NCA ECC-2:2024 explained

The renumbering matters operationally. If your gap register, your risk treatment plan or your supplier questionnaires still use ECC-1 control numbers, they point at a structure that no longer exists, and mapping them across is a real piece of work rather than a find and replace.

Control references read as main domain, subdomain, main control, subcontrol. So 2-3-2-6 is domain 2, subdomain 3, main control 2, subcontrol 6. Using the full reference in a gap register is worth the extra characters, because it survives a future restructure in a way a control title does not.

For a private business that holds no critical national infrastructure, ECC usually arrives through a contract rather than the law. Government supply chains push it down: a prime contractor that must show compliance passes control requirements to its suppliers. That obligation is real, and it is a contract obligation. Name it precisely rather than describing it as a law that applies to you.

Where ECC does apply, it applies in full: every control applicable to the entity, not a selected subset. Applicability follows what you do, not what you would prefer to scope in.

Read the domain list before a gap assessment, because it changes who needs to be in the room. An organisation expecting a technical audit finds that a third of the subdomains are strategy, management, policy, roles, risk, project management, compliance, audit, human resources and awareness.

Treat any offer of ECC certification with caution. It is a reliable sign that whoever is offering it has not read the document, and it is worth asking what exactly you would receive and who would recognise it.

NCA publishes an ECC-2:2024 Assessment and Compliance Tool to organise assessment and measurement. Article 10(3) of the NCA statute and High Order No. 57231 dated 10/11/1439H require ongoing, continuous compliance. In practice the evidence has to be maintained all year, not assembled for a visit.

Neither has an ISO 27001 equivalent, and neither is a project. They are organisational commitments with budget, headcount and reporting-line consequences, and no procedure closes them.

The independence requirement, which follows High Order No. 37140 dated 14/08/1438H, is the one that most often surprises a mid-size entity where cybersecurity has always been part of the IT manager's job. Separating them means a different reporting line, a different budget, and somebody whose job is to disagree with IT when it matters. That is the intent.

Plan both early. A programme that leaves the staffing and structure controls to the end discovers that its two longest-lead items were left until last.

The gaps are structural rather than technical. ISO 27001 is risk-selective: you may justify excluding a control, and the justification is itself auditable. ECC is prescriptive: you comply with every control applicable to you. That single difference reshapes a gap register.

Then there are the Saudi mandates ISO 27001 does not contain: an independent cybersecurity function, Saudi national staffing of cybersecurity positions, and reporting to NCA through the compliance tool. No amount of ISMS maturity produces those.

Where both are in play, the efficient route is ISO 27001 as the management system, with ECC-2:2024 mapped on top and a gap register keyed to the full control reference. One system, two reporting obligations, and the evidence collected once.

Versions matter here as much as they do for ECC, so check the current one on NCA's controls list before mapping anything. We give the version for ECC and CCC only, because those are the two we have checked against NCA's own pages.

NCA also lists the National Framework for Cybersecurity Risk Management and the Saudi Cybersecurity Workforce Framework among its frameworks. If a contract names any of these documents, map it on top of the same ECC register rather than opening a second one. Most of the evidence is shared, and two registers kept side by side drift apart.

The PDPL applies to any organisation processing personal data in the Kingdom, whatever its size, so an entity in scope for ECC is almost always in scope for the PDPL too. A personal data breach that could cause harm must be notified to SDAIA within 72 hours of becoming aware, and ECC's defense domain has its own subdomain for incident and threat management. One incident procedure should carry both routes.

The same goes for the registers. The controls that protect personal data should appear once, referenced from both the ECC control register and the PDPL records of processing, so one piece of evidence answers two regulators.

The list below is the order we would work in. None of it needs anyone from outside your organisation.