Who Must Comply with NCA ECC-2:2024? The Scope Explained

Knowing who must comply with NCA ECC is essential for organisations operating in Saudi Arabia. The answer depends on ownership, government affiliation, infrastructure responsibilities, and applicable contracts.

NCA ECC-2:2024 directly applies to government entities, their affiliated companies and entities inside or outside Saudi Arabia, and private-sector entities that own, operate, or host critical national infrastructure (CNI). Other organisations are encouraged to adopt the controls. Suppliers and contractors may also face ECC-related obligations through contractual requirements or applicable sector rules.

However, not every private company automatically falls within the same mandatory scope. Understanding the distinction helps organisations plan their cybersecurity compliance requirements in Saudi Arabia.

If your organisation needs structured implementation guidance, consider the NCA ECC Course (Saudi Arabia).

What Is NCA ECC-2:2024?

NCA ECC stands for Essential Cybersecurity Controls, issued by Saudi Arabia's National Cybersecurity Authority (NCA). The framework establishes baseline cybersecurity requirements for organisations within its scope.

ECC-2:2024 replaced the earlier ECC-1:2018 edition. It reorganised the controls and clarified aspects of applicability. Therefore, organisations comparing the two versions should review the updated requirements rather than assume their existing arrangements remain sufficient.

The framework contains:

• Four main domains

• 28 subdomains

• 108 main controls

• 92 subcontrols

These requirements address cybersecurity governance, defence, resilience and related organisational practices.

The official NCA ECC regulatory page provides access to the framework. You can also consult the official ECC-2:2024 English PDF and the Guide to ECC Implementation.

These documents should be the starting point for interpreting the NCA ECC standard. Where the English translation leaves uncertainty, confirm the applicable wording against the official Arabic version.

Who Must Comply with NCA ECC-2:2024?

The NCA ECC-2:2024 scope identifies three principal categories. Organisations should assess their legal status, ownership and infrastructure responsibilities before deciding whether the framework applies.

1. Government entities in Saudi Arabia

Government entities are within the direct scope of ECC-2:2024. This includes ministries, authorities and establishments operating within the Kingdom.

Consequently, government entities must assess their cybersecurity arrangements against the applicable controls. Responsibilities may cover governance, risk management, access control, incident response and business continuity.

The assessment should involve leadership, cybersecurity teams, IT, procurement and other relevant functions. This helps ensure that controls operate across the organisation rather than remaining isolated within the IT department.

For government entities, NCA ECC compliance is an ongoing responsibility. Purchasing security software or delivering one training session does not demonstrate that every applicable requirement has been implemented.

2. Government-affiliated companies and entities

The framework also covers companies and entities affiliated with government organisations, whether they operate inside or outside Saudi Arabia.

This scope clarification matters for corporate groups with multiple subsidiaries, international operations or separate legal entities. A business should not assume that operating outside the Kingdom automatically excludes it.

Instead, the organisation should establish the nature of its government affiliation and review the applicable ECC wording. It should also identify which legal entities, systems and business operations fall within the relevant scope.

For multinational groups, this assessment can help determine where cybersecurity policies need to align with ECC-2:2024. Local laws and other regulatory requirements must still be considered separately.

3. Private-sector entities responsible for critical national infrastructure

The NCA ECC private sector scope includes private entities that own, operate or host critical national infrastructure.

Critical national infrastructure (CNI) in Saudi Arabia can involve essential services across areas such as:

• Energy and electricity

• Water and essential utilities

• Telecommunications

• Transport

• Healthcare and other critical services

These examples illustrate potentially relevant sectors. However, an organisation should not determine its legal scope from its industry alone. Its actual role and the applicable NCA requirements matter.

Owning infrastructure means holding responsibility for the relevant assets. Operating it means running or managing the infrastructure or its essential functions.

Hosting may involve providing the facilities or technology environment in which critical infrastructure systems or services operate. Data centres and cloud providers should therefore assess their specific responsibilities and applicable NCA controls.

Not every supplier serving an energy company automatically becomes a directly regulated CNI entity. However, contracts, service arrangements and separate regulatory obligations can impose significant cybersecurity duties.

Organisations should document their scope assessment and obtain qualified advice when ownership, affiliation or hosting responsibilities are unclear.

Who Isn’t Directly Covered, and Why ECC Often Still Applies

An organisation outside ECC's direct scope may still have cybersecurity obligations. The reason could be a contract, another NCA framework or a customer's regulatory responsibilities.

Suppliers, contractors, cloud providers and MSSPs

Suppliers and contractors are not automatically subject to every ECC control simply because they serve a government customer. However, procurement agreements may require them to implement specified security measures.

For example, a government agency may require suppliers to demonstrate access controls, incident reporting, vulnerability management and secure data handling. The precise obligations depend on the contract and applicable rules.

Cloud service providers require additional attention. The NCA's Cloud Cybersecurity Controls (CCC) extend ECC requirements and address cloud service providers and tenants. CCC can apply to providers outside ECC's direct scope when they serve customers covered by the cloud framework. Official CCC framework.

Managed security service providers (MSSPs) should similarly assess their customer obligations, service boundaries, and applicable requirements. Review the related guidance on third-party and cloud security controls when evaluating outsourced services.

Foreign suppliers also need to distinguish direct regulatory scope from contractual duties. A supplier based abroad may have to meet specified ECC-aligned requirements without automatically becoming directly subject to every ECC control.

Private companies that are not CNI: the NCNICC-1:2025 route

Private companies that do not own, operate or host CNI should not assume ECC directly applies to them.

