Saudi Arabia

NCA Essential Cybersecurity Controls

The Saudi National Cybersecurity Authority's baseline controls, and a mandatory obligation for organisations in scope inside the Kingdom.

NUEXUS delivers readiness, gap assessment, implementation support and evidence preparation. NUEXUS is not an accredited certification body and not an auditor, and cannot certify you, issue an attestation, or sign off on a result.

How it is organised

It is a regulatory obligation, not a voluntary framework

This is the practical difference from ISO or NIST. Where those are adopted by choice or by customer pressure, entities in scope of the ECC are required to comply, and compliance is assessed by the authority rather than negotiated with a customer.

Organised into domains covering governance through to resilience

The controls are grouped into domains spanning cybersecurity governance, defence, resilience and third-party or cloud considerations, with subdomains beneath them. The structure is deliberately close to international practice, which is what makes a combined ISO and ECC programme feasible rather than duplicative.

Localisation matters

Requirements around data residency, hosting and the involvement of national authorities are where an internationally-run programme most often finds it does not already comply, even when its general security posture is strong.

What an assessor will ask to see

Documented governance, including an approved strategy and defined roles
Evidence that controls operate, not only that policies exist
Third-party and cloud arrangements assessed against the localisation requirements
Periodic review and reporting in the form the authority expects

Where it usually goes wrong

Assuming an existing ISO 27001 certificate satisfies the obligation, which it does not by itself
Governance evidence produced in English only where Arabic is expected
Cloud and hosting arrangements that conflict with residency requirements
Supplier contracts that never pass the obligation down

Who it applies to

Government entities in Saudi Arabia and their subsidiaries
Operators of critical national infrastructure in the Kingdom
Organisations directed into scope by the NCA or by a sector regulator
Suppliers whose contracts push the obligation down to them

Where NUEXUS helps

Gap assessment against the control set, in the Kingdom's context rather than a generic one
Mapping existing ISO or NIST work onto ECC so it is not implemented twice
Remediation and evidence preparation ahead of an assessment

Talk to us

Check the current text

National Cybersecurity Authority (NCA), Saudi Arabia

The controls and their applicability are published by the NCA, and scope is determined by the authority. Confirm the current version and your own scope with the NCA or your sector regulator before planning.

Also in this reference

Other frameworks

ISO 27001The international standard for an information security management system, and the one most often written into contracts as a supplier requirement.SOC 2A US attestation report on the controls a service organisation runs, most often requested by enterprise customers during procurement.NIST CSF 2.0A voluntary framework for organising a security programme around outcomes, widely used as a common language between technical teams and boards.CIS ControlsA prioritised, prescriptive control set that tells a small team what to do first, which is what most other frameworks deliberately avoid doing.

All frameworks