Regulatory Standards · Saudi Arabia
NCA Essential Cybersecurity Controls
NCA ECC compliance, evidenced alongside PDPL.
The National Cybersecurity Authority's Essential Cybersecurity Controls set the baseline for Saudi government entities and critical national infrastructure. Astragar maps ECC controls to evidence and exposure.
Register interest in NCA ECCComing to Astragar GRC
ECC-2:2024
Current edition of the controls
4
Domains: governance, defence, resilience, third parties & cloud
Mandatory
For government entities and critical infrastructure operators
What NCA ECC requires
The obligations, in brief.
Governance
Cybersecurity strategy, roles, policies and risk management.
Defence
Asset, identity, vulnerability and data protection controls.
Resilience
Cybersecurity within business continuity.
Third parties & cloud
Controls for third-party and cloud computing services.
How Astragar helps
From checklist to measurable risk.
01
Requirement → control mapping
Map every NCA ECC requirement to controls, systems, assets and owners.
02
Evidence, continuously
Collect and maintain evidence, with sign-off from contributor to IT auditor, CISO and executive office.
03
Exposure behind the gaps
See which vulnerabilities and sensitive data put NCA ECC controls at risk.
04
Risk in financial terms
Prioritise remediation by business and financial impact, not checklist order.
One Saudi evidence layer: NCA ECC, SAMA CSF and PDPL mapped together, with Arabic and English data discovery.
Sign-off workflow
Evidence Contributor
→IT Auditor
→CISO
→Executive Office
Related · Government, Critical Infrastructure & AI
European Union
NIS2 →
European Union
EU CRA →
United States
FedRAMP →
United States
CMMC →
European Union
EU AI Act →
Global
ISO 42001 →
Global
NIST AI RMF →
Find the data. Test the controls. Reduce the risk.
NCA ECC mapping is coming to Astragar GRC. Talk to us about early access and how your existing evidence already applies.
Talk to usAstragar supports compliance programmes with technical evidence and risk analysis. It does not provide legal advice or issue certifications.
See your cyber risk in $ terms, not CVSS scores.
