Short answer
NCA ECC 2024 changes centre on the new edition, ECC-2:2024, which replaces ECC-1:2018. It sets 4 domains, 28 subdomains, 108 main controls and 92 subcontrols, keeps governance, defence, resilience and third-party and cloud security, and leaves industrial control systems to the separate OTCC. Organisations should re-map their programme to the new numbering.
Key takeaways
- ECC-2:2024 has 4 domains, 28 subdomains, 108 controls and 92 subcontrols.
- Industrial control systems are covered by the separate Operational Technology Cybersecurity Controls.
- The cybersecurity function stays independent of IT and led by a qualified Saudi national.
- Re-map evidence to the new numbering rather than starting again.
The new structure
ECC-2:2024 groups its controls into four domains: cybersecurity governance (10 subdomains, from strategy and the cybersecurity function to audit and training), cybersecurity defence (15 subdomains, from asset and identity management to incident and threat management and web application security), cybersecurity resilience (business continuity) and third-party and cloud computing cybersecurity.
| Domain | Subdomains | Examples |
|---|---|---|
| 1 Governance | 10 | Strategy, cybersecurity function, policies, risk, periodic review, HR, awareness |
| 2 Defence | 15 | Assets, identity and access, systems, network, data, cryptography, backup, vulnerabilities, logs, incidents |
| 3 Resilience | 1 | Cybersecurity in business continuity |
| 4 Third party and cloud | 2 | Third-party cybersecurity; cloud computing and hosting |
What to update
Most of the control intent carries over from ECC-1:2018, so the work is mainly re-mapping. Update the control numbering in your register, check each control's wording against the 2024 text, and confirm subcontrols you previously treated as guidance. Industrial control systems controls now sit in NCA's Operational Technology Cybersecurity Controls (OTCC), so OT environments need that set as well.
Checklist
Moving to ECC-2:2024
0 of 6 done
ECC is one of several NCA control sets. Cloud, data, OT and critical systems controls (CCC, DCC, OTCC, CSCC) can apply on top of it.
Put this into practice on QULDEX
Frequently asked questions
How many controls are in NCA ECC-2:2024?
108 main controls and 92 subcontrols, in 4 domains and 28 subdomains.
Does ECC-2:2024 cover OT and industrial control systems?
Industrial control systems are covered by NCA's separate Operational Technology Cybersecurity Controls (OTCC), which apply alongside ECC for OT environments.
Do we need to restart our ECC programme for the 2024 edition?
No. Most control intent carries over, so re-map existing evidence to the new numbering, check tightened wording and re-run the self-assessment.
Sources
- Essential Cybersecurity Controls (ECC-2:2024), National Cybersecurity Authority
- National Cybersecurity Authority: regulatory documents, NCA
- ISO/IEC 27001:2022 Information security management systems, ISO