The NCA introduced the Non-Critical National Infrastructure Cybersecurity Controls, NCNICC-1:2025, for relevant non-CNI private-sector organisations. This framework provides a more specific route for organisations outside the traditional ECC scope.

Businesses should consult the official NCA regulatory documents for the applicable framework and its current requirements. They should also check whether other sector rules or contractual terms apply.

Voluntary adopters

The NCA strongly encourages other organisations in the Kingdom to adopt ECC as a cybersecurity best practice. Voluntary adoption can help businesses establish consistent governance and improve risk management.

However, adopting ECC voluntarily does not automatically make an organisation legally subject to every requirement. Equally, calling a programme voluntary does not remove obligations arising under other applicable regulations or contracts.

Does ECC Apply to You? A Quick Scope Check

Use these four questions as an initial screening tool. This is a practical guide, not a substitute for a formal applicability assessment.

For a defensible decision, document:

• The legal entity and ownership structure.

• Government affiliation, where relevant.

• Infrastructure ownership, operation or hosting responsibilities.

• Customer contracts and applicable regulatory frameworks.

• The controls that apply to the organisation's actual services and technology.

The ECC statement of applicability is particularly important. The framework states that entities must comply with controls applicable to them. Some requirements depend on business activities or technology use. For example, its cloud and hosting controls apply to entities using or planning to use those services.

Do not treat the scope check as permission to exclude controls without evidence. Record the reasoning and validate it against the official framework.

ECC vs CCC, OTCC, CSCC, DCC and NCNICC: How the NCA Frameworks Fit Together

The phrase NCA ECC CCC often appears in searches because organisations need to understand how the different frameworks interact. They are related, but they do not serve identical purposes.

The NCA describes CCC, OTCC, CSCC and DCC as frameworks that extend or complement ECC in their respective areas.

For example, an in-scope organisation using cloud services may need to assess both ECC and applicable CCC controls. An organisation operating industrial systems may also need to assess OTCC.

Read NCA ECC vs OTCC to understand the distinction between baseline cybersecurity and operational technology requirements. For a wider comparison, see NCA ECC vs ISO 27001.

The correct framework depends on the organisation's scope, activities and applicable requirements. Using one framework does not automatically satisfy every other applicable framework.

What Compliance Looks Like for In-Scope Entities

NCA ECC compliance means implementing the applicable controls, maintaining evidence, and reviewing their effectiveness. It is not a one-off certificate or a policy document that remains untouched after approval.

ECC-2:2024 groups its requirements into four main domains:

• Cybersecurity Governance: Establish responsibilities, policies, risk management and oversight.

• Cybersecurity Defence: Protect systems, networks, applications and information assets.

• Cybersecurity Resilience: Prepare for incidents, recovery and business continuity.

• Third-Party and Cloud Computing Cybersecurity: Manage relevant supplier, outsourced service and cloud risks.

The organisation must assess each applicable control against its actual environment. This includes identifying gaps, assigning owners, setting remediation priorities and retaining evidence of implementation.

Two requirements deserve particular attention. Control 1-2-1 requires cybersecurity to be independent of the IT department. Control 1-2-2 addresses filling cybersecurity positions with qualified, full-time Saudi professionals.

These requirements can affect organisational structure, recruitment and budget planning. Organisations should review the exact control wording and implementation expectations before making compliance decisions.

The ECC implementation guide offers practical guidance for interpreting and applying the controls. For teams that need structured learning, the NCA ECC Course (Saudi Arabia) can support understanding of the framework and its implementation.

An ECC statement of applicability should explain which controls apply and why. Where a control is considered inapplicable, retain a clear rationale supported by the framework and the organisation's circumstances.

How NCA Checks Compliance and What Happens If You Don’t

The NCA may assess compliance through several methods, including self-assessments, periodic reports submitted through its compliance tools and field audits. The official NCA Self-Assessment Process explains how national entities evaluate and track their compliance status.

Organisations should maintain current evidence rather than prepare documentation only when an assessment is approaching. Useful records may include approved policies, risk registers, access reviews, incident records, supplier assessments and remediation plans.

The NCA's legal powers include measures for cybersecurity violations. Depending on the applicable rules and circumstances, consequences can include warnings, licence suspension or revocation, service suspension and financial penalties. The relevant statutory framework provides for fines of up to SAR 25 million in specified circumstances.

The actual consequences depend on the violation, the applicable legal provisions and the decision-making process. Organisations should consult the NCA Laws and Regulations rather than assume that every breach attracts the same penalty.

Next Steps Checklist

Use this checklist to begin assessing your organisation's position:

• Confirm whether your entity falls within ECC-2:2024's direct scope.

• Review government affiliation, CNI responsibilities and relevant contracts.

• Download the official ECC PDF and implementation guide.

• Map applicable controls to existing policies and technical measures.

• Identify control gaps, accountable owners, and remediation deadlines.

• Record applicability decisions and supporting evidence.

• Establish regular reviews and continuous compliance monitoring.

Start with scope, then prioritise implementation based on applicable requirements and identified risks.

Conclusion: Confirm Your ECC Scope Before Implementing Controls

Understanding who must comply with NCA ECC helps organisations avoid incorrect assumptions about their cybersecurity responsibilities. Direct applicability depends on government status, affiliation, and CNI responsibilities. Contracts and other NCA frameworks can create additional obligations.

Start by confirming your organisation's scope against the official ECC-2:2024 document. Then assess applicable controls, document
decisions, and establish continuous compliance processes.

For practical guidance on understanding the framework, consider the NCA ECC Course (Saudi Arabia) as part of your team's learning and implementation plan.