The National Cybersecurity Authority's Essential Cybersecurity Controls (ECC) are the baseline for government entities and for organizations that own, operate or host critical national infrastructure. Private companies outside that circle now have their own baseline, the NCNICC controls adopted in December 2025, but many still prepare against ECC because a client or a regulator asks them to.
Either way, the first gap assessment can look bigger than it is. Most of the effort goes into organizing what you already have, not buying something new. The ten steps below follow the order a careful assessment usually runs in. Each one produces something the next step needs, so it pays to resist jumping straight to fixes before you know your scope and your gaps.
The ten steps #
Step 1: Confirm applicability and scope #
Start with where your obligation comes from: are you a national entity, a service provider, or a supplier in a regulated chain? Then write down which systems, locations, business units and data are in scope. A written scope stops you from over-engineering some areas and missing others completely.
Step 2: Get an executive sponsor #
Compliance that sits only with the IT team rarely lasts. You need a senior owner, usually at board or executive level, who approves the cybersecurity strategy, signs off the budget and holds the programme to account. The controls expect this commitment to be documented, so get it in writing.
Step 3: Build an asset inventory #
List your information and technology assets: servers, endpoints, applications, network devices, cloud services and the data they hold. For each one, record the owner, the classification and how critical it is to the business. Almost every other control refers back to this list, so it is worth getting right early.
Step 4: Assign governance roles #
Decide who is responsible for cybersecurity governance, who takes risk decisions and who runs daily operations, and assign these roles formally. A small company may only need one named owner rather than a department. What matters is a clear line between the people who operate controls and the people who review them.
Step 5: Review your documentation #
Collect your policies, standards and procedures and compare them with the control domains. Most small and medium businesses find fragments: an acceptable-use note in one place, an informal backup routine in another. Map what exists, mark what is missing, and note where the written policy and the actual practice no longer match.
Step 6: Check yourself control by control #
Go through each domain in order, from governance and risk management to asset, identity and access management, data protection and resilience. Give every control an honest status: implemented, partially implemented or not implemented. Write down how you reached each verdict, because an assessor will ask.
Step 7: Prioritize by risk #
Some gaps matter far more than others. Rank them by the likelihood and business impact of the risk behind them, and deal first with weaknesses that expose critical systems or sensitive data. Working in this order shows real progress quickly and puts effort where it protects the most.
Step 8: Build a remediation roadmap #
Turn the ranked gaps into a plan with owners, target dates and realistic milestones. Separate the quick wins, which often need only a documented procedure, from the longer pieces of work that need tools or process changes. A dated, credible roadmap is itself one of the outputs an assessor expects to see.
Step 9: Collect evidence #
For every control you say you meet, gather the proof: approved policies, configuration records, access reviews, log samples, training records and meeting minutes. Organize it so an assessor can go from a control to its evidence without searching. If you cannot produce the evidence, the assessment will treat the control as a gap.
Step 10: Rehearse with an independent assessment #
Before the formal review, ask an independent party to walk through your controls and question your evidence. Outside eyes catch the assumptions your team stopped noticing, and they find weak spots while you still have time to fix them.
In short #
Scope and sponsorship come first, and everything else depends on them. A good asset inventory and a clear map of your documents do most of the heavy work. Score yourself honestly, let risk set the order of remediation, and collect evidence as you go rather than at the end.
Frequently asked #
How long does ECC readiness usually take for an SMB?
It depends on your starting point and your scope, but a focused programme commonly takes a few months. The self-check and the roadmap are quick; closing the gaps and building lasting evidence takes most of the time.
Do we need to buy new security tools to comply?
Not necessarily. Many of the controls concern governance, documented processes and running what you already have properly. Tools can help with specific gaps, but start by organizing and operating your current setup well.
Can we run the gap assessment ourselves?
Yes, and a self-check is a good first move. The weakness is objectivity: internal teams tend to score generously and overlook familiar problems. An independent assessment before the formal review gives you a more reliable picture.
Official Sources and References #
The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.