ECC-2:2024 vs ECC-1:2018: What Changed and What It Means for Your Organisation

ECC-2:2024 replaced ECC-1:2018, reducing the framework from five domains and 114 main controls to four domains and 108 controls. However, it introduces clearer requirements for cybersecurity staffing, email authentication, DDoS protection, and risk-based MFA.

The former ICS domain now falls under OTCC-1:2022. Government entities, CNI operators, and relevant suppliers should assess their applicable requirements and identify compliance gaps.

Prepare your team for the transition with the NCA ECC Course (Saudi Arabia) to build practical knowledge of ECC-2:2024 implementation and compliance.

ECC-2:2024 vs ECC-1:2018 at a Glance

The differences extend beyond the number of controls. ECC-2:2024 reorganises requirements and clarifies several organisational and technical expectations.

Consolidation, not relaxation: Fewer controls do not automatically mean less implementation work. Organisations must evaluate the revised requirements and identify outstanding technical, staffing, and governance gaps.

The official NCA Essential Cybersecurity Controls page provides the published framework and implementation guide.

How the Structure Changed: Four Domains Instead of Five

ECC-2:2024 organises cybersecurity requirements into four main domains. Each addresses a different part of an organisation’s security programme.

The four ECC-2:2024 domains

1. Cybersecurity Governance

This domain establishes accountability and organisational direction. Its requirements address cybersecurity strategy, management, policies, risk management, compliance, and responsibilities.

2. Cybersecurity Defense

This domain focuses on protecting systems, networks, applications, and information. Relevant areas include asset management, identity and access management, vulnerability management, and technical safeguards.

3. Cybersecurity Resilience

This domain addresses an organisation’s ability to prepare for, respond to, and recover from cybersecurity incidents. It covers resilience-related capabilities, including incident management and continuity arrangements.

4. Third-Party and Cloud Computing Cybersecurity

This domain addresses risks arising from external providers and cloud services. Organisations should assess supplier relationships, cloud responsibilities, and security evidence.

For implementation, use the official ECC document to verify each applicable control and its specific requirements. Domain names alone are not sufficient for demonstrating compliance.

Why fewer controls do not mean less work

ECC-2:2024 reduces the main controls from 114 to 108. It also reduces subcontrols from 201 to 92. These changes reflect consolidation, clarification, and the relocation of industrial control system requirements.

Therefore, do not treat the new framework as a simpler checklist. Instead, map existing evidence to the revised control structure and identify what remains missing.

Teams building implementation skills can consider the NCA ECC Course (Saudi Arabia). Training can help relevant staff interpret requirements, coordinate remediation, and prepare consistent evidence.

Does ECC-2 Still Include an ICS Domain?

Where industrial control systems moved

ECC-1:2018 included a dedicated fifth domain for Industrial Control Systems Protection. ECC-2:2024 no longer contains that separate domain.

Instead, the National Cybersecurity Authority addresses operational technology through its Operational Technology Cybersecurity Controls (OTCC-1:2022).

OTCC establishes additional cybersecurity requirements for relevant operational technology environments. It is an extension of ECC, rather than a replacement for the main framework.

Organisations operating industrial control systems should therefore assess both frameworks where applicable. They must establish ECC compliance first, then implement additional OTCC requirements.

For a more detailed explanation, consult the internal guide NCA ECC vs OTCC. The official OTCC Methodology and Mapping Annex also supports understanding the relationship between the controls.

What Is New or Stricter in ECC-2:2024?

Several ECC-2:2024 changes require organisations to review existing policies, staffing arrangements, and technical safeguards. The following areas deserve particular attention during a gap assessment.

Saudization of all cybersecurity positions

ECC-2:2024 requires all cybersecurity positions to be filled by full-time, qualified Saudi cybersecurity professionals. Organisations should review their workforce arrangements against this requirement.

Start by checking:

• Current cybersecurity roles and responsibilities.

• Job descriptions and qualification records.

• Evidence of full-time employment.

• Outsourced cybersecurity responsibilities.

• Vacancies and gaps in specialist capabilities.

Document the findings and assign responsibility for addressing each gap. Where staffing arrangements need adjustment, coordinate with human resources and the cybersecurity leadership team.

