The Saudi National Cybersecurity Authority developed the essential cybersecurity controls (ECC – 1: 2018) after conducting a comprehensive study of multiple national and international cybersecurity frameworks and standards. Reference: https://nca.gov.sa/en/legislation?item=191&slug=controls-list
Showing 114 controls
2-1-1
Cybersecurity requirements for managing information and technology assets must be defined, documented and approved.
2-1-2
The cybersecurity requirements for managing information and technology assets must be implemented.
2-1-3
Acceptable use policy of information and technology assets must be defined, documented and approved.
2-1-4
Acceptable use policy of information and technology assets must be implemented.
2-1-5
Information and technology assets must be classified, labeled and handled as per related law and regulatory requirements.
2-1-6
The cybersecurity requirements for managing information and technology assets must be reviewed periodically.
2-10-1
Cybersecurity requirements for technical vulnerabilities management must be defined, documented and approved.
2-10-2
The cybersecurity requirements for technical vulnerabilities management must be implemented.
2-10-3
The cybersecurity requirements for technical vulnerabilities management must include at least the following: 2-10-3-1 Periodic vulnerabilities assessments. 2-10-3-2 Vulnerabilities classification base...
2-10-4
The cybersecurity requirements for technical vulnerabilities management must be reviewed periodically.
2-11-1
Cybersecurity requirements for penetration testing exercises must be defined, documented and approved.
2-11-2
The cybersecurity requirements for penetration testing processes must be implemented.
2-11-3
The cybersecurity requirements for penetration testing processes must include at least the following: 2-11-3-1 Scope of penetration tests which must cover Internet-facing services and its technical co...
2-11-4
Cybersecurity requirements for penetration testing processes must be reviewed periodically.
2-12-1
Cybersecurity requirements for event logs and monitoring management must be defined, documented and approved.
2-12-2
The cybersecurity requirements for event logs and monitoring management must be implemented.
2-12-3
The cybersecurity requirements for event logs and monitoring management must include at least the following: 2-12-3-1 Activation of cybersecurity event logs on critical information assets. 2-12-3-2 Ac...
2-12-4
The cybersecurity requirements for event logs and monitoring management must be reviewed periodically.
2-13-1
Requirements for cybersecurity incidents and threat management must be defined, documented and approved.
2-13-2
The requirements for cybersecurity incidents and threat management must be implemented.
2-13-3
The requirements for cybersecurity incidents and threat management must include at least the following: 2-13-3-1 Cybersecurity incident response plans and escalation procedures. 2-13-3-2 Cybersecurity...
2-13-4
The requirements for cybersecurity incidents and threat management must be reviewed periodically.
2-14-1
Cybersecurity requirements for physical protection of information and technology assets must be defined, documented and approved.
2-14-2
The cybersecurity requirements for physical protection of information and technology assets must be implemented.
2-14-3
The cybersecurity requirements for physical protection of information and technology assets must include at least the following: 2-14-3-1 Authorized access to sensitive areas within the organization (...
2-14-4
The cybersecurity requirements for physical protection of information and technology assets must be reviewed periodically.
2-15-1
Cybersecurity requirements for external web applications must be defined, documented and approved.
2-15-2
The cybersecurity requirements for external web applications must be implemented.
2-15-3
The cybersecurity requirements for external web applications must include at least the following: 2-15-3-1 Use of web application firewall. 2-15-3-2 Adoption of the multi-tier architecture principle....
2-15-4
The cybersecurity requirements for external web applications must be reviewed periodically.
2-2-1
Cybersecurity requirements for identity and access management must be defined, documented and approved.
2-2-2
The cybersecurity requirements for identity and access management must be implemented.
2-2-3
The cybersecurity requirements for identity and access management must include at least the following 2-2-3-1 User authentication based on username and password. 2-2-3-2 Multi-factor authentication fo...
2-2-4
The Implementation of the cybersecurity requirements for identity and access management must be reviewed periodically.
2-3-1
Cybersecurity requirements for protecting information systems and information processing facilities must be defined, documented and approved.
2-3-2
The cybersecurity requirements for protecting information systems and information processing facilities must be implemented.
2-3-3
The cybersecurity requirements for protecting information systems and information processing facilities must include at least the following: 2-3-3-1 Advanced, up-to-date and secure management of malwa...
2-3-4
The cybersecurity requirements for protecting information systems and information processing facilities must be reviewed periodically.
2-4-1
Cybersecurity requirements for protecting email service must be defined, documented and approved.
2-4-2
The cybersecurity requirements for email service must be implemented.
2-4-3
The cybersecurity requirements for protecting the email service must include at the least the following: 2-4-3-1 Analyzing and filtering email messages (specifically phishing emails and spam) using ad...
