NCA ECC
Gap assessment and remediation against the National Cybersecurity Authority Essential Cybersecurity Controls, the mandatory baseline for most Saudi organizations.
Learn moreAudit-ready policy, control, and evidence frameworks against the standards Saudi regulators enforce. We help organizations in the Kingdom move from scattered documentation to a coherent, defensible compliance posture that withstands scrutiny.
The national requirements set by the National Cybersecurity Authority, from the ECC baseline and the new private-sector controls to cloud, data, critical systems, operational technology and AI. We assess, implement and prepare you for review, bilingual and evidence-led.
Gap assessment and remediation against the National Cybersecurity Authority Essential Cybersecurity Controls, the mandatory baseline for most Saudi organizations.
Learn moreThe NCA cybersecurity controls for private companies outside critical infrastructure, adopted December 2025.
Learn moreData Cybersecurity Controls: protecting data by its classification, across its whole lifecycle.
Learn moreCloud Cybersecurity Controls for cloud service providers and tenants, extending your ECC posture into the cloud.
Learn moreThe stricter NCA controls for critical systems, built on top of the ECC.
Learn moreThe NCA controls for industrial control systems and operational technology.
Learn moreThe NCA controls for secure remote and hybrid work.
Learn moreProtect your official social media accounts against takeover, to the NCA controls.
Learn moreBring your encryption in line with the national standards, and plan for post-quantum.
Learn moreSecure your online store, payments and customer data to the NCA e-commerce guidelines.
Learn moreAdopt the national framework for identifying, assessing, treating and reporting cybersecurity risk.
Learn morePrepare your AI tools and systems for the NCA AI Cybersecurity Guidelines.
Learn moreDefine roles, job descriptions and development plans on the national workforce framework.
Learn moreInternationally recognized management systems and guidelines for information security, privacy, continuity, risk, cloud and AI. We implement them and prepare you for certification by an accredited certification body.
Implementation and certification readiness for an Information Security Management System recognised by partners and clients worldwide.
Learn moreA certifiable privacy management system that supports PDPL compliance.
Learn moreA tested, certifiable business continuity system, from impact analysis to rehearsed recovery.
Learn moreOne risk language for the whole organization, aligned with ISO 31000.
Learn moreCloud security and cloud privacy controls on top of ISO/IEC 27001.
Learn moreGuidance-led review of your internet exposure and the controls that matter online.
Learn moreA certifiable management system for responsible, secure use of AI.
Learn moreRequirements that come from your sector, your data or your customers: personal data protection, financial services, payment cards, telecoms and cloud assurance.
Readiness for the Personal Data Protection Law: data governance, records of processing, and data-subject rights handling.
Learn moreCompliance programmes against the SAMA Cyber Security Framework for entities regulated by the Saudi Central Bank.
Learn moreProtect payment card data and prepare for your PCI DSS assessment.
Learn moreReadiness for the CST cybersecurity regulatory framework for ICT providers.
Learn moreCloud security assurance customers recognize, through the CSA STAR programme.
Learn moreThese frameworks are not competing checklists. They form layers that build on a common foundation. Sequencing them sensibly avoids duplicated effort and lets a single control set satisfy several obligations at once.
The NCA Essential Cybersecurity Controls are the mandatory floor for most organizations operating in the Kingdom. We start here so that the governance, asset, and control foundations are in place before anything else is layered on top.
An ISO/IEC 27001 Information Security Management System maps closely to the ECC and gives you certification that partners and clients recognise globally. Much of the evidence prepared for the ECC carries directly into certification readiness.
SAMA CSF, PDPL, and the NCA Data Cybersecurity Controls add sector and data-specific requirements over the baseline. Where they overlap with ECC and ISO 27001, we reuse existing controls and evidence rather than rebuilding them.
Every NCA control set, the PDPL, the SAMA and CST frameworks and the international standards beside them, with current editions and direct links to the official documents. A short applicability helper suggests which ones are most likely to apply to you.
The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.