Saudi Arabia NCA ECC

National Cybersecurity Authority Essential Cybersecurity Controls: asset management, vulnerability management.


Short name	NCA ECC
Region	Middle East & Africa
Country or scope	Saudi Arabia
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers NCA ECC

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 18 controls from Safeguard's control catalog for NCA ECC.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for NCA ECC and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`SA-ECC-2-1` Asset Management	Entities must maintain an accurate and up-to-date inventory of information and technology assets, which for software means an inventory of components in use (NCA ECC Domain 2, Asset Management subdomain)	Scan
`SA-ECC-VULN` Vulnerability Management	Technical vulnerabilities must be identified and assessed periodically, requiring software components to carry identifiers matchable against vulnerability sources (NCA ECC Domain 2, Vulnerability Management subdomain)	Scan
`SA-ECC-PATCH` Patch Management	Security patches and updates must be applied in a timely manner, which requires knowing the version of each software component to determine applicability (NCA ECC Domain 2, Patch Management subdomain)	Scan
`SA-ECC-INTEG` Systems Protection and Integrity	Information system protection controls include safeguarding the integrity of deployed software, supported by cryptographic hashes for components (NCA ECC Domain 2, Information System and Processing Facilities Protection subdomain)	Scan
`SA-ECC-4-1` Third-Party Cybersecurity	Cybersecurity requirements must be applied to third parties and outsourcing arrangements, requiring the supplier of externally sourced software components to be known (NCA ECC Domain 4, Third-Party and Cloud Computing Cybersecurity)	Scan
`SA-ECC-DOC` Documented and Auditable Records	ECC compliance must be documented and subject to periodic review and audit; a dated, identifiable SBOM provides the auditable software-asset record (NCA ECC Domain 1, Cybersecurity Governance: periodical review and audit)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`ECC-1-1`	Establish a Cybersecurity Strategy and Programme
`ECC-1-2`	Define Cybersecurity Roles and Responsibilities
`ECC-1-3`	Establish Cybersecurity Policies and Procedures
`ECC-2-1`	Manage Cybersecurity Risk
`ECC-2-2`	Manage Cybersecurity in the Supply Chain
`ECC-2-3`	Manage Asset Cybersecurity
`ECC-2-4`	Manage Identity and Access
`ECC-2-5`	Protect Information Assets
`ECC-2-6`	Manage Vulnerabilities and Patches
`ECC-2-7`	Perform Cybersecurity Event Logging and Monitoring
`ECC-2-9`	Manage Cybersecurity Incidents
`ECC-2-12`	Manage Cybersecurity in Change Management
`ECC-2-13`	Ensure Business Continuity and Disaster Recovery
`ECC-3-1`	Secure Network Architecture
`ECC-4-1`	Govern Cybersecurity in Cloud Computing
`ECC-4-2`	Secure Industrial Control Systems
`ECC-5-1`	Manage Cybersecurity Compliance
`ECC-5-2`	Manage Cybersecurity Audit

Policy templates

Written for NCA ECC:

Enterprise Cybersecurity Policy (NCA ECC)
Identity, Access Management and Vulnerability Management Policy (NCA ECC)
Cybersecurity Incident Management and BCP Policy (NCA ECC)

And 22 from the standard set, adapted to NCA ECC.