NCA ECC Compliance Checklist: The Evidence to Prepare Before Your Audit

An NCA ECC compliance checklist helps organisations prepare evidence against Saudi Arabia's Essential Cybersecurity Controls. It connects cybersecurity requirements with documents, technical configurations, test results, and responsible owners.

The checklist should follow ECC-2:2024, issued by the National Cybersecurity Authority (NCA). It covers governance, defense, resilience, and third-party and cloud cybersecurity.

However, listing implemented controls is not enough. Organisations also need reliable evidence demonstrating how those controls operate.

This guide explains what to collect, how to verify it, and where gaps commonly appear. For structured learning, explore the NCA ECC Course (Saudi Arabia).

What the NCA ECC Checklist Covers

The NCA ECC framework establishes baseline cybersecurity requirements for organisations within its scope.

The current ECC-2:2024 structure contains four domains, 28 subdomains, and 108 main controls. It also includes 92 subcontrols.

Each domain addresses a different part of organisational cybersecurity.

The domain structure helps organisations group evidence logically. However, each applicable ECC control needs individual consideration.

An ECC requirements checklist should therefore track requirements alongside their supporting records.

Operational technology also needs separate attention. ECC-2:2024 moved its former industrial control systems domain into OTCC. Organisations managing these environments should understand NCA ECC vs OTCC.

The frameworks address related security risks but have different scopes.

Who Needs to Prepare for an NCA ECC Audit?

NCA ECC applies to specified organisations operating within Saudi Arabia's regulatory scope.

These include government agencies and their affiliated entities. Private organisations owning, operating, or hosting critical national infrastructure are also covered.

The official ECC-2:2024 framework explains its scope and applicability.

Other businesses may encounter ECC expectations through customer contracts or procurement requirements. However, contractual expectations should not be confused with direct regulatory obligations.

Before preparing evidence, confirm the organisation's scope. Then identify which requirements apply to its systems, services, and operating environment.

For example, cloud-specific requirements depend partly on cloud service usage. A documented applicability review helps prevent unnecessary work and overlooked controls.

How the NCA Assesses ECC Compliance

The NCA evaluates compliance through several assessment mechanisms.

These include organisational self-assessments, periodic compliance-tool reports, and field auditing visits. The selected mechanism depends on the NCA's assessment approach.

The framework also references an ECC-2:2024 assessment and compliance tool. However, organisations should distinguish recorded compliance status from supporting evidence.

A policy demonstrates an approved requirement. A configuration record can demonstrate implementation. Meanwhile, testing and monitoring records help show operational performance.

Consider an organisation requiring multifactor authentication. Its access policy establishes expectations. Configuration exports can demonstrate enforcement. Access testing provides additional assurance.

Together, these records form a stronger evidence package.

A useful evidence chain

   ↓

1. Control

   ↓

2. Artifact

   ↓

3. Owner

   ↓

4. Review date

This structure connects each control with traceable documentation. It also makes evidence easier to locate during reviews.

The NCA's GECC-2:2026 implementation guide provides illustrative deliverables.

These examples help organisations understand possible implementation evidence. However, the guide does not prescribe one exhaustive evidence package. Assessors may request additional supporting records where necessary.

NCA ECC Evidence Checklist by Domain

A useful NCA ECC checklist organises evidence under the four official domains.

Start with the applicable requirement. Then identify the responsible team and supporting records.

The tables below provide illustrative evidence examples, not an exhaustive list of mandatory deliverables. Compare each example with the official framework and GECC-2:2026 guidance.

Domain 1: Cybersecurity Governance

Cybersecurity governance establishes accountability, management direction, and organisational oversight.

The domain covers cybersecurity strategy, policies, risk management, responsibilities, and awareness. For audit preparation, collect approved documents alongside implementation and review records.

The following evidence supports key cybersecurity governance areas:

• Cybersecurity strategy: Prepare approved strategies, documented objectives, and progress reviews. Cybersecurity leadership typically manages these records.

• Policies and procedures: Collect approved policies, revision histories, and review records. The compliance team usually maintains this documentation.

