Essential Cybersecurity Controls ECC-2:2024
The national baseline of cybersecurity controls for government entities and for organizations that own, operate or host critical national infrastructure.
Every national control set, law and international standard that shapes cybersecurity in the Kingdom, with its current edition and a direct link to the official document.
Saudi organizations work with a growing set of cybersecurity requirements: controls from the National Cybersecurity Authority, the Personal Data Protection Law, sector frameworks from the Saudi Central Bank and the Communications, Space and Technology Commission, and the international standards that sit beside them.
This library lists them in one place. Each entry shows who issued it, the current edition, a one-line summary and links to the official page and documents in Arabic and English. Where a Saudi regulation is published in both languages, the Arabic text is the binding version. We check the links regularly; the date of the last check is shown below.
Links last checked:
Answer three quick questions to see the documents most likely to apply to your organization. This is a starting point based on the official scope statements, not a legal determination; confirm your position in writing with the regulator or an assessor.
Based on the scope statements in the official documents. Confirm applicability with the regulator or an assessor before you plan the work.
Ask us to confirm your position58 documents
The national controls, frameworks and guidelines issued by the NCA. The Essential Cybersecurity Controls are the foundation that most of the other control sets extend.
The national baseline of cybersecurity controls for government entities and for organizations that own, operate or host critical national infrastructure.
Minimum cybersecurity requirements for cloud service providers and for in-scope government and critical infrastructure tenants that use cloud services, as an extension of the ECC.
Minimum cybersecurity controls for private-sector entities outside critical infrastructure, in two size categories: large entities, and small and medium entities.
Controls for protecting data throughout its life cycle, extending the Essential Cybersecurity Controls.
Additional controls for organizations that own or operate critical systems, extending the Essential Cybersecurity Controls.
Controls for operational technology and industrial control systems: the systems that run physical processes in sectors such as energy and water.
Controls that let organizations allow remote work securely, covering telework systems, devices and users.
Controls for securing organizations' official social media accounts against takeover and misuse.
Practical cybersecurity guidance for e-commerce service providers, including small and home-based sellers, issued with the Saudi e-Commerce Council.
Guidance that helps online shoppers protect their devices, personal data and payments.
Approved cryptographic algorithms, strength levels and key management requirements for national entities.
A national reference and methodology for managing cybersecurity risks at the entity and national levels.
The national reference for cybersecurity job roles, tasks, knowledge and skills, with career progression paths.
Draft guidelines on the cybersecurity of artificial intelligence, including generative and agentic AI. The public consultation closed in August 2026.
National law on personal data, and the cybersecurity frameworks of sector regulators.
The law that governs the processing of personal data in the Kingdom, with its implementing regulations and the regulations on transferring data abroad.
SDAIA's national data governance platform, with personal data protection services, registration and guidance.
The cybersecurity framework that organizations regulated by the Saudi Central Bank are required to adopt.
Cybersecurity requirements for licensed service providers in the information and communications technology sector.
Certifiable management system standards and their guidance documents, often used alongside the national controls.
The international requirements for an information security management system, and the most widely certified security standard.
Guidance on the information security controls referenced in ISO/IEC 27001.
Guidance on assessing and treating information security risks.
Requirements and guidance for a privacy information management system, which can be certified on its own since the 2025 edition.
Requirements for a business continuity management system.
Principles and guidelines for managing any type of risk.
Information security controls for cloud service providers and customers, based on ISO/IEC 27002.
Controls for protecting personal data in public clouds that act as data processors.
Guidelines for Internet security and cybersecurity collaboration between organizations.
Requirements for an artificial intelligence management system: the certifiable standard for governing AI responsibly.
Principles and process for information security incident management.
Requirements for an IT service management system.
Principles for the governance of IT by an organization's governing body.
Widely used frameworks, testing guides and references from NIST, PCI SSC, the Cloud Security Alliance, OWASP and others.
Security requirements for every organization that stores, processes or transmits payment card data.
The Cloud Security Alliance's assurance programme for cloud providers, from self-assessment to third-party certification.
A cybersecurity control framework for cloud computing, mapped to major standards.
A widely used framework to govern, identify, protect, detect, respond to and recover from cybersecurity risk.
A comprehensive catalogue of security and privacy controls.
Recommendations for incident response, aligned with the NIST Cybersecurity Framework 2.0.
Technical guidance for planning and conducting security testing and assessment, including penetration testing.
Guidance for planning enterprise patch management.
Guidance for securing operational technology.
Guidance for building a cybersecurity and privacy learning and awareness programme.
A NIST post-quantum cryptography standard for key establishment (ML-KEM).
A NIST post-quantum cryptography standard for digital signatures (ML-DSA).
A NIST post-quantum cryptography standard for hash-based digital signatures (SLH-DSA).
A draft NIST plan for moving from quantum-vulnerable public-key algorithms to the post-quantum standards.
A tool for managing privacy risk across an organization.
A common language for describing cybersecurity work, roles, tasks, knowledge and skills.
The best-known awareness list of the most critical web application security risks.
A detailed checklist of security requirements for designing, building and testing applications.
A comprehensive guide to testing the security of web applications.
The most critical security risks for application programming interfaces (APIs).
The OWASP standard (MASVS) and testing guide (MASTG) for mobile application security.
The most critical security risks for applications built on large language models.
A knowledge base of real-world adversary tactics and techniques.
Consensus-based secure configuration guides for operating systems, cloud services and applications.
The standard method for rating the severity of software vulnerabilities.
The international series of standards for securing industrial automation and control systems.
A framework for the governance and management of enterprise IT.
No document matches your search. Try a shorter word or a code such as ECC or 27001.