Home
Courses
NCA ECC Course (Saudi Arabia) — Essential Cybersecurity Controls ECC-2:2024

NCA ECC Course (Saudi Arabia) — Essential Cybersecurity Controls ECC-2:2024

Cybersecurity compliance becomes defensible only when governance, people, technology, evidence, and executive accountability operate as one integrated system.

5.0
(4.8 ratings)
|
398 Students

The National Cybersecurity Authority's Essential Cybersecurity Controls, ECC-2:2024, set the minimum cybersecurity requirements for Saudi government entities and for private organisations that own, operate or host Critical National Infrastructure. This NCA ECC course explains what they require across governance, controls and evidence.

Over six modules you will cover the four ECC domains: cybersecurity governance, defense, resilience, and third-party and cloud security. You will learn what ECC expects for ownership and executive accountability, policies and standards, protecting people, identities and data, technical controls, incident management and recovery, and control evidence for audits.

Each module explains one group of controls and what it means for your organisation. Organisations outside the formal scope can also use ECC as a national benchmark.

This NCA ECC course develops structured capability across cybersecurity governance, defensive controls, resilience, third-party management, cloud security, and compliance assurance.

  • Understand the objectives, scope and structure of NCA ECC-2:2024.
  • Explain the four principal domains of the framework.
  • Establish governance and executive accountability for cybersecurity compliance.
  • Develop policies and risk controls that match ECC requirements.
  • Protect people, identities, privileged accounts and data.
  • Evaluate technical defense controls across networks, endpoints, email, applications and encryption.
  • Strengthen vulnerability management, monitoring and threat detection.
  • Understand how ECC addresses incident management, resilience and recovery, and third-party, cloud and audit evidence.

This course supports professionals responsible for cybersecurity governance, technical protection, regulatory compliance, risk management, incident response, cloud security, and audit readiness.

  • Chief Information Security Officers (CISOs) and cybersecurity managers
  • ECC compliance specialists
  • GRC professionals
  • Information security officers
  • Security architects and engineers
  • Identity and access management professionals

There will be a short assessment after each module and a final assessment after completing the course. Learners must achieve a minimum score of 70% in the final assessment to pass and become eligible for the certificate.

A certificate of completion will be provided after completing the course.

Certification

Our courses are built around what professionals need most:

  • Career-focused online learning
  • Aligned with Saudi market needs
  • Flexible, self-paced access for one year
  • Digital certificate included
  • Suitable for individuals and teams
  • Clear, structured modules, backed by a 7-day money-back guarantee

Saudi organisations need people who can run, assess and evidence cybersecurity controls. This course supports roles such as:

  • NCA ECC Compliance Specialist
  • Cybersecurity Governance Analyst
  • Cybersecurity Risk Manager
  • Cybersecurity Compliance Manager
  • Information Security Manager
  • Cybersecurity Controls Assessor
  • Security Operations Manager
  • Identity and Access Management Specialist

To build on this course, see our Cybersecurity Governance, Risk & Compliance (GRC) course for governance and risk, SAMA Cybersecurity Framework (CSF) Compliance for financial-sector rules, and ISO 27001 Information Security for an international standard.

Module 1: Understanding the NCA and the ECC 2-2024 Framework

30:00 min
  • The NCA's role, control objectives, scope and structure, compliance requirements and related frameworks.

Module 2: Establishing Governance and Accountability for ECC Compliance

32:00 min
  • Strategy and structures, policies, roles and responsibilities, risk processes, project controls, oversight, workforce requirements and executive reporting.

Module 3: Protecting People, Access, and Data in Saudi Organizations

34:00 min
  • Employee lifecycle risk, security awareness, asset ownership, identity and access controls, privileged accounts, data classification, encryption and physical protection.

Module 4: Implementing Technical Defense Controls under ECC

36:00 min
  • System hardening, endpoint protection, email and network security, mobile devices, web applications, vulnerability management, penetration testing, logging and monitoring.

Module 5: Managing Incidents, Resilience, and Recovery

38:00 min
  • Incident and threat management, escalation, communication, digital evidence, business continuity, backups and recovery testing.

Module 6: Third-Party, Cloud, and Audit Readiness for ECC Compliance

40:00 min
  • Vendor due diligence, contracts, outsourcing and managed services, cloud risk, control evidence, audits and remediation plans.

Frequently Asked Questions

It is the 2024 version of the Essential Cybersecurity Controls from Saudi Arabia's National Cybersecurity Authority (NCA). It sets the minimum cybersecurity requirements for the entities it covers. Read more in What Is NCA ECC and Why It Matters.

Saudi government agencies and their affiliated entities, and private-sector entities that own, operate or host Critical National Infrastructure. The NCA encourages all other entities to use the controls.

Cybersecurity Governance, Cybersecurity Defense, Cybersecurity Resilience, and Third-Party and Cloud Computing Cybersecurity.

The NCA document sets out 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols. Module 1 explains this structure.

ECC-2:2024 replaces ECC-1:2018. Industrial control systems moved out to the separate OTCC controls, DDoS protection was added as a subcontrol, and data localisation and classification requirements moved to the National Data Management Office.

Control 1-2-2 requires cybersecurity positions to be filled by full-time, qualified Saudi professionals. Module 2 covers workforce requirements. See the Cybersecurity Saudization rule and your next NCA ECC audit.

Yes. Module 6 explains audit readiness: control evidence, audits and remediation plans. The NCA may assess compliance through self-assessments, tool reports or field audits. See How to Pass an NCA ECC Compliance Audit.

Yes. Module 2 covers strategy, accountability, policies, risk management, project requirements, awareness and reviews.