• Roles and responsibilities: Keep organisation charts, job descriptions, and responsibility assignments. HR and cybersecurity teams typically manage these records.

• Risk management: Maintain risk assessments, treatment plans, and updated risk registers. The risk management team usually oversees this evidence.

• Project security: Prepare security requirements, project reviews, and approval records. Project management typically maintains these documents.

• Compliance and audit: Collect applicable requirements registers and audit reports. Internal audit usually manages these records.

• Personnel security: Maintain recruitment records and relevant qualification evidence. HR typically holds responsibility for this documentation.

• Awareness and training: Keep training plans, attendance records, and assessment results. The training team usually maintains these records.

What should organisations verify?

First, check whether policy documents have formal approval. Then confirm they remain current and accessible to relevant personnel.

Next, review risk registers for assigned owners and documented treatment decisions.

For personnel controls, check the applicable ECC staffing requirements. Supporting records should reflect the organisation's actual arrangements.

Finally, check whether governance activities happen as documented. Meeting records, review results, and completed actions can strengthen the evidence package.

Domain 2: Cybersecurity Defense

Cybersecurity defense contains the framework's largest group of controls. It addresses security across systems, networks, applications, identities, information, and operational processes.

Therefore, this section requires particularly detailed technical evidence.

These areas appear in the official ECC defense controls. Individual evidence requirements depend on the applicable control.

What makes technical evidence reliable?

Technical evidence should demonstrate actual implementation rather than planned implementation. For example, an approved access policy cannot independently prove MFA enforcement.

A stronger package could contain:

• The applicable access policy and approved security requirements.

• Current authentication configuration exports.

• Relevant authentication impact assessments.

• Test results demonstrating the configured behaviour.

• Dated review records showing continued oversight.

Similarly, a backup schedule does not confirm successful restoration.

Organisations should retain completed recovery test results where relevant. These help demonstrate whether recovery arrangements operate as intended. For vulnerability management, track findings through remediation or approved treatment.

A scan report alone may leave important questions unanswered. Reviewers also need to understand outstanding risks and corrective action status. Avoid collecting unnecessary sensitive information.

Redact secrets, credentials, and unrelated personal information before sharing evidence. Maintain appropriate access restrictions and secure storage for assessment records.

For employees responsible for understanding ECC controls, the NCA ECC Course (Saudi Arabia) offers a relevant training option.

Domain 3: Cybersecurity Resilience

Cybersecurity resilience focuses on maintaining and recovering essential business operations during cyber disruptions.

The framework addresses cybersecurity within business continuity management. Evidence should connect documented recovery arrangements with actual testing and review activities.

Organisations should prepare evidence covering these key areas:

• Cybersecurity continuity: Prepare business continuity plans covering applicable cyber scenarios. The business continuity management (BCM) manager typically oversees these documents.

• Recovery arrangements: Maintain recovery procedures and documented recovery objectives. The IT recovery team usually manages this evidence.

• Exercises and testing: Collect exercise plans, test results, and documented lessons learned. BCM and cybersecurity teams typically manage these records.

• Plan reviews: Keep updated plans, assigned corrective actions, and review approvals. Risk and continuity teams usually oversee this documentation.

Start by reviewing the organisation's business continuity arrangements.

Check whether relevant cyber incidents are included. Examples may include ransomware, infrastructure compromise, and significant service disruption. Next, review recovery exercises and their recorded outcomes.

Any identified weaknesses should have assigned corrective actions. Follow-up records can demonstrate whether improvements were completed.

This creates a clearer connection between resilience planning and operational readiness.

Domain 4: Third-Party and Cloud Computing Cybersecurity

External suppliers can introduce risks beyond an organisation's direct operational control. Therefore, this domain addresses relevant third-party and cloud cybersecurity arrangements.

Organisations should demonstrate how applicable supplier risks are identified and managed.

First, review supplier risk assessments and contractual security obligations. Then examine records demonstrating ongoing supplier oversight.

For cloud services, establish which responsibilities belong to each party. A responsibility matrix can make this distinction easier to assess.

