A new business application
Trace the application through identity, hosting, data, monitoring and support. Assign the control evidence before go-live, not at the next audit.
All frameworks & requirements
National Cybersecurity Authority
NCA Essential Cybersecurity Controls Readiness
Turn NCA ECC requirements into accountable governance, technical safeguards, operational evidence and a practical improvement roadmap.
ECC 2-2024Sources reviewed: 4 November 2026
Understand the requirement. Connect it to operations.
NCA Essential Cybersecurity Controls provide a national cybersecurity baseline for entities within their defined scope. The current published edition is ECC 2-2024. Start with the applicable document and the organization's status rather than a checklist copied from an older assessment.
Readiness should connect control intent to service delivery. For each applicable requirement, identify who owns the decision, what protects the environment, where evidence is generated and how effectiveness is reviewed. IRIS Technology can support this work across identity, networks, infrastructure, cloud and security operations.
Confirm applicability before choosing controls.
Confirm whether the entity falls within the published scope, including relevant government entities and private-sector entities owning, operating or hosting critical national infrastructure. Record applicability and exclusions with a defensible rationale; not every Saudi business automatically has the same obligations.
ECC is the foundation for additional NCA control sets where applicable. Critical systems, cloud, data and operational technology need their own scope decisions. Keep one control register with specific overlays rather than separate, contradictory policies for each document.
Turn requirements into implementation and evidence.
| Focus area | Implementation examples | Evidence to maintain |
|---|---|---|
| Accountable governance | Map control owners, policies, risk decisions and management oversight. | Approved responsibilities, risk register and review minutes. |
| Asset and access visibility | Reconcile asset records with network discovery and identity privileges. | Validated inventory, access reviews and removal records. |
| Defensive coverage | Review hardening, segmentation, endpoint protection and vulnerability treatment. | Configuration baselines, coverage reports and tracked exceptions. |
| Response and resilience | Connect monitoring to escalation, containment and tested recovery. | Incident exercises, restoration results and action owners. |
| Suppliers and cloud | Review external access, service boundaries and customer responsibilities. | Supplier assessments, contracts and responsibility mapping. |
What this looks like in practice.
A growing security estate
Check which systems are actually covered by existing tools. A license count is weaker evidence than verified configuration, alert handling and closure of gaps.
From readiness assessment to working controls.
Agree the scope, responsible owners and acceptance criteria before work begins. The approach is tailored to your systems, suppliers, operating constraints and existing evidence.
Assess and prioritize
Review applicability, current controls and evidence. Identify gaps and dependencies, distinguish design from operating effectiveness, and prioritize actions with accountable owners.
Design the improvements
Translate approved requirements into architecture, policies, processes and technical changes. Reuse effective controls while keeping national and sector mappings distinct.
Implement and validate
Configure agreed safeguards, document procedures and validate representative workflows within authorized access and change windows. Record exceptions and residual risks.
Handover and sustain
Organize evidence, transfer operating knowledge and define a review cadence. Track corrective actions as systems, services, suppliers and requirements change.
Agree concrete deliverables.
- A scope and applicability record with assumptions and responsibilities.
- A gap/risk register and prioritized remediation roadmap.
- Control mapping, architecture recommendations and operating procedures.
- An evidence register, agreed validation results and handover material.
Deliverables, depth, access and timing depend on the statement of work. This is readiness and implementation support; it does not include a promise of regulator acceptance or formal certification.
Common questions.
Does ECC apply to every company?
Applicability follows the official scope and relevant directions. Confirm the entity, services and contractual obligations before setting the assessment boundary.
Should we still use ECC 2018?
Use the current NCA publication as the baseline and map earlier work to ECC 2-2024. Preserve useful evidence, but review changed requirements and implementation assumptions.
Does buying a SIEM establish compliance?
No. Monitoring technology supports selected controls. Governance, people, coverage, response, resilience and evidence still need to work together.
Can ECC replace specialized NCA controls?
No. Identify additional controls for relevant critical systems, cloud services, data and OT environments. Show how the baseline and overlays relate to implementation.
What should we bring to an assessment?
Prepare inventories, architecture diagrams, policies, risk records, access models, supplier lists and existing findings. Agree safe access and evidence handling before technical validation.
Start with the official sources.
Read the linked authority publications for the binding scope, wording and applicable updates. The implementation examples on this page are practical recommendations, not a reproduction of every regulatory requirement.
General readiness and technology information, not a legal opinion, regulator endorsement or guarantee of compliance. Confirm applicability, current versions and sector directions with the competent authority and qualified advisers.
Related frameworks and requirements
Define the right scope for your organization.
Bring your services, systems, supplier dependencies and existing findings. We will help turn them into a practical assessment and implementation scope.
Discuss your readiness