NCA ECC
Gap assessment and remediation against the National Cybersecurity Authority Essential Cybersecurity Controls, the mandatory baseline for most Saudi organizations.
Learn moreIdentify which of your systems count as critical and assess them against the National Cybersecurity Authority's Critical Systems Cybersecurity Controls, the stricter layer that sits on top of the ECC for systems whose failure would matter nationally.
The Critical Systems Cybersecurity Controls (CSCC) are an extension of the Essential Cybersecurity Controls. They apply to critical systems within entities that own, operate or host critical national infrastructure: systems whose disruption, or the unauthorized access to or disclosure of their data, could seriously affect national security, the economy, or essential services.
Where the ECC sets the baseline for the whole organization, the CSCC raises the bar for those specific systems, with stronger requirements across governance, defence, resilience and third parties. The first step is therefore deciding, carefully and with evidence, which systems are critical.
Every engagement follows the Cyber Shields rhythm: Assess, Protect, Monitor. For this engagement, that translates into the following steps.
Findings are anchored to recognized frameworks so they are defensible and cross-mappable.
The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.
Every engagement is scoped individually. Pricing depends on the size and complexity of your environment, the systems or controls in scope, and the timeline you need to work to. Rather than publish figures that rarely fit a specific situation, we prepare a written proposal with a clear fee and schedule once your scope is understood.
Tell us about your organization and the deadline you are working toward, and we will return a tailored proposal within five business days, following a signed Non-Disclosure Agreement.
A system whose disruption, or the unauthorized access to or disclosure of its data, could seriously affect national security, the economy or essential services. We document the decision for each candidate system.
No. The CSCC adds stricter requirements on top of the ECC for critical systems. The ECC still applies to the organization as a whole.
Yes. Alongside the assessment we can validate key controls through targeted testing, agreed in scope beforehand.
Yes. Reports, the executive summary, and the readout session are available in both Arabic and English at no additional cost.
Gap assessment and remediation against the National Cybersecurity Authority Essential Cybersecurity Controls, the mandatory baseline for most Saudi organizations.
Learn moreThe NCA controls for industrial control systems and operational technology.
Learn moreWeb, mobile, network and API testing with reproducible findings and remediation guidance.
Learn moreTell us about your critical systems and we will return a written proposal within five business days. NDA first, always.