Email authentication: SPF, DKIM, and DMARC

ECC-2:2024 requires organisations to validate email domains using SPF, DKIM, and DMARC. These mechanisms help organisations control and verify legitimate email sources.

Each mechanism serves a different purpose:

• SPF: Identifies servers authorised to send email for a domain.

• DKIM: Uses digital signatures to help recipients verify message integrity and domain association.

• DMARC: Defines how receiving systems should handle messages that fail specified authentication checks.

Organisations should review their DNS records, authorised sending services, and authentication alignment. They should also examine DMARC policies and reporting arrangements.

Check every relevant sending domain, including services operated by external providers. Changes should be tested carefully to avoid disrupting legitimate business email.

DDoS protection as a specific requirement

ECC-2:2024 includes protection against distributed denial-of-service (DDoS) attacks. These attacks can overwhelm online services and affect their availability.

Organisations should identify internet-facing systems and assess their exposure. They should also review traffic visibility and available mitigation capacity.

Evaluate whether existing providers can support the organisation’s protection requirements. Confirm that incident-response procedures cover suspected DDoS activity and escalation responsibilities.

Record the technical arrangements and supporting evidence. A general security policy alone may not demonstrate that effective protection exists.

Risk-based MFA for privileged and remote access

ECC-2:2024 requires multi-factor authentication for remote access and privileged accounts. The authentication factors and techniques must be selected through an impact assessment of authentication failure or bypass.

Organisations should review:

• Privileged accounts and administrative access.

• Remote-access services and entry points.

• Emergency or break-glass accounts.

• Service accounts and their authentication methods.

• Conditional-access rules and exceptions.

• Account recovery and emergency procedures.

Identify exceptions and document their justification. Then assess whether the selected authentication methods provide appropriate protection for each access scenario.

National Cryptographic Standards

ECC-2:2024 references the National Cryptographic Standards. Organisations should assess their cryptographic arrangements against the applicable requirements.

The NCA explains that its National Cryptographic Standards address cryptographic mechanisms for protecting national data, systems, and networks.

A practical review should cover:

• Cryptographic assets and their intended uses.

• Algorithm and protocol selection.

• Encryption key generation, storage, rotation, and retirement.

• Certificate issuance, renewal, and revocation.

• Legacy systems using outdated cryptographic mechanisms.

Use the applicable standard and assess the required protection level. Record gaps and assign remediation actions to the responsible technical teams.

What Moved or Was Removed?

Not all ECC-2:2024 changes introduce new requirements. Some address topics through separate frameworks, while others clarify existing obligations.

Data hosting and privacy moved to related frameworks

Organisations must still assess applicable data governance, localisation, and privacy obligations.

The NCA Data Cybersecurity Controls provide separate data protection requirements. Organisations should also review relevant SDAIA and National Data Management Office (NDMO) rules.

Relocation does not remove these obligations. Maintain separate compliance mappings for each applicable framework.

General legal compliance and international agreements

ECC-2:2024 removes the former general control on compliance with national laws and makes international agreements conditional.

Organisations must still assess applicable legal obligations. Removing an ECC control does not eliminate duties under other laws or regulations.

Terminology and scope clarifications

ECC-2:2024 clarifies its scope, including affiliated entities operating outside Saudi Arabia. The Arabic version is authoritative for interpretation.

When developing policies or audit evidence, consult the Arabic text where meaning is unclear. Document how each relevant requirement applies to the organisation and its affiliates.

Who Must Comply Under ECC-2:2024?

ECC applies to specified national entities and critical infrastructure organisations. However, not every private company automatically falls within its direct scope.

The relevant categories include:

• Government entities: Government agencies and their affiliated entities inside and outside Saudi Arabia.

• Critical national infrastructure: Private-sector entities that own, operate, or host critical national infrastructure.

• Suppliers and service providers: Organisations whose contracts with government entities or CNI operators impose ECC-related obligations.

• Other private companies: Organisations that should assess the separate frameworks applicable to their activities, including NCNICC-1:2025 where relevant.

For a more detailed scope discussion, see who must comply with ECC-2:2024. Organisations should confirm applicability against the official NCA framework and their specific circumstances.

What ECC-2:2024 Means for Your Organisation

The practical impact depends on the organisation’s regulatory status, existing security controls, and operating environment.