2-4-4
The cybersecurity requirements for email service must be reviewed periodically.
2-5-1
Cybersecurity requirements for network security management must be defined, documented and approved.
2-5-2
The cybersecurity requirements for network security management must be implemented.
2-5-3
The cybersecurity requirements for network security management must include at least the following: 2-5-3-1 Logical or physical segregation and segmentation of network segments using firewalls and def...
2-5-4
The cybersecurity requirements for network security management must be reviewed periodically.
2-6-1
Cybersecurity requirements for mobile devices security and BYOD must be defined, documented and approved.
2-6-2
The cybersecurity requirements for mobile devices security and BYOD must be implemented.
2-6-3
The cybersecurity requirements for mobile devices security and BYOD must include at least the following: 2-6-3-1 Separation and encryption of organization's data and information stored on mobile devic...
2-6-4
The cybersecurity requirements for mobile devices security and BYOD must be reviewed periodically.
2-7-1
Cybersecurity requirements for protecting and handling data and information must be defined, documented and approved as per the related laws and regulations.
2-7-2
The cybersecurity requirements for protecting and handling data and information must be implemented.
2-7-3
The cybersecurity requirements for protecting and handling data and information must include at least the following: 2-7-3-1 Data and information ownership. 2-7-3-2 Data and information classification...
2-7-4
The cybersecurity requirements for protecting and handling data and information must be reviewed periodically.
2-8-1
Cybersecurity requirements for cryptography must be defined, documented and approved.
2-8-2
The cybersecurity requirements for cryptography must be implemented.
2-8-3
The cybersecurity requirements for cryptography must include at least the following: 2-8-3-1 Approved cryptographic solutions standards and its technical and regulatory limitations. 2-8-3-2 Secure man...
2-8-4
The cybersecurity requirements for cryptography must be reviewed periodically.
2-9-1
Cybersecurity requirements for backup and recovery management must be defined, documented and approved.
2-9-2
The cybersecurity requirements for backup and recovery management must be implemented.
2-9-3
The cybersecurity requirements for backup and recovery management must include at least the following: 2-9-3-1 Scope and coverage of backups to cover critical technology and information assets. 2-9-3-...
2-9-4
The cybersecurity requirements for backup and recovery management must be reviewed periodically.
1-1-1
A cybersecurity strategy must be defined, documented and approved. It must be supported by the head of the organization or his/her delegate (referred to in this document as Authorizing Official). The...
1-1-2
A roadmap must be executed to implement the cybersecurity strategy.
1-1-3
The cybersecurity strategy must be reviewed periodically according to planned intervals or upon changes to related laws and regulations.
1-10-1
A cybersecurity awareness program must be developed and approved. The program must be conducted periodically through multiple channels to strengthen the awareness about cybersecurity, cyber threats an...
1-10-2
The cybersecurity awareness program must be implemented.
1-10-3
The cybersecurity awareness program must cover the latest cyber threats and how to protect against them, and must include at least the following subjects: 1-10-3-1 Secure handling of email services, e...
1-10-4
Essential and customized (i.e., tailored to job functions as it relates to cybersecurity) training and access to professional skillsets must be made available to personnel working directly on tasks re...
1-10-5
The implementation of the cybersecurity awareness program must be reviewed periodically.
1-2-1
A dedicated cybersecurity function (e.g., division, department) must be established within the organization. This function must be independent from the Information Technology/Information Communication...
1-2-2
The position of cybersecurity function head (e.g., CISO), and related supervisory and critical positions within the function, must be filled with full-time and experienced Saudi cybersecurity professi...
1-2-3
A cybersecurity steering committee must be established by the Authorizing Official to ensure the support and implementation of the cybersecurity programs and initiatives within the organization. Commi...
1-3-1
Cybersecurity policies and procedures must be defined and documented by the cybersecurity function, approved by the Authorizing Official, and disseminated to relevant parties inside and outside the or...
1-3-2
The cybersecurity function must ensure that the cybersecurity policies and procedures are implemented.
1-3-3
The cybersecurity policies and procedures must be supported by technical security standards (e.g., operating systems, databases and firewall technical security standards).
1-3-4
The cybersecurity policies and procedures must be reviewed periodically according to planned intervals or upon changes to related laws and regulations. Changes and reviews must be approved and documen...
1-4-1
Cybersecurity organizational structure and related roles and responsibilities must be defined, documented, approved, supported and assigned by the Authorizing Official while ensuring that this does no...
1-4-2
The cybersecurity roles and responsibilities must be reviewed periodically according to planned intervals or upon changes to related laws and regulations.
1-5-1
Cybersecurity risk management methodology and procedures must be defined, documented and approved as per confidentiality, integrity and availability considerations of information and technology assets...
