NCA ECC vs ISO 27001

For the buyer, the practical distinction is the question being answered. An ISO assessment examines conformity with the management system standard. An ECC review asks whether the applicable national controls have been implemented. Keep those questions separate in the assessment while sharing the documents and records that answer them.

Start with the written request. If it names both, create a requirement list that names both. If it names only one, establish whether the other applies independently before setting the scope. A supplier questionnaire is useful evidence of a customer's request, but it is not a substitute for assessing NCA applicability.

NCA encourages other entities in the Kingdom to adopt ECC. Distinguish that encouragement from a direct obligation and from a contract condition. Record the reason for your assessment so the next reviewer can see why the controls were included.

For an ISO request, put the service and sites named by the customer beside your ISMS scope. Ask whether the information and activities behind the contract sit inside that boundary. Do the same exercise separately for ECC rather than assuming the certificate's scope defines the national control obligation.

Use full control references in the mapping. A row labelled access control is too broad to show which requirement was checked, which evidence was sampled or what remains open.

An access review is a useful example. Open the review record, check which systems it includes, who approved changes and whether actions closed. Link that record to the relevant requirements. If the ECC assessment includes a system outside the sampled set, the record does not close that gap just because it is called an access review.

Keep one evidence reference with separate assessment columns. Record the period and scope examined, who reviewed it and the unresolved work. This makes a shared file useful without turning a mapping exercise into an unsupported claim of conformity.

Bring the scope statement, risk assessment and Statement of Applicability into the review. Add the evidence index and open corrective actions. These are useful inputs, but a certificate is not a completed ECC control register. Leave a control open where the evidence has not been examined.

Separate a missing record from a missing organisational decision. The first may need the process owner to retrieve evidence. The second may need management to change a reporting line or approve a role. Put the decision and responsible role into the gap register so it reaches the person who can act.

Check whether the existing risk process covers the intended ISMS boundary. Review who accepts risk, how treatment decisions are recorded and how changes are followed up. Reuse the approved process where it fits, and keep a clear record of any change needed for the new scope.

Then plan the internal audit against the standard and the actual operation. Carry its findings into corrective action and management review. The value of the existing ECC work is the evidence it provides, not a shortcut past reviewing the system that manages it.

Ask for a control register showing the evidence examined and the gaps still open. A report that only says aligned gives the next reviewer little to check. A useful register shows the full reference, the evidence location and the reason for the assessment result.

We would sample the existing risk register, access reviews and supplier assessments, mapping only the evidence that answers the relevant controls. A gap affecting reporting lines would go to management. A missing service or system in the evidence would go to its process owner.

The proposed outputs are an applicability note, a control mapping and a gap register with responsible roles. ITF Consult handles the management system; ITF Cyber supports the policies, control mapping and readiness evidence. The organisation can then see what it already has and what remains to be implemented.

Use this short list to prepare the review. An unavailable document becomes a question to resolve, not a reason to assume the control is absent or present.