NCA Essential Cybersecurity Controls: Simple Explanation
114 controls across 5 domains. We explain the most important controls for hosting providers and tech companies — without complex jargon.
Essential Controls: What NCA Actually Requires
The National Cybersecurity Authority issued the Essential Cybersecurity Controls (ECC-1:2018) as a mandatory framework for all government entities and companies handling government data or critical infrastructure. This article details the actual requirements and explains how to implement them practically on your digital infrastructure.
Who Do These Controls Apply To
NCA controls are mandatory for:
- All government entities without exception
- Companies operating critical infrastructure such as energy, water, and telecommunications
- Service providers to government entities
- The financial sector alongside SAMA requirements
- Any entity processing or storing government data
If you are a technology company building systems for government entities, you are bound by these controls even as a private company.
Domain One: Cybersecurity Governance
This domain requires a clear institutional framework:
Cybersecurity Policy
- Written document approved by the highest authority in the organization
- Updated annually at minimum
- Covers all aspects of cybersecurity
- Distributed to all employees
Cybersecurity Strategy
- Multi-year plan with measurable objectives
- Dedicated cybersecurity budget
- Annual review and update based on changes
Roles and Responsibilities
- Appointment of a cybersecurity officer at the executive level
- Clear separation between operational and security responsibilities
- Responsibility matrix defined for each control
Cyber Risk Management
- Comprehensive risk assessment annually at minimum
- Updated risk register with threats and vulnerabilities
- Treatment plans with specific implementation dates
Domain Two: Cybersecurity Defense
Identity and Access Management
| Control | Details |
|---|---|
| Two-factor authentication | Mandatory on all critical systems and administrative accounts |
| Least privilege | Every user receives minimum access only |
| Permission review | Every 90 days maximum |
| Access logs | Retained for 12 months minimum |
| Dormant accounts | Disabled after 90 days without use |
Encryption
- TLS 1.2 minimum for all connections with TLS 1.3 preferred
- Sensitive data encrypted at rest using AES-256 standard
- Encryption key management through a dedicated system
- Key rotation every 90 days
Network Security
- Network segmentation into isolated security zones
- Firewall between each zone
- Intrusion Detection System on critical networks
- 24/7 traffic monitoring
Domain Three: Cybersecurity Resilience
Vulnerability Management
- Comprehensive vulnerability scanning monthly at minimum
- Critical vulnerability remediation within 72 hours of discovery
- High vulnerability remediation within 30 days
- Annual penetration testing by an independent external party
Backup and Recovery
- Daily backup of all critical data
- Backup storage at a geographically separate location
- Quarterly restore testing at minimum
- All backups encrypted
- One full year retention for government data
Security Incident Management
- Defined and trained response team
- NCA notification within one hour of discovering a major incident
- Documentation of every incident with root cause analysis
- Lessons learned and procedure updates after each incident
Domain Four: Third-Party Security
Before Contracting
- Comprehensive security assessment of the service provider
- Verification of certifications and security standards
- Review of the provider's security policies
During the Contract
- Clear security requirements in the contract
- Right to audit the provider's practices
- Continuous monitoring of provider compliance
- Immediate notification of any security incident
Upon Exit
- Clear and scheduled data migration plan
- Confirmation of data deletion from the provider's systems
- Complete documentation of the exit process
Applying Controls to Infrastructure
What the Hosting Provider Must Offer
- Data center in Saudi Arabia with Tier III classification
- Free or supported SSL/TLS encryption
- Daily backup with various retention options
- Access logs available to the client
- Technical support that understands NCA requirements
What the Organization Must Provide
- Written and updated policies and procedures
- Regular employee training
- Periodic review of permissions and systems
- Tested and ready incident response plan
Cost of Compliance vs Non-Compliance
| Item | Annual Compliance Cost | Non-Compliance Cost |
|---|---|---|
| Saudi server | 3,450 to competitive pricing — pricing and plans | Fine up to 5 million SAR |
| Monitoring system | 1,200 to 5,000 SAR | Undetected breach |
| Penetration testing | 5,000 to 20,000 SAR | Undiscovered vulnerabilities |
| Training | Employee time | 90% of breaches start with human error |
CLOUD (cloud.net.sa) provides infrastructure compliant with NCA requirements. Saudi servers in certified data centers in Riyadh and Jeddah. Free SSL encryption. Daily backup. Local technical support that speaks your language and understands compliance requirements. Starting from competitive pricing — pricing and plans per year.
Get Started
Need a secure environment? Choose a protected server with DDoS protection and advanced firewall. Review our SLA and Privacy Policy.
