Saudi NCA Essential Cybersecurity Controls assessment
The Essential Cybersecurity Controls are the National Cybersecurity Authority’s baseline for government organizations in Saudi Arabia, the companies that serve them, and operators of critical national infrastructure. We assess each control against evidence and give you a register that follows the NCA’s own structure.
Who it is for
- Saudi government organizations and their suppliers.
- Private sector organizations that own, operate or host critical national infrastructure.
- International companies bidding for or delivering Saudi government work.
What we assess
- All main domains: Cybersecurity Governance, Cybersecurity Defense, Cybersecurity Resilience, Third-Party and Cloud Computing Cybersecurity, and Industrial Control Systems Cybersecurity where it applies.
- Each subdomain and control rated against evidence, with the control number your NCA self-assessment uses.
- The physical security subdomain, tested on site.
- Links to the other NCA frameworks that apply to you: OSMACC, CGIoT, and the Cloud, Data and Operational Technology controls.
What you receive
- An ECC control register: rating, evidence, owner and remediation step for each control.
- A remediation roadmap with a price range on every item.
- An executive summary in English, with Arabic on request.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically three to six weeks, depending on the number of entities and sites.
Common questions
Who has to comply with the ECC?
The NCA applies the ECC to government organizations in Saudi Arabia and their companies and entities, and to private sector organizations that own, operate or host critical national infrastructure. It encourages other organizations to adopt it. The scope section of the published document is the authority.
We were assessed against ECC-1:2018. What now?
ECC-2:2024 is the current edition. We assess against it and map your earlier results across, so prior work carries over.
Do you submit our compliance to the NCA or certify us?
No. We assess readiness and give you the evidence and register to work from. Submissions to the NCA are made by your organization, and we do not issue certificates.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
Saudi NCA ECC assessment
We reply within one business day.
Nothing you send is shared outside Calibre.