However, cloud arrangements vary across services and providers. Evidence must therefore reflect the actual deployment and applicable requirements.

For additional details, review third-party and cloud security controls in ECC.

What Changed in ECC-2:2024 That Affects Your Evidence?

ECC-2:2024 introduced changes that can affect existing audit documentation. Consequently, organisations using ECC-1:2018 records should review their evidence mappings.

The official framework's change appendix identifies several relevant updates.

For MFA, ECC-2:2024 clarifies authentication decisions using relevant impact assessments.

For email protection, SPF, DKIM, and DMARC are explicitly identified. Therefore, organisations should verify actual domain authentication settings. The framework also introduces DDoS protection within network security requirements.

Another change concerns cybersecurity staffing. Organisations should review the updated requirements for qualified Saudi cybersecurity professionals. Furthermore, the former industrial control systems domain moved to OTCC.

Data localisation provisions also changed. Relevant requirements now need consideration under the appropriate NDMO framework. For a detailed comparison, read what changed in ECC-2:2024.

Policies and Templates Auditors Expect

An effective evidence package needs clear documentation and traceable records. However, the documents required depend on applicable ECC controls.

The GECC-2:2026 guide provides useful implementation examples and illustrative deliverables.

Organisations can use these examples when assessing their documentation.

Common evidence categories include:

• Approved cybersecurity policies and review records.

• Cybersecurity risk assessments and treatment plans.

• Identity and access management documentation.

• Backup procedures and restoration evidence.

• Incident response plans and incident handling records.

• Secure development and project security documentation.

• Internal reviews, assessments, and corrective actions.

A document's existence does not necessarily demonstrate effective implementation. For example, a backup policy should connect with relevant backup and recovery evidence.

Similarly, an incident response plan should reflect actual organisational arrangements. The NCA implementation guidance can support this documentation review.

Treat its example deliverables as guidance rather than an exhaustive mandatory list.

How to Build Your NCA ECC Evidence Pack

A structured evidence register makes audit preparation easier to manage. Instead of storing unrelated files, connect every record to the relevant requirement.

Use the following process to organise your ECC compliance requirements.

Five-stage audit preparation workflow:

01
Establish scope
Identify applicable controls and systems

         │

        ▼

02
Assess gaps
Review existing controls and evidence

         │

        ▼

03
Address gaps
Resolve weaknesses and assign owners

         │

        ▼

04
Validate evidence
Check accuracy, dates, and completeness

         │

        ▼

05
Maintain records
Organise, review, and update evidence

Start by defining organisational scope and applicable NCA requirements. Then compare existing evidence against each applicable ECC control. Where gaps exist, document corrective actions and assign responsibilities.

Next, validate the records before submitting them through any required assessment process. Finally, maintain evidence as systems and controls change.

Common Evidence Gaps That Can Affect Audit Readiness

Even implemented controls may lack sufficient supporting documentation.

Consequently, organisations should identify evidence weaknesses before formal assessment activities.

Common problems include:

• Unapproved policies: Documents lack clear approval or review information.

• Missing ownership: Nobody maintains or verifies specific records.

• Outdated configurations: Screenshots no longer reflect operational systems.

• Incomplete access reviews: Permissions lack documented review or approval.

• Missing restoration tests: Backup records exist without supporting recovery evidence.

• Unresolved vulnerabilities: Findings lack documented remediation or risk treatment.

• Obsolete mappings: Evidence references superseded ECC requirements.

• Poor traceability: Records cannot be linked to the assessed control.

These issues do not automatically establish official audit findings. However, they can weaken the organisation's ability to demonstrate compliance. A periodic evidence review helps identify problems before they become difficult to resolve.

Conclusion

A reliable NCA ECC compliance checklist connects applicable requirements with verifiable evidence.

Start by confirming scope. Then review documentation, technical settings, ownership, and completed testing. Address missing records before assessment activities. Maintain evidence as organisational systems and risks change.

The goal is not simply collecting documents. It is demonstrating how applicable cybersecurity controls operate. For further learning, explore the NCA ECC Course (Saudi Arabia).