NCA ECC readiness, with the evidence behind it
A control-by-control position against ECC-2:2024, the governance documents it requires, and a remediation plan with an owner on every line.
- Control set
- ECC-2:2024, 4 domains and 28 subdomains
- Controls
- 108 main controls and 92 subcontrols
- ECC certificate
- Does not exist, and nobody can issue one
- How NCA checks
- Self-assessment, the compliance tool, field audits
- Coverage
- Riyadh and the Eastern Province; documents read remotely
ECC-2:2024 is NCA's mandatory minimum control set: 4 domains, 28 subdomains, 108 main controls and 92 subcontrols. It binds government bodies, their affiliates and private entities that own, operate or host critical national infrastructure. There is no ECC certificate. Readiness means every applicable control is either evidenced or on a dated plan with an owner.
- 01 Call
- 02 Scope
- 03 Read
- 04 Register
- 05 Documents
- 06 Plan
NCA ECC readiness, with the evidence behind it sits at step 4 of how an engagement runs. You receive the register.
Two controls you cannot write your way out of
Control 1-2-1 requires a cybersecurity function independent of the IT department, preferably reporting to the head of the entity. Control 1-2-2 requires cybersecurity positions to be filled by full-time, qualified Saudi professionals.
Neither is closed by a procedure. Both mean a reporting line, a budget and hiring. In a mid-size entity where security has always been part of the IT manager's job, 1-2-1 is the one that causes the argument. We put both first in the plan, because they have the longest lead time and they decide who owns everything else.
Most of the other controls fail on evidence, not on practice. "Access reviews happen by email and are not recorded" is a partial, and the fix is a record rather than a product. The thing was being done. Nobody could show it.
Seven areas of work, each ending in a document
The third column is what your team keeps and maintains after the engagement.
| Area | What we do | What you hold |
|---|---|---|
| Control mapping | Every applicable control assessed as evidenced, partial or absent, with the evidence seen recorded against it. | The control register |
| Governance documents | The policies, standards and procedures the control set requires, drafted for your own approval route. | The document set |
| Asset and data inventory | What you hold, where it sits, who owns it, and which controls apply to it. | The inventory |
| Evidence structure | How each control produces a record a reviewer can open, and where that record is kept. | The evidence map |
| Third-party and cloud | Your contractual and documentary position with suppliers and hosting, read against domain 4. | Supplier and cloud rows in the register |
| Penetration testing and vulnerability management | The procedure these controls require, a scope for the test, and a comparison of providers you could contract. | A test scope ready to send |
| Remediation | Gaps sequenced by risk and effort, an owner on each, written so your IT team or its suppliers can carry out the technical items. | The remediation plan |
The documents you hold at the end
The control register
Every applicable control with its state, the evidence seen and its owner, kept in NCA's own numbering. The working document, not the report.
The gap register
Only the gaps, ranked, with what closing each one requires. Short enough for a management meeting.
The governance document set
The policies, standards and procedures ECC requires, drafted for your approval route rather than lifted from a template pack.
The evidence map
For each control, the record that proves it and where that record is kept. This is what a reviewer opens.
The remediation plan
Gaps in order, an owner and a date on each, written so a different supplier could carry out the technical items.
A test scope
For the penetration testing controls: targets, exclusions and the testing window, ready to send to providers.
From the clause to the walk-through
The time from scope to walk-through is set at scoping. A group with shared services and no asset list takes longer, and the asset list is the part that takes the time.
- 01
Scope
Which legal entity, sites and systems, read against the obligation or the contract clause. The output is the scope statement.
- 02
Collect
Your existing policies, registers, contracts and screenshots, read before we ask a single question. The output is a document index.
- 03
Interview
Short sessions with the people who operate each control, because documents and practice rarely match.
- 04
State each control
Evidenced, partial or absent, with the evidence recorded. Partial is the most common state and the most useful, because it names what is missing.
- 05
Write up the gaps
Each one with the effort to close it, so the plan can be argued on cost rather than on principle.
- 06
Draft the documents
Governance documents for whatever is missing or unusable, written for your approval route.
- 07
Walk it through
A session with management, who decide the order of remediation. The output is the remediation plan.
When a customer's renewal depends on it
A services company in Riyadh is told by a government-affiliated customer that renewal depends on showing its position against ECC-2:2024.
