NCA Essential Cybersecurity Controls compliance software
Assess, evidence and report against the Kingdom's Essential Cybersecurity Controls, ECC-2:2024, in Arabic or English, hosted in your own environment.
- Issuing authorityNational Cybersecurity Authority
- EditionECC-2:2024, replacing ECC-1:2018
- Main domainsCybersecurity Governance · Cybersecurity Defense · Cybersecurity Resilience · Third-Party and Cloud Computing Cybersecurity
- Controls108 main controls and 92 subcontrols across 28 subdomains
- LanguagesArabic and English
- Assessment basisControl-by-control implementation and evidence
What NCA-ECC requires
Who it applies to
- Government ministries, authorities, establishments and their affiliated companies, inside and outside the Kingdom
- Private sector entities that own, operate or host critical national infrastructure
- Service providers and contractors required by a government client to demonstrate ECC alignment
- Other entities, which NCA strongly encourages to adopt the controls
The Essential Cybersecurity Controls (ECC) are issued by Saudi Arabia's National Cybersecurity Authority and form the mandatory cybersecurity baseline for government entities and their affiliated companies, inside and outside the Kingdom, and for private entities that own, operate or host critical national infrastructure. The current edition, ECC-2:2024, has 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols, covering cybersecurity governance, cybersecurity defense, cybersecurity resilience, and third-party and cloud computing cybersecurity. The industrial control systems domain of the 2018 edition moved to NCA's Operational Technology Cybersecurity Controls (OTCC-1:2022).
ECC compliance is not a one-off certification exercise. Entities are expected to maintain and demonstrate their posture continuously, with documented evidence available to the regulator on request. In practice the difficulty is rarely understanding the controls. It is sustaining evidence across dozens of control owners between assessment cycles.
Most regulated Saudi organisations also carry overlapping obligations under SDAIA's Personal Data Protection Law, and financial institutions additionally fall under the SAMA Cyber Security Framework. Managing these as separate programmes duplicates effort on controls that are substantially the same.
Related reading: GRC platform requirements for regulated entities
How GRCLens supports NCA-ECC
NCA-ECC runs on the same shared control model as every other framework in GRCLens, so evidence captured once can satisfy several obligations at the same time.
Full ECC control catalogue
Every ECC-2:2024 control is pre-loaded and mapped, so assessments start from a structured baseline rather than a blank spreadsheet.
Native Arabic interface
Control text, assessment workflow and reporting operate in Arabic with right-to-left layout, so Saudi teams work in their own language.
Shared control model
ECC controls are mapped to overlapping obligations under PDPL and ISO/IEC 27001. Evidence captured once satisfies several frameworks at the same time.
Data residency
GRCLens can be deployed on-premises in your own data centre or in a compliant in-Kingdom cloud region, so regulated data never leaves your control.
Evidence and audit trail
Every assessment decision carries an owner, a timestamp and supporting evidence, producing a defensible record for regulator review.
NCA-ECC frequently asked questions
Who must comply with the NCA Essential Cybersecurity Controls?
Saudi government entities and their affiliated companies, inside and outside the Kingdom, and private entities that own, operate or host critical national infrastructure. Many other organisations adopt the ECC because a government client requires it by contract, and NCA encourages all entities to use them.
What changed between ECC-1:2018 and ECC-2:2024?
ECC-2:2024 has 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols. The industrial control systems domain was removed and moved to the Operational Technology Cybersecurity Controls (OTCC-1:2022), which require ECC compliance first.
Can GRCLens be hosted inside Saudi Arabia?
Yes. GRCLens can be deployed on-premises within your own data centre, or in a compliant in-Kingdom cloud region. This is a common requirement for entities with data residency obligations.
Does GRCLens support Arabic for ECC assessments?
Yes. The platform provides a native Arabic interface with right-to-left layout covering control text, assessment workflow and reporting.
Can one assessment cover ECC and PDPL together?
Yes. GRCLens uses a shared control model, so evidence captured against an ECC control is reused where the same control satisfies a PDPL or ISO/IEC 27001 obligation, rather than being collected twice.
One platform, many obligations
See all supported frameworks → Every framework that applies in Saudi Arabia →
Talk to us about NCA-ECC
Security Solution Consultants provides NCA-ECC readiness and advisory services alongside the platform, so you can combine tooling with hands-on expertise.