About this Framework
The NCA Essential Cybersecurity Controls version 2 (ECC-2:2024) represents a major update to Saudi Arabia's foundational cybersecurity standard, expanding from ECC-1:2018 with new controls for cloud security, AI system cybersecurity, software supply chain security, OT/IoT convergence and enhanced cybersecurity governance. ECC-2 maintains mandatory applicability for all Saudi government entities and critical national infrastructure operators, with updated compliance assessment methodologies and revised timelines for transitioning from ECC-1:2018 compliance programmes.
Key Control Domains
Cybersecurity Governance
Cybersecurity Risk Management
Cybersecurity in IT & Cloud
Cybersecurity in OT & IoT
Cybersecurity in AI Systems
Software Supply Chain Security
Third-Party Cybersecurity
Physical Cybersecurity
Incident Response & Recovery
Who Needs This?
- Saudi government ministries and agencies (mandatory ECC-2 transition)
- Critical national infrastructure operators across all sectors
- Cloud service providers operating in Saudi Arabia
- Organisations previously certified against ECC-1:2018
- Saudi entities pursuing cloud-first and AI-enabled digital transformation
Compliance Benefits
- Updated NCA regulatory compliance replacing ECC-1:2018
- New controls addressing AI, cloud and OT/IoT security convergence
- Enhanced supply chain security controls aligned with global best practices
- Aligned with Saudi Vision 2030 digital transformation security objectives
Official Reference
NCA Official Portal — ECC-2:2024
https://nca.gov.sa
Assessment Details
Share this Assessment
Share this permanent link with your team, clients or auditors.
https://grcopilot.app/frameworks/essential-cybersecurity-controls-ecc-2-2024