NCA Cybersecurity Controls

No changes recorded yet — we are watching, and nothing has been published.

No key dates confirmed by an official source yet.

1. —
   ECC-2:2024 Major versionCurrent

   Second edition of the Essential Cybersecurity Controls, updating ECC-1:2018; Appendix C lists every change. source

   More

   • Main domain 5 (Industrial Control Systems Cybersecurity) was deleted and its controls moved to the OTCC.
   • All cybersecurity positions are to be filled by full-time, qualified Saudi professionals.
   • Multi-factor authentication requirements were clarified, email domain validation now names SPF, DKIM and DMARC, and DDoS protection was added (sub-control 2-5-3-9).
2. —
   CCC-2:2024 Major version

   Second edition of the Cloud Cybersecurity Controls, updating CCC-1:2020; the data localisation controls were removed and transferred to the National Data Management Office. source

   More

   • Entities must refer to the National Data Management Office at the Saudi Data and Artificial Intelligence Authority on data localisation.
3. —
   OTCC-1:2022 Major version

   Operational Technology Cybersecurity Controls, an extension of the ECC setting minimum requirements to protect industrial control systems. source

4. —
   CCC-1:2020 Major version

   First edition of the Cloud Cybersecurity Controls for cloud service providers and tenants. source

5. —
   CSCC-1:2019 Major version

   Critical Systems Cybersecurity Controls, an extension of the ECC with 32 main controls and 73 subcontrols for national critical systems. source

Government bodies and operators of critical national infrastructure must meet the ECC; the CSCC, CCC and OTCC add controls for critical systems, cloud and industrial systems.

ECC

Government agencies, including their companies and entities inside and outside the Kingdom, and all private sector entities owning, operating or hosting CNIs; NCA strongly encourages all other entities to use the controls. source

CCC

Cloud service providers serving in-scope tenants, and tenants that are government agencies or CNI entities using or planning to use cloud services. source

CCC out of scope

Providers serving only non-Saudi entities abroad, or only individuals and private entities that do not own, operate or host CNIs, and no in-scope tenants. source

CSCC

Systems deemed critical under the CSCC criteria, owned or operated by government organizations in the Kingdom or abroad, their subsidiaries or private organizations. source

OTCC

Organizations protecting industrial control systems, as an extension to the ECC. source

Cloud in ECC

ECC subdomain 4-2 (cloud computing and hosting) binds entities using or planning to use cloud and hosting services. source

Continuous compliance, evaluated by NCA through self-assessment, compliance tool reports and field audit visits.

How NCA checks

NCA evaluates ECC compliance through self-assessment by the entities, periodic reports of the compliance tool and/or field auditing visits, as it deems appropriate. source

Compliance tool

NCA states it will issue an ECC-2:2024 Assessment and Compliance Tool; the OTCC page lists an OTCC Assessment and Compliance Tool. source source

Cloud tenants

CCC tenant controls extend the ECC, so tenants must comply continuously with both the ECC and the CCC, at the levels set in the CCC's Annex A. source

Binding on entities in scope under NCA's Statute; NCA periodically revises the controls and publishes updates for implementation.

Legal basis

All entities in scope shall take all necessary measures to ensure ongoing compliance, as per Article 10(3) of the NCA's Statute and High Order No. 57231. source

Updates

NCA will periodically review and update the ECC and communicate and publish the updated version for implementation and compliance. source

1. Standard Essential Cybersecurity Controls (ECC-2:2024)
2. Guidance Guide to Essential Cybersecurity Controls (ECC) Implementation
3. Standard Cloud Cybersecurity Controls (CCC-2:2024)
4. Standard Critical Systems Cybersecurity Controls (CSCC-1:2019)
5. Standard Operational Technology Cybersecurity Controls (OTCC-1:2022)

1. UAE NIAF

   The UAE's national information assurance framework, rather than Saudi Arabia's NCA control sets.

2. ISO 27001

   A voluntary, certifiable ISMS standard; the NCA controls are binding on Saudi government bodies and CNI operators.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to NCA Cybersecurity Controls (RSS)