NCA Cybersecurity Controls Compliance
ECC and CCC gap assessment, policies, technical controls, evidence and ongoing support.
- Covers
- ECC-2:2024CCC-2:2024Gap assessmentPolicies & proceduresTechnical controlsEvidence & roadmap
- How we work
- Consultation → Gap assessment → Roadmap → Implement → Evidence → Keep compliant
A government or infrastructure client asks how you meet the NCA controls. Our fix: A gap assessment that answers control by control, with owners and dates.
See the common problemsDocuments exist, but nothing proves they work. Our fix: Procedures your team can follow, and evidence that they are applied.
See the common problemsWhich NCA frameworks apply to you, and how the ECC and the CCC fit together.
Read the essentialsAnswer 12 quick yes/no questions based on common ECC requirements. Get an indicative score and your top gaps.
Try the NCA readiness checkAnswer a few quick questions and a Skylius specialist will prepare practical recommendations.
Request a consultationNCA cybersecurity controls, implemented and evidenced.
We assess you against the NCA Essential Cybersecurity Controls (ECC) and, where you provide or use cloud services, the Cloud Cybersecurity Controls (CCC). Then we write the policies, implement the technical controls, prepare the evidence and keep you compliant as requirements change.
Take the 2-minute NCA readiness check →
Who it applies to
Who needs NCA cybersecurity controls?
The ECC is the national baseline set by the National Cybersecurity Authority. The CCC extends it for cloud computing. Whether they are mandatory for you depends on who you are and who you serve.
Government entities & their companies
Ministries, authorities and public bodies, and the companies and entities they own, inside or outside the Kingdom.
ECC mandatoryCritical national infrastructure
Private-sector organisations that own, operate or host critical national infrastructure.
ECC mandatoryCloud providers & tenants
Cloud service providers serving in-scope entities, and in-scope entities that use or plan to use cloud services.
CCC appliesSuppliers & service providers
In-scope entities must manage third-party cybersecurity, so their suppliers are often asked to meet requirements in the contract.
Often contractualSound familiar?
Why compliance stalls.
A client sent a controls questionnaire
A government or infrastructure client asks how you meet the NCA controls and you have no clear answers.
Policies on paper only
Documents exist, but nobody follows them and nothing proves they work.
Cloud use without clear controls
Microsoft 365, hosting or SaaS were adopted quickly, without the tenant controls in place.
No dedicated cybersecurity team
IT is stretched and nobody owns compliance, reviews or evidence.
ECC & CCC in brief
Know the controls before you start.
The baseline
Essential Cybersecurity Controls (ECC-2:2024)4 main domains, 28 subdomains, 108 main controls and 92 subcontrols: governance, defence, resilience, and third-party and cloud cybersecurity.
The cloud extension
Cloud Cybersecurity Controls (CCC-2:2024)Built on the ECC for cloud computing, with separate controls for cloud service providers and cloud service tenants.
Related NCA frameworks
Applied where your scope requires themCritical Systems (CSCC), Data (DCC), Operational Technology (OTCC), Telework (TCC) and Social Media Accounts (OSMACC) controls extend the ECC for specific cases.
Who checks compliance
NCA, your regulator or your clientNCA monitors compliance of entities in scope. Clients in scope may also require evidence from their suppliers.
ECC or CCC?
| ECC | CCC | |
|---|---|---|
| Purpose | Minimum cybersecurity requirements for national entities | Minimum requirements for cloud computing, as an extension of the ECC |
| Applies to | Government entities and their companies, and private-sector CNI owners, operators and hosts | Cloud providers serving in-scope entities, and in-scope entities using cloud |
| Relationship | The baseline | In addition to the ECC, not instead of it |
Our role, clearly: Skylius is an implementation and readiness partner. We are not NCA and we do not issue certificates or compliance decisions. We prepare your organisation and the evidence; assessment stays with NCA, your regulator or your client.
What we do
From gap to evidence, we do the work.
Six workstreams, one accountable team. You make the decisions; we build, implement and document.
Gap assessment
We confirm which frameworks and controls apply to you, then review each one against what you have today.
- Applicability and scope review: ECC, CCC and any related framework
- Control-by-control gap register with owners
- Risk-based priorities: critical gaps first
Start here: a short consultation tells you which controls are likely in scope.
Policies & procedures
We write the documents for you, tailored to how your organisation really works, and help you roll them out.
Approved, communicated and reviewed.
Who owns cybersecurity, and who approves.
Method, register and treatment.
Least privilege, MFA, access reviews.
Who reports what, and how fast.
Requirements in contracts and cloud use.
Technical controls implementation
Our engineers implement the controls themselves: configured, tested and documented so they hold up when reviewed.
Evidence preparation
We collect and organise the proof that each control is in place and working.
- Evidence mapped to each applicable control
- Recent, dated records, screenshots and reports
- Clear answers for questionnaires and self-assessments
- Internal review before anything is submitted
Remediation roadmap
Not everything can be fixed at once. We turn the gap register into a realistic plan your management can approve.
