ECC-2:2024 replaces ECC-1:2018; current NCA publication dated 31 July 2025
Last verified
2026-10-20
The Essential Cybersecurity Controls (ECC) are the NCA's minimum cybersecurity baseline. ECC-2:2024 replaces ECC-1:2018; the current NCA publication is dated 31 July 2025.
Applies to: government entities and their affiliated companies (inside and outside the Kingdom), and private entities owning, operating or hosting Critical National Infrastructure (CNI). Compliance is required under Art 10(3) of the NCA Statute and High Order 57231 (10/11/1439H). Other entities are encouraged to use the controls.
Structure: 4 domains and 28 subdomains. The hosted text lists 108 main controls and 92 subcontrols. Former Domain 5 (industrial control systems) moved to the OTCC.
Localisation: subcontrol 4-2-3-3 (hosting and storage inside the Kingdom) is deleted and localisation is referred to the National Data Management Office (NDMO) at SDAIA. The remaining localisation rule is 4-1-3-2: managed security operations centres using remote access must be fully located in the Kingdom.
Incidents: entities report cybersecurity incidents to the NCA and share incident information with it (2-13-3-3 and 2-13-3-4). The ECC sets no reporting hours.
Compliance and penalties: assessed by self-assessment, the ECC-2:2024 compliance tool and field audits. Penalties under the NCA's Statutory Enablers (Royal Decree M/117) apply to non-government entities; government entities are excluded.
Implementation guide: see the Guide to ECC Implementation.
Proposed PDPL change (as at 20 October 2026): SDAIA's draft amendments to the PDPL Implementing Regulation (IR), open for comment to 5 November 2026, would require controllers to apply applicable NCA controls (draft Art 23(1)(b)), to store personal data in the Kingdom (draft Art 23(2)) and to notify SDAIA within 72 hours of any breach, without prejudice to NCA reporting (draft Art 24). With ECC-2 and CCC-2 referring localisation to NDMO, draft Art 23(2) would become the main general localisation rule.