NCA ECC-2:2024 — evidence for every domain of the updated Essential Cybersecurity Controls

ECC-2:2024 is the second revision of the Essential Cybersecurity Controls issued by the National Cybersecurity Authority (NCA) of the Kingdom of Saudi Arabia, replacing ECC-1:2018. It is mandatory for government entities, semi-government entities, and Critical National Infrastructure operators in KSA. The revision strengthens third-party and cloud cybersecurity, introduces Industrial Control Systems as a top-level domain, and updates cryptographic and monitoring requirements to reflect current NCA guidance.

Government and semi-government entities in KSA, and organisations designated as Critical National Infrastructure by the NCA. Private-sector entities may also adopt ECC as good practice or where required by sector regulators. SAMA-regulated financial institutions follow the SAMA Cyber Security Framework instead — though NCA ECC alignment is common where entities operate in both scopes.

Domain 1 — Cybersecurity Governance (strategy, policies, roles, risk management, awareness, audit). Domain 2 — Cybersecurity Defence (asset management, identity, access control, cryptography, vulnerability management, event monitoring, incident response). Domain 3 — Cybersecurity Resilience (cyber aspects of business continuity). Domain 4 — Third-Party and Cloud Cybersecurity (vendor assurance, cloud tenancy, outsourced services). Domain 5 — Industrial Control Systems Cybersecurity (OT and ICS controls for CNI operators).

The most material changes are the elevation of Third-Party and Cloud Cybersecurity into a dedicated domain (previously scattered across defence and outsourcing controls), the promotion of Industrial Control Systems from an appendix to a full domain with unified sub-controls, updated cryptographic requirements aligned with current NCA cryptographic guidance, strengthened event correlation and retention expectations, and a shift from periodic-scan vulnerability management toward continuous risk-based posture. Governance controls are largely stable but with sharper evidence expectations.

ManySignal delivers the operational spine of Domain 2 (Defence) — event correlation, incident response, vulnerability posture, cryptographic monitoring — plus Domain 4 (Third-Party and Cloud) monitoring evidence from telemetry rather than questionnaires. Domain 3 (Resilience) is supported through backup and ransomware recovery instrumentation. Domain 5 (ICS) is covered where OT telemetry is integrated. Domain 1 (Governance) is supported through activity-based attestation records. Evidence exports render in the NCA-expected structure with bilingual descriptions.