NCA ECC framework overview
The ECC 1-1:2020 framework comprises five domains: Cybersecurity Governance, Cybersecurity Risk Management, Cybersecurity Operations, Third-Party Cybersecurity, and Industrial Control Systems. Domain 3 (Cybersecurity Operations) contains the controls most relevant to security monitoring: 3-1 (Asset Management), 3-3 (Identity and Access Management), and 3-5 (Cybersecurity Monitoring and Operations).
The NCA conducts compliance assessments of covered entities and publishes sector-specific guidance. Entities found non-compliant with ECC can face regulatory action. Compliance assessments typically include evidence review and technical testing — the same artefacts that satisfy other frameworks (SOC 2, ISO 27001) provide a strong foundation for NCA ECC evidence.
ECC 3-5: Cybersecurity Monitoring and Operations
ECC 3-5 requires: a security operations capability to monitor cybersecurity events, logging of all significant cybersecurity events, analysis of logs for anomalous activity, incident response procedures, and regular testing of the monitoring capability. These five requirements map directly to ManySignal capabilities.
The framework distinguishes between monitoring (continuous) and analysis (event-triggered). Both are required. ManySignal's detect agent provides continuous monitoring; the triage and investigate agents provide analysis. The combination satisfies the ECC 3-5 requirement for both monitoring and analytical response.
Log collection and retention for ECC
ECC 3-5 requires logging of all significant cybersecurity events. 'Significant' is not defined prescriptively — use the NIST SP 800-92 log management guidance as a reference: at minimum, authentication events, privilege use, account management, policy changes, and system events for all in-scope systems.
Retention requirements are not specified in the ECC itself but are subject to Saudi Arabia's Personal Data Protection Law (PDPL) and sector-specific regulations. For government entities, a common requirement is 5 years for security event logs. Configure ManySignal retention accordingly and confirm with your NCA liaison.
- All in-scope systems have active log ingestion in ManySignal
- Authentication, privilege, account management, policy, and system events captured
- Retention policy reviewed against PDPL and sector-specific requirements
- Monitoring capability tested quarterly (tabletop or controlled incident simulation)
- Incident response procedure references ECC 3-5 requirements explicitly
Identity and Access Management controls (ECC 3-3)
ECC 3-3 includes MFA requirements for remote access and privileged accounts, privileged access management controls, and user activity monitoring for privileged users. ManySignal satisfies the monitoring requirement: privileged identity activity is modelled in the entity graph with elevated anomaly sensitivity, and all privileged actions are logged on the immutable case timeline.
For Saudi government entities, the ECC also requires compliance with NCA's Identity and Access Management Framework (IAM 1-1). This framework mandates IdP integration and access review processes that align naturally with ManySignal's entity graph population from IdP sources.
Evidence for NCA compliance assessments
NCA compliance assessments are evidence-based. Prepare: the monitoring capability design document (what sources are ingested, what is detected, how incidents are managed), the detection catalogue (active detections mapped to ECC controls), the incident log (cases from the past 12 months), and the periodic testing records (tabletop or simulation results).
Demonstrate the monitoring capability live during the assessment if requested: show a ManySignal case from detection through triage to verdict, and show the weekly metrics report. Live demonstration of a functioning capability is more persuasive than documentation alone.
Key takeaways
- ECC Domain 3 (Cybersecurity Operations) is the primary domain relevant to security monitoring.
- ECC 3-5 requires both continuous monitoring and analytical response — detect agent plus triage/investigate agents.
- Retain logs per PDPL and sector requirements; confirm retention period with your NCA liaison.
- ECC 3-3 privileged account monitoring is satisfied by elevated anomaly sensitivity in the entity graph.
- Prepare: design document, detection catalogue, incident log, and periodic testing records for assessments.
- Live capability demonstration during NCA assessments is more persuasive than documentation alone.