Regulations · Saudi Arabia

NCA Essential Cybersecurity Controls (ECC-2:2024) and Data Security

The Essential Cybersecurity Controls (ECC-2:2024) are the National Cybersecurity Authority's baseline control set for organizations in Saudi Arabia. The 2024 edition replaced ECC-1:2018 and is organized into four main domains and twenty-eight subdomains. Several of its subdomains bear directly on data: knowing what sensitive information exists, protecting it in use and in transit, and monitoring for unauthorized change. Siberson provides capabilities relevant to those objectives.

Request a Demo All Saudi Arabia frameworks

Siberson · Saudi Arabia

Personal data located

PDPL scope

Mapped

Classification applied

NCA DCC lifecycle

Labelled

Egress attempt — external e-mail

Classified document

Blocked

Control evidence — NCA ECC · SAMA CSF

At a glance

Regulation overview

Regulation overview
Official name	Essential Cybersecurity Controls (ECC-2:2024)
Issuing authority	National Cybersecurity Authority (NCA)
Jurisdiction	Kingdom of Saudi Arabia
Status	Current edition, published 2024; supersedes ECC-1:2018. Four main domains, twenty-eight subdomains.
Who it applies to	Government entities and their contractors, and operators of critical national infrastructure; widely adopted as a baseline by other regulated organizations

Capability mapping

Data security requirements and how Siberson supports them

Only requirements with a defensible technical relationship to the platform are listed. No control identifiers are cited.

Regulatory requirement to Siberson capability mapping
Regulatory requirement	Security objective	Siberson capability	Product
Identifying and protecting information assets	Know which information assets exist and how sensitive each one is	Discovery across structured and unstructured repositories, feeding an inventory that stays current as new data appears	Siberson Veriket Data Discovery
Information classification and handling	Apply a consistent classification scheme and make handling rules follow it	Configurable classification levels held in metadata and shown as visible markings, applied automatically or by the user	Siberson Veriket Data Classification
Preventing data leakage	Stop sensitive information leaving through uncontrolled channels	Endpoint enforcement across e-mail, web, removable media, print and clipboard, driven by the classification label rather than pattern matching alone	Siberson Verikor DLP
Integrity and event monitoring	Detect unauthorized change to critical files and configurations and retain the record	Real-time file and registry monitoring combined with scheduled baseline comparison, with alerting into existing operations	Siberson Verifim File Integrity Monitoring

The platform

Products referenced on this page

Siberson Veriket Data Discovery

Siberson Veriket Data Discovery helps enterprises identify sensitive and regulated information across structured and unstructured data environments.

Find out more

Siberson Veriket Data Classification

Siberson Veriket Data Classification helps organizations classify and label sensitive information according to enterprise and regulatory data handling policies.

Find out more

Siberson Verikor DLP

Siberson Verikor DLP is an enterprise Data Loss Prevention solution designed to help organizations protect sensitive information and enforce data security policies across enterprise environments.

Find out more

Siberson Verifim File Integrity Monitoring

Siberson Verifim File Integrity Monitoring helps organizations detect unauthorized changes to critical files and improve security monitoring and auditability.

Find out more

FAQ

NCA ECC — questions & answers

What are the NCA Essential Cybersecurity Controls?

The Essential Cybersecurity Controls are the minimum cybersecurity requirements issued by Saudi Arabia's National Cybersecurity Authority. The current edition, ECC-2:2024, is organized into four main domains and twenty-eight subdomains covering governance, defence, resilience and third-party cybersecurity.

Which organizations are subject to NCA ECC?

The controls apply to government entities and their contractors and to operators of critical national infrastructure. Many other regulated organizations adopt them as a cybersecurity baseline even where they are not directly in scope.

How does DLP relate to the ECC data protection objectives?

Data leakage prevention is the enforcement half of information protection: classification records how sensitive something is, and DLP decides what may happen to it at the moment of transfer. Siberson Verikor DLP applies that decision on the endpoint across e-mail, web, removable media, print and clipboard.

How can file integrity monitoring support ECC monitoring requirements?

Siberson Verifim File Integrity Monitoring detects unauthorized changes to critical files, folders and Windows registry keys and produces records intended to support audit and investigation. It combines real-time monitoring with scheduled baseline comparison so that change occurring while an agent was stopped is still surfaced.

Primary sources

Regulatory sources

Last reviewed: August 2026

Regulatory applicability varies by organization, industry and deployment. Siberson provides technical security capabilities and does not constitute legal or regulatory advice. Siberson is not certified, approved or endorsed by any authority named on this page.

Build your GCC data security compliance strategy

Map your discovery, classification, DLP and integrity monitoring capabilities against the requirements relevant to your operations.

Request a Demo