01Introduction
Organizations operating in Saudi Arabia's government and critical infrastructure sectors must follow the National Cybersecurity Authority's baseline controls, and so must many of their suppliers.
02What is NCA ECC?
The Essential Cybersecurity Controls (ECC) are the minimum cybersecurity requirements issued by Saudi Arabia's National Cybersecurity Authority (NCA). First published in 2018 and updated in 2024, they apply to government organizations, their companies and critical national infrastructure operators.
The controls are grouped into domains covering governance, defense, resilience, third-party and cloud security, and industrial control systems. The defense domain includes dedicated controls for vulnerability management and penetration testing. Financial institutions are also subject to SAMA CSF.
03How NCA ECC works
Compliance is assessed by the NCA and through self-assessment.
- 1.
Governance
Set up a cybersecurity function, strategy and policies approved by leadership.
- 2.
Implement controls
Apply the ECC subcontrols across the in-scope environment.
- 3.
Test
Run periodic penetration tests and vulnerability assessments on internet-facing and critical systems.
- 4.
Assess
Complete self-assessments and respond to NCA compliance reviews.
04Threats and risks
The ECC responds to a high-threat environment.
Destructive malware
Wiper attacks on government and energy sectors.
Exposed services
Internet-facing applications and portals with known weaknesses.
Third-party access
Contractors with privileged access to critical systems.
Regulatory action
Noncompliance can affect eligibility for government work.
05How Parameter helps
Parameter supports the ECC penetration testing and vulnerability management controls with continuous evidence.
Penetration testing
The pentesting agents test internet-facing apps and APIs and document proven findings.
Vulnerability management
Managed vulnerability scanning with validated results.
Cloud and third party
Cloud Security and Supply Chain cover the cloud and third-party domains.