- Quick wins separated from projects
- Phases with owners, effort and dependencies
- Budget items identified early, vendor-neutral
- Progress tracked against the register
Ongoing compliance support
Compliance is not a one-off. We keep controls running and evidence current, and update you when NCA publishes new versions.
- Periodic reviews and access recertification
- Patching, monitoring and backup checks
- Evidence refreshed for the next review
- Updates when frameworks change
Bundle it: pair compliance with an IT maintenance contract so controls never drift.
How we work
A clear path, step by step.
Consultation
We learn your sector, clients and what is already in place.
Gap assessment
Every applicable control reviewed against your setup.
Roadmap
Gaps prioritised into an approved, phased plan.
Implement
Policies written, technical controls configured and tested.
Evidence
Proof collected and mapped to each control.
Keep compliant
Reviews, upkeep and updates as requirements change.
RealisticTimelines depend on your scope, how many gaps we find and how quickly decisions are made. We run workstreams in parallel where we can.
Deliverables
What you receive.
Which NCA frameworks and controls apply, and why.
Status, gap and owner for each control.
Phased plan with priorities and effort.
Written for you, ready to approve.
Access, MFA, endpoint, email, network, logging.
A maintained register of your technology assets.
Dated proof mapped to every control.
Short, practical training for your staff.
Reminders for periodic reviews and updates.
Interactive · NCA readiness check
How close are you to the NCA controls?
Answer 12 quick yes/no questions based on common ECC requirements. Get an indicative readiness score and your top gaps.
Do you have an approved cybersecurity strategy and policies that staff have acknowledged?Governance
Is there a named cybersecurity function or owner, separate from day-to-day IT operations?Governance
Do you run and review a documented cybersecurity risk assessment?Risk
Do you keep an up-to-date inventory of information and technology assets?Assets
Is MFA enforced for remote access, email and privileged accounts, with regular access reviews?Access
Is email protected with filtering and SPF, DKIM and DMARC on your domain?Email
Are networks segmented and protected by firewalls with reviewed rules?Network
Do you scan for vulnerabilities and patch on a defined schedule?Defence
Are security event logs collected, protected and monitored?Detect
Are backups protected and restore-tested?Resilience
Is there a written incident response procedure with clear owners?Respond
Do supplier and cloud contracts include cybersecurity requirements?Third party & cloud
Indicative only. Your exact scope depends on your entity type, sector and cloud use, which may add CCC or other NCA framework controls.
Your readiness score
Answer the questions to see where you stand.
Not started
Close these first
- Answer the questions to see your priorities.
Why Skylius
Practical compliance, delivered by engineers.
For more than 16 years, Skylius has delivered IT, network and security projects for companies across Saudi Arabia: over 2,500 projects for more than 2,000 clients.
Our own engineers configure the access, endpoint, email, network, logging and backup controls the frameworks call for.
No hand-offs between consultants, IT vendors and integrators. One accountable partner.
Policies and procedures tailored to how your organisation works, in clear language.
Based in Al Khobar and working on site across the Eastern Province and the Kingdom.
Ongoing support so controls keep running and evidence stays current.
Technology we work with
Proven platforms, chosen per control.
FAQ
Questions about NCA controls.
Have a different question about NCA compliance? A specialist will reply on WhatsApp.
The ECC is mandatory for government entities in the Kingdom, their companies and entities, and private-sector organisations that own, operate or host critical national infrastructure. NCA encourages other organisations to use it, and in-scope clients often pass requirements to their suppliers through contracts. We help you confirm where you stand.
The ECC is the baseline. The CCC (Cloud Cybersecurity Controls) extends it for cloud computing, with one set of controls for cloud service providers and another for cloud service tenants. If the CCC applies to you, you still need the ECC.
No. NCA’s CCC is the Cloud Cybersecurity Controls framework. Aramco’s CCC is the Cybersecurity Compliance Certificate its suppliers obtain under SACS-210. We support both; see our Aramco CCC page if Aramco or SABIC asked you for a certificate.
No. Skylius is not NCA, a regulator or an audit body. We assess, implement and prepare evidence. Compliance is assessed by NCA, your sector regulator or your client, depending on your situation.
We work with the current published versions, ECC-2:2024 and CCC-2:2024, and check NCA’s site for updates at the start of every engagement. If you implemented ECC-1:2018 earlier, we review your controls against the current version and fill the gaps.
Possibly. NCA also publishes controls for critical systems, data, operational technology, telework and organisations’ social media accounts. We include them in the applicability review when your systems, data or operations fall within their scope.
Not necessarily. We start with what you already have; many gaps close with configuration, procedures and evidence. Where a tool is genuinely missing, we recommend a right-sized, vendor-neutral option and explain why.
It depends on your scope, how many gaps the assessment finds and how quickly decisions are made. After the gap assessment you receive a phased roadmap with realistic timings.
NCA cybersecurity controls
Know where you stand against the NCA controls.
Tell us about your organisation and clients. We will confirm the likely scope and propose a clear plan for the gap assessment.