Whether ECC binds the company directly is a question for its legal advisers, and we say so. The contract clause settles the practical scope: one legal entity, two offices, the ERP and email.
We read the existing policies, the cloud contracts and the asset spreadsheet before the first interview. The spreadsheet stops at laptops and misses the cloud accounts, so the inventory is rebuilt first. Interviews follow with the IT manager, HR and finance.
Most controls land as partial. Controls 1-2-1 and 1-2-2 land as absent, because security sits inside the IT manager's role, and the plan puts a decision on that to management first. The penetration testing controls cannot be evidenced without a test, so the plan includes a test scope and a provider comparison.
The company holds a control register, a gap register, a governance document set drafted for its own approval, an evidence map and a remediation plan its customer can read.
Who it binds, and who it reaches
The legal scope is narrow. The practical scope is much wider, and NCA encourages every other entity in the Kingdom to adopt the controls.
Government bodies and their affiliates
Ministries, authorities and other government bodies, and the companies and entities affiliated to them, inside and outside the Kingdom. For them ECC applies in full: every control relevant to the entity, not a selected subset.
Owners, operators and hosts of critical national infrastructure
Private entities that own, operate or host critical national infrastructure are bound directly. Applicability follows what the entity does, not what it would prefer to scope in.
An ECC clause in someone else's contract
A ministry's contractor, a CNI operator's software vendor and a government affiliate's logistics provider all find ECC clauses in their contracts. That obligation is real, and it is a contract obligation. We read the clause first, because it usually names the systems in scope, and the answer is rarely the whole company.
When a contract names a different control set
ECC is the baseline. NCA also publishes the Cloud Cybersecurity Controls, CCC-2:2024, which apply both to cloud service providers and to the organisations that use them, and the sets listed below. If a contract or a regulator names one of these, we map it on top of the same register rather than starting a second.
- Critical Systems Cybersecurity Controls
- Operational Technology Cybersecurity Controls
- Data Cybersecurity Controls
- Telework Cybersecurity Controls
- Organizations' Social Media Accounts Cybersecurity Controls
- National Cryptographic Standards
Questions before an ECC assessment
Is there an ECC certificate?
No. ECC is not certifiable and no certification body issues one. NCA checks compliance through self-assessment, its compliance tool and field audits. An offer of ECC certification is a reason to ask what exactly you would receive.
Does ECC apply to us?
It binds government bodies, their affiliates and private owners, operators or hosts of critical national infrastructure. For everyone else it usually arrives through a contract. Whether it binds you legally is a question for your legal advisers; we work from whichever obligation you actually have.
Does ISO 27001 make us ECC compliant?
It gets you a long way, not all the way. ISO 27001 lets you justify excluding a control; ECC applies every control relevant to you. And 1-2-1 and 1-2-2 have no ISO equivalent.
Can you complete NCA's compliance tool for us?
The self-assessment belongs to your entity and is submitted by it. We prepare the evidence and the answers so the person submitting can stand behind every line.
Who runs the penetration testing ECC asks for?
A testing provider you contract. We write the scope, help you compare providers and work through the report with you, so each finding lands in the remediation plan with an owner.
What drives the cost?
The entities and sites in scope, how much documentation already exists, how many control owners must be interviewed, and whether suppliers and cloud services are included.
Next to this work
Security policies and governance
The policy set ECC's governance domain asks for, written to be approved and used.
Read moreITF CyberCommissioning a penetration test
The scope, the provider comparison, and the report read through to a retest.
Read moreITF CyberThird-party and vendor security
Domain 4 in practice: what your suppliers and hosts owe you in writing.
Read moreGuideNCA ECC-2:2024 explained
The domains, the scope and a list of first steps, in one long read.
Read moreITF ConsultISO 27001 readiness
The management system underneath, with ECC mapped on top.
Read moreITF TrainingCybersecurity awareness course
Subdomain 1-10 asks for an awareness programme; the course is one part of it.
Read morePart of one system
Every division keeps records to the same standard, so the second one you need works the way the first one did.
Start from the clause you were handed
Bring the contract clause or the regulator's letter to the first call. It settles which entity, sites and systems are in scope, and every document after it is built from that scope statement.