or host CNI	All SAMA Member Organizations: banks, insurers and reinsurers, financing companies, credit bureaus, financial market infrastructure
Structure	4 main domains, 28 subdomains, 108 main controls, 92 subcontrols	4 domains (3.1 to 3.4) with subdomains of principles, objectives and control considerations
Assessment model	Compliance with each control	Maturity levels 0 to 5; at least level 3 expected
Penetration testing	2-11: periodic tests of all internet-facing services	3.2.4: annual review and penetration tests of customer and internet-facing services

The ECC figures come from the ECC-2:2024 document published by NCA. The SAMA figures come from the framework introduction, its applicability section and its maturity model on the SAMA Rulebook. Note that ECC is not certifiable: there is no “ECC certificate”, only compliance with the controls.

Do Saudi financial institutions have to comply with both NCA ECC and SAMA CSF?

Every SAMA Member Organization must comply with the SAMA Cyber Security Framework, and a financial institution must also comply with NCA ECC-2:2024 when it owns, operates or hosts Critical National Infrastructure or is a government-affiliated entity. Large banks, payment infrastructure and market infrastructure are the institutions most likely to sit in both scopes.

ECC-2:2024 states that it applies to government agencies, their affiliated companies and entities inside and outside the Kingdom, and private-sector entities that own, operate or host CNI, and NCA encourages all other entities to use the controls. Whether a specific institution is treated as CNI is a determination for the regulators, not something to assume. The safe working rule we use: if your institution has been told by NCA that it is in scope, or is government-owned or affiliated, plan for dual compliance and confirm the position with your compliance function.

Fintechs at the sandbox or licensing stage sit under SAMA’s Cyber Resilience Fundamental Requirements (CRFR) first, and move to the full SAMA CSF once licensed. ICT and hosting providers that serve banks may also answer to the CST Cybersecurity Regulatory Framework.

How do NCA ECC domains map to SAMA CSF domains?

NCA ECC’s four domains map closely onto SAMA CSF’s four domains: ECC Governance aligns with SAMA 3.1 and 3.2, ECC Defense with SAMA 3.3, ECC Resilience with SAMA’s incident and event management subdomains, and ECC Third-Party and Cloud with SAMA 3.4. The mapping below is Sumrite’s working mapping, not an official crosswalk.

NCA ECC-2:2024 domain	Closest SAMA CSF domain and subdomains
1 Cybersecurity Governance	3.1 Leadership and Governance (3.1.1 to 3.1.7); 3.2 Risk Management and Compliance (3.2.1, 3.2.2, 3.2.5)
2 Cybersecurity Defense	3.3 Operations and Technology (3.3.3 Asset Management, 3.3.5 IAM, 3.3.6 Application Security, 3.3.8 Infrastructure Security, 3.3.9 Cryptography, 3.3.17 Vulnerability Management); 3.2.4 Cyber Security Review
3 Cybersecurity Resilience	3.3.14 Event Management and 3.3.15 Incident Management, together with SAMA’s separate Business Continuity Management framework
4 Third-Party and Cloud Computing Cybersecurity	3.4 Third Party Cyber Security (3.4.1 Contract and Vendor Management, 3.4.2 Outsourcing, 3.4.3 Cloud Computing)

The SAMA subdomain names are from SAMA CSF Section 3, Control Domains. The most useful pairs for testing work are ECC 2-11 Penetration Testing with SAMA CSF 3.2.4 Cyber Security Review, and ECC 2-10 Vulnerabilities Management with SAMA CSF 3.3.17 Vulnerability Management.

How can one penetration testing programme satisfy both NCA ECC 2-11 and SAMA CSF 3.2.4?

One penetration testing programme satisfies both frameworks when its scope is the union of both lists, its cadence is the stricter of the two, and every finding and retest is mapped to both control references. That means scoping every internet-facing component named in ECC 2-11-3-1 and every customer and internet-facing service under SAMA CSF 3.2.4, at least annually.

The two control texts line up well:

• Scope. ECC 2-11-3-1 requires the scope to include all internet-facing services and their technical components: infrastructure, websites, web applications, smartphone and tablet applications, email and remote access. SAMA CSF 3.2.4 covers customer and internet facing services.
• Frequency. ECC 2-11-3-2 requires tests to be conducted periodically; SAMA CSF 3.2.4 says annual. Annual is therefore the floor for a dual programme, and SAMA CSF 3.3.7 adds penetration testing of changes where applicable.
• Follow-up. ECC 2-11-4 requires the implementation of the penetration testing requirements to be periodically reviewed; SAMA CSF 3.2.4 requires follow-up reviews to confirm issues were addressed. A retest closes both.

Our ECC-2:2024 penetration testing guide and SAMA penetration testing guide cover each control in more depth, and the Saudi penetration testing pillar guide maps every test type to both.

Where do NCA ECC and SAMA CSF differ in ways that matter?

The differences that matter most are ECC’s Saudi-staffing and in-Kingdom managed-service rules, SAMA’s maturity model and red teaming framework, and SAMA’s exclusions for non-bank institutions. A merged programme has to carry the stricter requirement from each side.

ECC 1-2-2 staffing

All cybersecurity positions shall be filled with full-time, qualified Saudi cybersecurity professionals.

ECC 4-1-3 managed services

Managed service centres using remote access must be fully located inside Saudi Arabia.

SAMA maturity model

Each SAMA CSF subdomain is scored 0 to 5 and must reach at least level 3 (structured and formalized).

SAMA non-bank exclusions

Subdomains 3.2.3, 3.3.12 and 3.3.13 are excluded for non-banks, with PCI, SWIFT CSCF or MFA conditions instead.

SAMA red teaming

The FEER framework expects threat-intelligence-based red teaming at least once every three years. See [SAMA red teaming vs penetration testing](/blog/sama-red-teaming-vs-penetration-testing).

The ECC 4-1-3 rule affects how you buy ongoing services: where a cybersecurity provider delivers a managed service over remote access, that service centre has to sit inside Saudi Arabia, so check the delivery model in the contract before signing. Our vendor risk and TPRM page covers how to evidence third-party controls for both ECC 4-1 and SAMA CSF 3.4.

How should you build a dual-compliance control register?

Build a single control register in which each row is an NCA ECC control or SAMA CSF subdomain, cross-referenced to the other framework, with one owner, one evidence set and both a compliance status and a SAMA maturity score. That lets one piece of evidence close two requirements.

The NCA ECC compliance page explains how Sumrite supports ECC programmes, and our ISO 27001 VAPT audit guide helps if the institution also holds an ISO 27001 certification that can share evidence.

How Sumrite helps

Sumrite runs one penetration testing programme for Saudi financial institutions that serves NCA ECC 2-11 and SAMA CSF 3.2.4 together, end to end with our verified NCA-registered partner firm. Each report maps findings to both frameworks, includes a retest, and comes with an evidence pack ready for NCA submissions and SAMA reviews. We have served 100+ Saudi clients across Riyadh, Jeddah, Dammam and other cities, and Saudi teams can start on our Saudi Arabia page, where a VAPT report for Saudi reviews is delivered in 48 hours.