If you are a government entity or affiliate

Review cybersecurity governance, staffing, risk management, incident readiness, and third-party oversight. Confirm that the cybersecurity department remains independent from IT and communications.

Direct reporting to the head of the entity is recommended. However, the framework does not make that reporting arrangement mandatory.

Prepare for self-assessment by maintaining current control evidence and assigning clear responsibilities. Review the Haseen self-assessment platform and the NCA self-assessment process.

If you operate critical national infrastructure

Treat ECC as the baseline where applicable. Then determine whether additional sector-specific or technology-specific requirements apply.

For organisations with operational technology, assess OTCC alongside ECC. Document which controls apply to corporate IT, operational environments, and shared systems.

If you are a supplier or foreign company in Saudi Arabia

Review contracts with government entities and CNI operators. Identify required controls, evidence requests, reporting commitments, and audit rights.

Separate direct regulatory obligations from contractual commitments. This distinction helps teams prioritise work without overlooking requirements imposed by customers.

How to Migrate From ECC-1:2018 to ECC-2:2024

A structured migration helps organisations preserve useful evidence while addressing new or revised requirements.

1. Re-map existing evidence

Do not restart the entire compliance programme without reviewing existing work. Map ECC-1 policies, procedures, technical configurations, and audit records to the ECC-2 control structure.

Confirm that each piece of evidence still supports the relevant requirement. Mark obsolete mappings and identify controls requiring new evidence.

2. Prioritise four areas of new work

Assess Saudization evidence, SPF/DKIM/DMARC validation, DDoS protection, and risk-based MFA. Assign owners, remediation dates, and evidence requirements based on risk and organisational priorities.

Avoid treating these areas as a complete list of changes. Review the full ECC-2 document to identify every applicable gap.

3. Reorganise data-related evidence

Move data hosting, localisation, and privacy evidence into the relevant compliance mappings. Identify applicable NDMO, SDAIA, and other Saudi data requirements.

Keep cross-references where controls overlap. This reduces duplication while preserving traceability across frameworks.

4. Update compliance tools and documents

Replace outdated ECC-1 references in control libraries, risk registers, policy mappings, and audit checklists. Update any ISO 27001 crosswalks or internal templates that use old ECC numbering.

Then check whether each document identifies the correct control owner and supporting evidence. Consistent numbering makes future reviews easier.

5. Conduct a self-assessment

Use Haseen and the NCA self-assessment process where applicable. Record the assessment results and assign remediation actions.

An ECC compliance checklist can help teams organise control owners, evidence, gaps, and follow-up actions. Validate the checklist against the official framework before using it as the final assessment basis.

What Does Moving to ECC-2:2024 Cost?

There is no single reliable cost figure that applies to every organisation. The total depends on existing maturity, system complexity, applicable obligations, and remediation needs.

The main ECC-2:2024 cost drivers include:

• Gap assessment and control remapping.

• Technical remediation and configuration changes.

• Saudization, recruitment, training, and role restructuring.

• Email authentication and domain-security improvements.

• DDoS protection and mitigation capacity.

• Third-party and cloud assurance.

• Policy updates, documentation, and internal audits.

• Self-assessment and evidence preparation.

Organisations with established controls may reuse some existing evidence. However, they must verify that it meets the revised requirements.

Costs may increase where significant staffing changes or technical upgrades are needed. CNI status, OT exposure, existing ISO 27001 alignment, and internal delivery capacity also affect the effort required.

For planning, estimate each remediation item separately. Include implementation, testing, documentation, and ongoing maintenance rather than considering procurement costs alone.

Conclusion and Next Step

ECC-2:2024 vs ECC-1:2018 is a comparison between an earlier framework and a more consolidated, more specific set of cybersecurity controls. The revised framework reduces the number of main controls while strengthening important staffing and technical expectations.

Organisations should begin with control remapping and a focused gap assessment. They should prioritise Saudization, email authentication, DDoS protection, MFA, and applicable OTCC requirements.

Next, update compliance documentation and prepare evidence against the current control structure. Use official NCA publications to verify each requirement and confirm applicability.

The NCA ECC Course (Saudi Arabia) may help teams build the knowledge needed to interpret, implement, and evidence ECC-2 requirements. Choose training that supports your organisation’s actual responsibilities and compliance gaps.