The Essential Cybersecurity Controls from Saudi Arabia's National Cybersecurity Authority set minimum requirements in five domains: governance, defense, resilience, third-party and cloud, and industrial control systems. They apply to government bodies and operators of critical national infrastructure. This guide summarises the ECC-1:2018 text, so check for newer versions.
Who must comply?
The document says the controls apply to government organizations in the Kingdom, including ministries, authorities and their companies and entities, and to private sector organizations that own, operate or host critical national infrastructure. The authority strongly encourages every other organization to use them as best practice. Within scope, every organization must comply with all applicable controls, and applicability depends on technology use: the cloud subdomain applies if you use or plan to use cloud or hosting services, and the industrial control systems domain applies if you use those systems.
NCA states that it evaluates compliance through self-assessments, periodic reports from a compliance tool, or on-site audits. The text promises periodic updates. The copy we read is the ECC-1:2018 edition, so confirm the current edition with NCA before building a program around it.
What is in it?
The 2018 text has 5 main domains, 29 subdomains and 114 controls, and states four pillars: strategy, people, processes and technology.
- Cybersecurity governance: strategy, a dedicated cybersecurity function, policies, roles, risk management, project management, compliance, audit, HR and awareness.
- Cybersecurity defense: asset management, identity and access, email, network, mobile, data protection, cryptography, backup, vulnerabilities, penetration testing, logging, incident management, physical security and web application security.
- Cybersecurity resilience: business continuity aspects.
- Third-party and cloud computing cybersecurity.
- Industrial control systems cybersecurity.
Which controls matter most to software teams?
Several clauses speak directly to engineering.
Project and change management. Cybersecurity requirements must be part of project and change management, including vulnerability assessment and remediation and configuration review and hardening before go live. For software development the text lists secure coding standards, trusted and licensed sources for development tools and libraries, compliance testing against defined standards and secure integration between components.
Vulnerability management. Requirements must include periodic assessments, classification by criticality, remediation based on classification and risk, patch management, and subscription to authorized and trusted sources of vulnerability information.
Penetration testing. Scope must cover internet-facing services including infrastructure, websites, web applications, mobile apps, email and remote access, and tests must be periodic.
Logging and monitoring. Event logs must be active on critical assets, remote access and privileged accounts, with continuous monitoring and a retention period of at least 12 months.
Third parties. Contracts must cover non-disclosure and secure removal of data at the end of service and incident communication. For IT outsourcing and managed services, a risk assessment comes before signing, and managed security operations centers must be fully inside the Kingdom.
Cloud. Data must be classified before hosting, environments separated from other tenants, and the organization's information hosting and storage must be inside the Kingdom.
A constructed example
A software vendor wants to sell to a ministry. The procurement questionnaire asks for evidence of secure coding, dependency source control and 12 month log retention for the hosted service. The vendor maps those asks to controls 1-6-3, 2-10-3 and 2-12-3-5, notes that hosting must be inside the Kingdom under 4-2-3-3, and finds its default region does not qualify. The finding is useful before the bid, not after it.
What to do
- Confirm whether your organization or your customer is in scope, and which current edition applies.
- Build a control matrix from the five domains and mark which subdomains apply.
- Write the missing policies first, since many controls begin with define, document and approve.
- Evidence secure development: coding standard, dependency policy, scan reports.
- Set a vulnerability classification and remediation timeline, and keep records.
- Turn on logging for critical assets and privileged access, and set retention to at least 12 months.
- Review third-party contracts for the required clauses and data location.
- Run a self-assessment, fix the gaps, and repeat on a schedule.
Safeguard helps teams organize this kind of evidence through compliance automation and dependency scanning. It does not certify anyone against the ECC.
Quick check
Does the ECC apply to every company in Saudi Arabia?
It is mandatory for government organizations and operators of critical national infrastructure within its scope. NCA encourages other organizations to use it as good practice.
How long must security event logs be kept?
The 2018 text sets a retention period of 12 months minimum for cybersecurity event logs.
Sources
Last reviewed: 18 October 2026.
