NCA ECC compliance for government entities in Saudi ArabiaCitizens expect it to work. Auditors expect proof.
Security, release quality and service automation for public entities that answer to beneficiaries and regulators at the same time.
Free first step. We reply within one business day. No commitment.
- 30 min
- call to scope your review
- 108
- main controls in NCA ECC-2:2024Source: NCA, ECC-2:2024 (opens in a new tab)
Free first step · Cybersecurity
Security Posture Review
- You give:
- A 30-minute call and the list of systems in scope
- You get:
- A short written view of where you are most exposed, what we would test first and which compliance gaps to close first. Usually within a week of the call.
Scenarios
Where we start.
TQN supports NCA ECC compliance for government entities in Riyadh and across the Kingdom, from gap assessment to penetration testing and retest. The same team tests Arabic e-services before each release, builds Arabic AI agents that answer routine enquiries under human oversight, and turns city cameras into crowd and traffic counts. Every deployment is designed to support PDPL and NCA requirements.
- 01Cybersecurity
ECC readiness, control by control
The CISO gets a gap register mapped to the Essential Cybersecurity Controls, with an owner and an evidence list for every gap. We review policies, configurations and existing evidence, test the internet-facing services, prioritise remediation, and retest, so the next self-assessment rests on findings rather than assumptions.
- 02Cybersecurity
Penetration testing before a service goes live
A new portal, app or API launches with its exploitable flaws already closed. We test web, mobile, API and network layers, report each finding with severity, proof and a fix, and retest once your team or the contractor that built the system has remediated.
- 03AI Agents
Routine enquiries answered in Arabic, at any hour
Beneficiaries get answers on request status, required documents and procedures at any hour, in Arabic or English. The agent reads from your approved knowledge base and case system, cites its source, and hands the conversation to an employee, with full context, whenever a request needs a decision.
- 04Quality Engineering
Arabic e-services that pass before release
Each release is checked for broken RTL layouts, mixed Arabic and Latin text, Hijri dates and form validation before beneficiaries see it. Test agents generate cases from requirements, run them across browsers and mobile web in parallel, repair themselves when screens change, and load-test the service ahead of peak periods.
- 05Vision AI
Crowd and traffic counts from city cameras
Operations centres see occupancy, queue length and vehicle flow at public sites and events as live numbers, with an alert when a zone crosses its threshold. Models run on edge hardware, faces are blurred by default, and no face matching is performed unless it is requested and lawful.
Free first step. Fixed scope after. You decide at each stage.
In practice
Routine enquiries answered in Arabic, at any hour
Beneficiaries get answers on request status, required documents and procedures at any hour, in Arabic or English.
- When will permit request 4471 be complete?
- Tool stepCase lookup · request 4471
- AIIn technical review since 3 Nov. One document is missing: the site plan.
- I uploaded it yesterday. Can you approve the request?
- Needs approvalRouted to case officer · approval required
- AIA case officer now has your file. You will get an SMS once it is reviewed.
Regulations and national programmes
The rules that shape the work.
NCA Essential Cybersecurity Controls (ECC-2:2024)
Issued by the National Cybersecurity Authority, the ECC set the minimum cybersecurity requirements for national entities, including government organisations. ECC-2:2024 is the current version.
Official sourceDigital Government Authority
The Digital Government Authority issues the digital government regulatory framework, policies, and controls and standards that govern how government platforms, apps and websites are built and run, including its digital accessibility policy.
Official sourcePersonal Data Protection Law (PDPL)
Overseen by SDAIA, the PDPL governs how personal data from service requests, conversation logs and camera footage is collected, used, kept and transferred outside the Kingdom. Our agents and camera deployments are designed to support PDPL and NCA requirements.
Official source
Summaries for orientation only. Read the official source for the full requirement.
We map the requirement to your systems in the free first step.
Practices for this sector
The practices that fit.
- 02
Cybersecurity
Find and fix the gaps an attacker could use, before an attacker or auditor does.
First step: Security Posture Review
View practice - 03
Quality Engineering
Tests that write, run and repair themselves, so every release ships on time.
First step: QA Readiness Review
View practice - 04
AI Agents
Agents that answer, process and report in Arabic and English, inside your rules.
First step: Agent Opportunity Workshop
View practice - 01
Vision AI
Live counts, alerts and evidence from the cameras you already own.
First step: Show us one camera
View practice
FAQ
Questions from this sector.
No. Testing covers part of the controls. ECC compliance also spans governance, policies, asset management and third-party risk. We prepare you across all of it with a gap register and evidence list, but the self-assessment is yours and we never claim to certify anyone.
Yes. Camera analytics and test platforms run on your premises or in a Saudi data centre. For AI agents, hosting is agreed in the assessment against your data classification. Every deployment is designed to support PDPL and NCA requirements.
The assessment is free and carries no commitment. The pilot has a fixed scope, with targets and price agreed in writing before it starts, so it can go through your procurement process as a defined purchase.
Yes. We agree rules of engagement and testing windows with each system owner, test without needing source code where it is not available, and retest after each contractor fixes their findings.
It answers only from content your entity has approved, cites the source, and escalates to an employee when a question falls outside it or needs a decision. Conversations are logged and evaluated in production, and the knowledge base is updated as procedures change.
A named owner for each system in scope, an access window for testing, and short weekly reviews during the pilot. We run the testing, build and configuration.
Start here
Start with one problem. We will show you the result.
Tell us the problem in one line. We reply within one business day with the free first step that fits it.
Already have systems? We start from the cameras, applications and systems you run today.
Need proof first? The first step is free, and pilot targets are agreed in writing before work starts.
Concerned about data? Data stays in the Kingdom, on your premises or in a Saudi data centre, agreed in writing during the assessment.
Is Arabic a must? We work, report and deliver in Arabic and English.