1-5-2
The cybersecurity risk management methodology and procedures must be implemented by the cybersecurity function.
1-5-3
The cybersecurity risk assessment procedures must be implemented at least in the following cases: 1-5-3-1 Early stages of technology projects. 1-5-3-2 Before making major changes to technology infrast...
1-5-4
The cybersecurity risk management methodology and procedures must be reviewed periodically according to planned intervals or upon changes to related laws and regulations. Changes and reviews must be a...
1-6-1
Cybersecurity requirements must be included in project and asset (information/ technology) change management methodology and procedures to identify and manage cybersecurity risks as part of project ma...
1-6-2
The cybersecurity requirements in project and assets (information/technology) change management must include at least the following: 1-6-2-1 Vulnerability assessment and remediation. 1-6-2-2 Conductin...
1-6-3
The cybersecurity requirements related to software and application development projects must include at least the following: 1-6-3-1 Using secure coding standards. 1-6-3-2 Using trusted and licensed s...
1-6-4
The cybersecurity requirements in project management must be reviewed periodically.
1-7-1
The organization must comply with related national cybersecurity laws and regulations.
1-7-2
The organization must comply with any nationally-approved international agreements and commiments related to cybersecurity.
1-8-1
Cybersecurity reviews must be conducted periodically by the cybersecurity function in the organization to assess the compliance with the cybersecurity controls in the organization.
1-8-2
Cybersecurity audits and reviews must be conducted by independent parties outside the cybersecurity function (e.g., Internal Audit function) to assess the compliance with the cybersecurity controls in...
1-8-3
Results from the cybersecurity audits and reviews must be documented and presented to the cybersecurity steering committee and Authorizing Official. Results must include the audit/review scope, observ...
1-9-1
Personnel cybersecurity requirements (prior to employment, during employment and after termination/separation) must be defined, documented and approved.
1-9-2
The personnel cybersecurity requirements must be implemented.
1-9-3
The personnel cybersecurity requirements prior to employment must include at least the following: 1-9-3-1 Inclusion of personnel cybersecurity responsibilities and non-disclosure clauses (covering the...
1-9-4
The personnel cybersecurity requirements during employment must include at least the following: 1-9-4-1 Cybersecurity awareness (during on-boarding and during employment). 1-9-4-2 Implementation of an...
1-9-5
Personnel access to information and technology assets must be reviewed and removed immediately upon termination/separation.
1-9-6
Personnel cybersecurity requirements must be reviewed periodically.
3-1-1
Cybersecurity requirements for business continuity management must be defined, documented and approved.
3-1-2
The cybersecurity requirements for business continuity management must be implemented.
3-1-3
The cybersecurity requirements for business continuity management must include at least the following: 3-1-3-1 Ensuring the continuity of cybersecurity systems and procedures. 3-1-3-2 Developing respo...
3-1-4
The cybersecurity requirements for business continuity management must be reviewed periodically.
5-1-1
Cybersecurity requirements related to Industrial Controls Systems and Operational Technology (ICS/OT) must be defined, documented and approved.
5-1-2
The cybersecurity requirements related to Industrial Controls Systems and Operational Technology (ICS/OT) must be implemented.
5-1-3
In addition to the applicable ECC controls from the main domains (1), (2), (3) and (4), the cybersecurity requirements related to Industrial Controls Systems and Operational Technology (ICS/OT) must i...
5-1-4
The cybersecurity requirements related to Industrial Controls Systems and Operational Technology (ICS/OT) must be reviewed periodically.
4-1-1
Cybersecurity requirements for contracts and agreements with third-parties must be identified, documented and approved.
4-1-2
The cybersecurity requirements for contracts and agreements with third-parties (e.g., Service Level Agreement (SLA) -which may affect, if impacted, the organization's data or services- must include at...
4-1-3
The cybersecurity requirements for contracts and agreements with IT outsourcing and managed services third-parties must include at least the following: 4-1-3-1 Conducting a cybersecurity risk assessme...
4-1-4
The cybersecurity requirements for contracts and agreements with third-parties must be reviewed periodically.
4-2-1
Cybersecurity requirements related to the use of hosting and cloud computing services must be defined, documented and approved.
4-2-2
The cybersecurity requirements related to the use of hosting and cloud computing services must be implemented. In line with related and applicable laws and regulations, and in addition to the applicab...
4-2-3
4-2-3-1 Classification of data prior to hosting on cloud or hosting services and returning data (in a usable format) upon service completion. 4-2-3-2 Separation of organization's environments (specifi...
4-2-4
The cybersecurity requirements related to the use of hosting and cloud computing services must be reviewed periodically.