NCA ECC for mid-sized companies: where to start

By the end of this guide you will know three things: whether the National Cybersecurity Authority's Essential Cybersecurity Controls bind your company, which set of controls applies if they do not, and the first five pieces of work that turn a policy folder into evidence an assessor will accept.

First question: does ECC apply to you?

The scope section of ECC-2:2024 is precise. The controls apply to government agencies in the Kingdom, including ministries, authorities and establishments, and to their affiliated companies and entities inside and outside the Kingdom. They also apply to private sector entities that own, operate or host Critical National Infrastructure. The NCA strongly encourages every other entity to use them as best practice. The current version is published on the NCA's ECC page.

For a mid-sized company, that gives four practical situations:

Your situation	What applies
Government-owned or government-affiliated company	ECC-2:2024 directly
You own, operate or host critical national infrastructure	ECC-2:2024 directly
Private, non-CNI, supplying government entities	ECC obligations reach you through your contracts, plus NCNICC if the NCA circulates it to you
Private, non-CNI, no government work	NCNICC-1:2025 if the NCA circulates it to you; ECC as best practice

The supplier route

This is the route mid-sized firms miss. ECC subdomain 4-1 requires every entity in scope to set cybersecurity requirements in its contracts with third parties. At minimum those contracts must cover non-disclosure and the secure removal of the entity's data at the end of the service, procedures for communicating a cybersecurity incident, and an obligation on the third party to apply the entity's cybersecurity requirements and policies (control 4-1-2).

If you deliver IT, managed or outsourced services to a ministry, an authority or a smart-city programme, expect those clauses in your next contract and expect to be asked for evidence. For outsourced and managed services, ECC also requires a cybersecurity risk assessment before contracting, and requires managed security operations centres that use remote access to be located fully inside the Kingdom (control 4-1-3).

The non-CNI private sector route

The NCA has issued the Non-CNI Private Sector Entities Cybersecurity Controls, NCNICC-1:2025 (Arabic text linked). They are built on ECC and split entities into two categories using the definitions of Monsha'at, the General Authority for Small and Medium Enterprises:

• Category A, large entities. More than 250 full-time employees, or more than SAR 200 million in annual revenue. Three main components, 22 subcomponents, 65 mandatory main controls.
• Category B, small and medium entities. 6 to 249 full-time employees, or SAR 3 million to 200 million in annual revenue. One main component, 13 subcomponents, 26 mandatory main controls.

The document states that each category's controls are binding on entities to which the NCA circulates them, and that the NCA may require additional controls where needed. Most companies that call themselves mid-sized sit in Category B. If you are close to the threshold, or growing, plan for Category A.

What ECC-2:2024 contains

ECC-2:2024 replaced ECC-1:2018. It has 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols. The update moved the former industrial control systems domain out of ECC and into the NCA's Operational Technology Cybersecurity Controls, as listed in Appendix C of the document.

Domain	What it covers
1. Cybersecurity Governance	Strategy, management, policies, roles, risk management, cybersecurity in IT projects, regulatory compliance, periodic review and audit, HR, awareness and training
2. Cybersecurity Defense	Assets, identity and access, system protection, email, network, mobile devices, data protection, cryptography, backup, vulnerability management, penetration testing, logging and monitoring, incident management, physical security, web application security
3. Cybersecurity Resilience	Cybersecurity within business continuity management
4. Third-Party and Cloud Computing Cybersecurity	Supplier contracts, cloud computing and hosting

The cloud subdomain, 4-2, binds entities that use or plan to use cloud computing and hosting services. If your systems sit with a cloud or hosting provider, also read the NCA's Cloud Cybersecurity Controls.

Where to start: five pieces of work

1. Know what you are protecting

Build the asset inventory first, as ECC subdomain 2-1 requires: systems, data, owners, where each one is hosted, and which services face the internet. Classify and label assets according to the relevant regulatory requirements (2-1-5). Every later control is measured against this list. A gap assessment without it is guesswork.

2. Put governance in place

Governance is where mid-sized companies have the most ground to cover, because ECC asks for structure, not only tools:

• A cybersecurity strategy approved and supported by the head of the entity (1-1-1)
• A cybersecurity department independent from IT (1-2-1)
• Cybersecurity positions filled by full-time, qualified Saudi professionals (1-2-2)
• A supervisory committee that includes the head of cybersecurity (1-2-3)
• Approved policies and procedures, backed by technical security standards (1-3)
• A documented risk methodology, applied early in technology projects and before major changes (1-5)

Under NCNICC, fewer of these are mandatory for Category B. For example, the cybersecurity management subcomponent (1-1 in NCNICC) binds Category A only. Read the applicability column for each control instead of assuming.

3. Close the gaps attackers use first

Start where an assessor and an attacker will both look. Each item below is an ECC-2:2024 control:

• Multi-factor authentication for remote access and privileged accounts (2.2.3.2), and privileged access management (2.2.3.4)
• Periodic vulnerability assessment, with remediation based on severity and tested patches (2-10-3)
• Penetration testing covering every service you provide over the internet (2-11-3)
• Event logging for critical assets, privileged accounts and remote access (2-12-3)
• Backups, with a restore you have actually tested (2-9)

4. Fix your contracts in both directions

List your own suppliers that touch your systems or data, and check their contracts against 4-1-2. Then review the contracts where you are the supplier, and prepare the evidence your government clients will ask for.

5. Prove it, then review it

ECC expects periodic review by the cybersecurity department (1-8-1) and independent review by parties other than that department (1-8-2), with results presented to the supervisory committee and the authorised official (1-8-3). The NCA evaluates compliance through self-assessment, reports from its compliance tool, and field audit visits. Keep evidence as you go: approvals, configurations, tickets, test reports.

A realistic sequence

Phase	Output
Scoping	Applicability decision: ECC, NCNICC category, contract obligations
Gap assessment	Control-by-control status with evidence, rated by risk
Remediation plan	Owner, date and budget line for each gap, governance first
Technical remediation	MFA, patching, logging, penetration test of internet-facing services
Readiness review	Evidence pack checked against each applicable control

Do not try to close every control in one pass. Fix the governance items and the internet-facing exposures first. They carry the most risk and the most audit weight.

What a gap assessment report should give you

• The applicability decision and the reasoning behind it
• A status for every applicable control: implemented, partial, not implemented, or not applicable
• The evidence reviewed for each status
• A risk rating for each gap and a recommended order of work
• A remediation roadmap with named owners
• The evidence you still need to produce

Questions to ask anyone helping you

• How did you decide which controls apply to us, and can you show the reasoning?
• Will you show the evidence behind each status, not only a score?
• Do you test the technical controls, or only read the policies?
• Who retests after remediation?

How TQN helps

TQN's cybersecurity practice provides compliance readiness for NCA ECC, PDPL and SAMA frameworks, alongside penetration testing, vulnerability assessment, cloud configuration review and retesting. Our work is designed to support PDPL and NCA requirements; the compliance decision stays with you and the regulator. For suppliers to ministries, authorities and smart-city programmes, see our page on government and smart cities. For the testing side, read Penetration testing in Saudi Arabia: scope, timeline and what a report contains.

Start with a Security Posture Review

Give us 30 minutes and the list of systems you believe are in scope. We tell you which control set we think applies, where your largest gaps are likely to be, and what to do first. It is free. Book a Security Posture Review.