The Essential Cybersecurity Controls (ECC) are the baseline cybersecurity requirements issued by Saudi Arabia's National Cybersecurity Authority (NCA). They are mandatory for government entities and organisations in critical national sectors, covering governance, defence, resilience, and third-party and cloud cybersecurity.
SBS runs a gap assessment against every ECC control, prioritises and remediates the findings, implements the technical and governance controls, and produces the evidence and documentation the NCA expects — leaving you audit-ready and resilient, not just compliant on paper.
Frequently asked questions
What is NCA ECC?
NCA ECC — the National Cybersecurity Authority’s Essential Cybersecurity Controls — are Saudi Arabia’s baseline, mandatory cybersecurity requirements for government and critical-sector organisations.
Who must comply with NCA ECC?
Government entities and organisations operating in critical national sectors must comply. Many private organisations also adopt ECC as a trusted baseline and to work with the public sector.