Stay Ahead of Threats.

NCA ECC 2-2024: What Saudi Businesses Must Know

Zyberon Security Team · 8 min read

The National Cybersecurity Authority (NCA) of Saudi Arabia released the second edition of its Essential Cybersecurity Controls (ECC 2-2024) as a mandatory baseline for all government entities and critical national infrastructure operators. Several controls now extend to private sector organisations that handle sensitive national data, making this a critical read for any KSA enterprise.

What Changed from ECC-1 to ECC 2-2024

• Asset Management: a continuously updated inventory of all digital assets, classified by criticality. Unknown assets are considered non-compliant.
• Identity and Access Management: privileged access governed by a formal PAM programme. MFA mandatory for all remote access and admin interfaces, without exception.
• Third-Party Risk: every technology vendor or MSP undergoes a formal cybersecurity assessment before onboarding, with annual reviews.
• Incident Response: plans tested at least annually through tabletop exercises, with retained evidence for auditors.
• Cloud Security: workloads hosted outside the Kingdom require explicit approval and must meet PDPL data residency requirements.

The ECC 2-2024 shift from guidance to obligation means organisations that treat compliance as optional now face formal enforcement, including fines, operational restrictions, and public disclosure of non-compliance.

The 5 Controls Most Organisations Are Failing

• Cyber Asset Register: ECC 2-2024 requires completeness with classification. If you can't list every device, application, and data store, you're not compliant.
• Privileged Access Management: shared admin accounts, undocumented service accounts, and no session recording are the three most common failures.
• Security Awareness Training: role-based, quarterly programmes with tracked completion and phishing simulation results, not annual one-hour sessions.
• Vulnerability Management: a formal patch cadence with critical vulnerabilities remediated within 15 days of disclosure.
• Supplier Risk Assessment: every SaaS tool, cloud service, and contractor with system access needs a documented security assessment.

Your 90-Day ECC 2-2024 Readiness Plan

• Days 1–30: gap assessment against all 114 ECC 2-2024 controls; classify gaps Critical, High, Medium; build a remediation register.
• Days 31–60: address all Critical gaps, typically PAM, MFA enforcement, and IR plan documentation. Stand up or engage continuous monitoring.
• Days 61–90: address High gaps, run a tabletop exercise, document evidence, prepare your audit pack.

Zero Trust Architecture: The Framework Every KSA Enterprise Needs

Zyberon Security Team · 7 min read

Traditional network security operated on a castle-and-moat model: everything inside the perimeter was trusted. In a world of remote work, multi-cloud data, and routinely compromised credentials, that model is actively dangerous. Zero Trust replaces the perimeter with identity: every request is treated as potentially hostile until explicitly verified.

The Three Pillars

• Verify Explicitly: authenticate and authorise every request using identity, device health, location, and behaviour. MFA is the minimum; adaptive authentication is the goal.
• Least Privilege: users and systems receive only the minimum permissions for their task, only for its duration. Persistent privileged access is eliminated.
• Assume Breach: design as if attackers are already inside. Encrypt everything, segment networks finely, and keep full audit logs.

Zero Trust is not a product you buy. It is an architectural philosophy you implement. The journey typically takes 12–24 months for a mid-market enterprise, but risk reduction begins on day one.

KSA Regulatory Alignment

• NCA ECC 2-2024: Zero Trust satisfies IAM, network security, and data protection controls simultaneously, making it the most efficient path to ECC 2-2024 maturity.
• SAMA CSF: the Protect domain maps directly to least-privilege and microsegmentation principles.
• PDPL: data classification and access controls form the technical foundation of purpose-limitation and data minimisation.

A Phased Journey

• Phase 1 — Identity (30–60 days): MFA everywhere, PAM for privileged accounts, eliminate shared credentials.
• Phase 2 — Devices (60–90 days): EDR on every endpoint, device health checks, MDM for mobile.
• Phase 3 — Network (90–180 days): microsegmentation, east-west inspection, identity-aware access.
• Phase 4 — Applications (180–365 days): application-layer access controls, SaaS visibility, API security.

Saudi Arabia's Digital Revolution and the Cybersecurity Imperative

Zyberon Security Team · 6 min read

Saudi Arabia stands at the frontlines of the world's digital revolution. With massive investment in digital infrastructure under Vision 2030, the Kingdom is transforming every sector at unprecedented pace. This creates enormous opportunity, and an expanding attack surface that threat actors have noticed.

The question for Saudi CIOs and CISOs is no longer whether to invest in cybersecurity. It is whether current investments are directed at the right controls, aligned to the right regulations, and delivering measurable risk reduction.

PDPL: The Compliance Reality

The Personal Data Protection Law is in full enforcement, with SDAIA actively investigating complaints and issuing fines. Every organisation that processes personal data of Saudi residents, regardless of headquarters, is subject to PDPL. The three most common violations Zyberon encounters during assessments:

• Missing lawful basis documentation: collecting personal data without documented consent, legitimate interest, or contractual necessity.
• Inadequate retention policies: personal data held indefinitely with no defined retention schedule or deletion process.
• Undisclosed third-party sharing: transfers to vendors, analytics platforms, or overseas processors without data subject awareness or contractual safeguards.

Building a Programme for Vision 2030

Organisations that treat cybersecurity as a compliance cost will struggle. Those that treat it as a strategic enabler, protecting the digital assets that drive Vision 2030 ambitions, will build durable competitive advantage. The framework has three components: governance, technology, and people.