Saudi Arabia. Cybersecurity. Regulatory controls
ECCNCA Essential Cybersecurity Controls (ECC)
In force
Partly verified
Low confidence.NCA pages loaded without readable control details; version numbers from prior knowledge.
§1Summary
- Synopsis
Baseline cybersecurity controls mandatory for government bodies, their companies and private operators of critical national infrastructure, covering governance, defence, resilience and third-party/cloud security.
- Key themes
- Unique features
Requires that hosting and storage of the organisation's data be within the Kingdom where cloud services are used.
- SaaS relevance
SaaS suppliers to Saudi government or CNI entities are flowed down ECC controls, including in-Kingdom hosting.
§2Obligations
- Extraterritorial
- Limited
- Cross-border transfers
- In-Kingdom hosting expected for covered entities' data
§3Dates
- Key dates
- Adopted
- In force
- ECC-1:2018; revised edition ECC-2:2024
§4Text and authority
- Text
- Authoritative text nca.gov.sa
- Authority
- National Cybersecurity Authority (NCA)
§5Where it applies
- Domestic law of
- Saudi Arabia
§6Sources and verification
- Sources consulted
- Verification
Low confidence.
Partly verified
Low confidence.NCA pages loaded without readable control details; version numbers from prior knowledge.