If you operate in Saudi Arabia, you will hear the term ECC often. The Essential Cybersecurity Controls were issued by the National Cybersecurity Authority (NCA) as the baseline that government bodies and critical national infrastructure operators must meet. Many private companies adopt them because customers and regulators expect it.
The five main domains
The ECC is organised into five main domains. Knowing them helps you map controls to the teams that own them.
- Cybersecurity governance: strategy, policies, roles, risk management and awareness.
- Cybersecurity defence: asset management, identity and access, network security, email, endpoints, vulnerability management, penetration testing, logging and monitoring, and incident response.
- Cybersecurity resilience: business continuity and disaster recovery aspects of cybersecurity.
- Third-party and cloud computing cybersecurity: outsourcing, managed services and cloud hosting.
- Industrial control systems cybersecurity: protecting operational technology where it applies.
Where infrastructure teams feel it most
Most of the technical work sits in the defence and resilience domains. In practice that means a current asset inventory, segmented networks, multi-factor authentication for privileged and remote access, patch and vulnerability management, central logging, tested backups and a recovery plan that has actually been exercised.
A practical starting sequence
- Run a gap analysis against the controls that apply to you and record the results honestly.
- Fix the controls that reduce the most risk first: remote access, privileged accounts, backups and patching.
- Put evidence in one place. Auditors want logs, tickets, reports and test results, not only policies.
- Schedule a penetration test of internet-facing systems and the most critical applications.
- Review third parties and cloud services against the same expectations.
The NCA updates its frameworks, so always check the current published version and any sector-specific controls that apply to you. If you would like help turning the controls into a prioritised technical plan, email [email protected].