NCA ECC
v2:2024ACTIVENCA Essential Cybersecurity Controls
Saudi Arabia's National Cybersecurity Authority Essential Cybersecurity Controls. Mandatory for government entities and critical infrastructure operators.
25
Total Controls
7
Domains
35
Cross-Framework Mappings
Saudi Arabia
Region
Cybersecurity Governance
حوكمة الأمن السيبراني41-1HIGH2 mappingsCybersecurity Policy
1-1HIGH2 mappingsCybersecurity Policy
Plain Language
Your organization must have a written cybersecurity policy approved by top management.
Implementation Guidance
Create a concise policy (10-20 pages) covering scope, objectives, roles. Get CEO/board sign-off. Review annually.
Evidence Examples
Signed policy document, board minutes, employee acknowledgment records.
1-2HIGH2 mappingsCybersecurity Roles and Responsibilities
1-2HIGH2 mappingsCybersecurity Roles and Responsibilities
Plain Language
A dedicated cybersecurity function must exist with clear roles and reporting lines.
Implementation Guidance
Appoint a CISO. Define reporting to C-suite. Create RACI matrix for security responsibilities.
Evidence Examples
Org chart, CISO appointment, RACI matrix, job descriptions.
1-3MEDIUM1 mappingCybersecurity in Project Management
1-3MEDIUM1 mappingCybersecurity in Project Management
Mapped to Other Frameworks
1-4HIGH1 mappingCybersecurity Awareness
1-4HIGH1 mappingCybersecurity Awareness
Plain Language
All employees must receive cybersecurity awareness training regularly.
Implementation Guidance
Conduct onboarding training, quarterly phishing simulations, and annual refresher courses.
Evidence Examples
Training attendance records, phishing simulation reports, quiz results.
Mapped to Other Frameworks
Cybersecurity Risk Management
إدارة مخاطر الأمن السيبراني32-1HIGH2 mappingsRisk Management
2-1HIGH2 mappingsRisk Management
Plain Language
Regularly identify, assess, and treat cybersecurity risks to your organization.
Implementation Guidance
Conduct annual risk assessments. Use ISO 27005 or similar methodology. Maintain risk register. Report to management.
Evidence Examples
Risk assessment reports, risk register, risk treatment plans, management reviews.
2-2HIGHAsset Management
2-2HIGHAsset Management
2-3MEDIUM1 mappingInformation Classification
2-3MEDIUM1 mappingInformation Classification
Mapped to Other Frameworks
Cybersecurity Operations
عمليات الأمن السيبراني43-1HIGH2 mappingsAccess Control Policy
3-1HIGH2 mappingsAccess Control Policy
Plain Language
Control who can access systems and data based on need-to-know and least privilege.
Implementation Guidance
Implement RBAC. Enforce least privilege. Require manager approval for access. Quarterly access reviews.
Evidence Examples
Access control policy, RBAC matrix, access review reports, privilege account inventory.
3-2HIGH1 mappingIdentity Management
3-2HIGH1 mappingIdentity Management
Mapped to Other Frameworks
3-3HIGH2 mappingsAuthentication
3-3HIGH2 mappingsAuthentication
3-4CRITICAL1 mappingPrivileged Access Management
3-4CRITICAL1 mappingPrivileged Access Management
Mapped to Other Frameworks
Cybersecurity Technology
تقنيات الأمن السيبراني54-1HIGH2 mappingsSecure Configuration
4-1HIGH2 mappingsSecure Configuration
4-2HIGH1 mappingMalware Protection
4-2HIGH1 mappingMalware Protection
Mapped to Other Frameworks
4-3HIGH2 mappingsVulnerability Management
4-3HIGH2 mappingsVulnerability Management
Plain Language
Regularly scan for and manage technical vulnerabilities, including timely patching.
Implementation Guidance
Weekly vulnerability scans. Patch critical vulns within 48h, high within 7 days. Subscribe to vendor bulletins.
Evidence Examples
Vulnerability scan reports, patch management records, SLA compliance, remediation tracking.
4-4HIGH2 mappingsSecurity Logging and Monitoring
4-4HIGH2 mappingsSecurity Logging and Monitoring
Mapped to Other Frameworks
4-5HIGH1 mappingNetwork Security
4-5HIGH1 mappingNetwork Security
Mapped to Other Frameworks
Incident Management
إدارة الحوادث45-1HIGH2 mappingsIncident Response Planning
5-1HIGH2 mappingsIncident Response Planning
Plain Language
Have a documented plan for detecting, responding to, and recovering from cybersecurity incidents.
Implementation Guidance
Create IR playbooks for common scenarios. Define escalation paths. Conduct tabletop exercises quarterly.
Evidence Examples
IR plan, playbooks, tabletop exercise reports, contact lists, post-incident reviews.
5-2HIGH1 mappingIncident Detection
5-2HIGH1 mappingIncident Detection
Mapped to Other Frameworks
5-3HIGH2 mappingsIncident Handling
5-3HIGH2 mappingsIncident Handling
5-4MEDIUM1 mappingLessons Learned
5-4MEDIUM1 mappingLessons Learned
Mapped to Other Frameworks
Business Continuity
استمرارية الأعمال26-1HIGH2 mappingsBusiness Continuity Planning
6-1HIGH2 mappingsBusiness Continuity Planning
6-2HIGH1 mappingDisaster Recovery
6-2HIGH1 mappingDisaster Recovery
Mapped to Other Frameworks
Physical Security
الأمن المادي37-1MEDIUM1 mappingPhysical Security Perimeters
7-1MEDIUM1 mappingPhysical Security Perimeters
Mapped to Other Frameworks
7-2MEDIUM1 mappingPhysical Entry Controls
7-2MEDIUM1 mappingPhysical Entry Controls
Mapped to Other Frameworks
7-3MEDIUM1 mappingPhysical Security Monitoring
7-3MEDIUM1 mapping