Saudi NCA Essential Cybersecurity Controls (ECC) Awareness Training

Opens by asking who would feel it first if your entity's e-services stopped. Walks through three events: Aramco's July 2021 statement that company data held by third-party contractors had been released; the faulty security product update of 19 July 2024, which Microsoft estimated affected about 8.5 million Windows devices; and the Verizon report of April 2025, with a third party involved in 30% of breaches, a human element in about 60% and ransomware in 44%. Draws three lessons: suppliers are part of your security, changes must be tested, and people are the first line of defence. Explains that the National Cybersecurity Authority issues the ECC as minimum requirements, that ECC-2:2024 updated ECC-1:2018, and its goals and four pillars. Introduces RST Digital Services Company, a worked example of a government-owned digital services company in Riyadh.

What you will be able to do

• Explain why the NCA issued the Essential Cybersecurity Controls and what ECC-2:2024 sets out
• Describe the lessons on suppliers, tested changes and people drawn from three recent events
• Name the three goals and four pillars the ECC takes into account

Why it matters

Gives employees, managers and suppliers in ECC scope a clear reason why the controls matter to the services they run, in every department.

Practice: Practice: Why the ECC · 3 questions

Describes the NCA as the Kingdom's national and specialised reference for cybersecurity, and the principle that no entity is relieved of responsibility for its own cybersecurity. Defines the scope: government agencies, their affiliated companies inside and outside the Kingdom, and private owners, operators and hosts of critical national infrastructure. Applies it to four cases, including RST Digital, a London affiliate, a private data centre and a Mumbai supplier reached through contract. Explains the statement of applicability, with cloud subdomain 4-2 as the example, and how the NCA checks ongoing compliance through self-assessment, compliance tool reports and field auditing visits. Lists the 2024 changes, from four domains and industrial control systems moving to the OTCC to wider Saudi staffing, MFA for privileged accounts, SPF, DKIM, DMARC and DDoS protection. Names the CCC, OTCC, CSCC and DCC and why the Arabic text is binding.

What you will be able to do

• Identify whether an organisation is in ECC scope from ownership, affiliation and infrastructure
• Explain how the NCA evaluates compliance through self-assessment, tool reports and field audits
• Describe the main changes from ECC-1:2018 to ECC-2:2024

Why it matters

Helps staff confirm on facts, not titles, whether the ECC applies to their entity, with evidence ready for NCA self-assessment or field audit.

Practice: Practice: The NCA and who must comply · 3 questions

Starts with the numbers from the ECC introduction, then names the four main domains: cybersecurity governance with ten subdomains, defence with fifteen, resilience with one, and third-party and cloud computing cybersecurity with two. Walks through every subdomain. Shows how to read 2-2-3-2 as domain, subdomain, main control and subcontrol, here multi-factor authentication for remote access and privileged accounts. Explains the page layout of objective, controls and subcontrols introduced with the words as a minimum, then the four-step pattern in identity and access management: identify, document and approve; implement; include the minimum list; review periodically. Uses e-mail protection, subdomain 2-4, as a worked page. Shows where a service desk agent, HR manager, project manager and procurement lead at RST Digital look first, the mistake of approved but unapplied policies, and the definitions of confidentiality, integrity, availability and authorised official.

What you will be able to do

• Name the four ECC domains and the number of subdomains in each
• Read a control number as domain, subdomain, main control and subcontrol
• Explain the define, implement, minimum list and review pattern most subdomains follow

Why it matters

Lets any employee find the controls that apply to their work and predict what an assessor will ask for, because approved is not implemented.

Practice: Practice: How the ECC is built · 3 questions

Begins with RST Digital's move from security inside IT to a separate cybersecurity department, showing why doing and checking are kept apart. Explains subdomain 1-1: a strategy approved and supported by the authorised official, carried out through an action plan and reviewed at planned intervals, with RST Digital's vision and multi-factor sign-in initiative as the example. Covers subdomain 1-2: a cybersecurity department independent from IT, all positions filled by full-time, qualified Saudi professionals, the Saudi Cybersecurity Workforce Framework, and a supervisory committee with a charter and minutes. Explains what counts as approval under the authority matrix. Sets out subdomain 1-3 on policies, procedures and technical security standards, and how staff acknowledgements become evidence. Covers subdomain 1-4 on roles, with a Dubai logistics firm where one engineer configured and audited the same firewall, and four questions to test governance.

What you will be able to do

• Explain what the ECC expects of the cybersecurity strategy and its action plan
• Describe why the cybersecurity department must be independent from the IT department
• Distinguish a policy, a procedure and a technical security standard

Why it matters

Prepares leaders, committee members and managers to set up and evidence ECC governance, from strategy approval to policy acknowledgements.

Practice: Practice: Strategy, department and policies · 3 questions

Compares two launches of the same app at RST Digital, one reviewed a week before go-live and one assessed at the start, to show why risk is assessed early. Explains subdomain 1-5: an approved risk methodology covering confidentiality, integrity and availability, and the four moments named in control 1-5-3, from early in projects to before new services are released. Shows one risk register entry for a citizen portal, with cause, rating, treatment, owner and date. Covers subdomain 1-6 on cybersecurity in project and change management, the minimum checks for software development, and a Mumbai software house copying an unchecked code library. Links change management to the July 2024 faulty update. Explains subdomain 1-7 on international commitments, and subdomain 1-8, where independent parties audit the controls under the Generally Accepted Auditing Standards and report to the committee.

What you will be able to do

• Identify the moments when the ECC requires a cybersecurity risk assessment
• Explain how cybersecurity requirements fit into project and change management
• Describe how periodic review and independent audit results are documented and reported

Why it matters

Helps project managers and buyers build security in before designs and contracts are fixed, avoiding late rework, and support independent audits.

Practice: Practice: Risk, projects, compliance and audit · 3 questions

Opens with a contractor account still working three weeks after the contract ended. Explains subdomain 1-9 and its three points: before employment, with cybersecurity responsibilities, non-disclosure clauses and screening for sensitive roles; during employment, with awareness and policy compliance; and at the end, with powers reviewed and revoked immediately. Follows four moments at RST Digital and an insurer in Toronto where an analyst kept finance access after moving to marketing. Links to the Verizon finding of a human element in about 60% of breaches, then sets out subdomain 1-10: a programme through multiple channels covering e-mail and phishing, mobile devices and storage media, browsing and social media, with a Sydney university badge photo example. Includes a phishing e-mail exercise, specialised training for cybersecurity staff, developers and executives, and four questions for measuring the programme.

What you will be able to do

• Describe the cybersecurity requirements before, during and at the end of employment
• Explain why access must be removed when a person changes role or leaves
• Name the four topics the ECC awareness programme must cover as a minimum

Why it matters

Gives HR teams and managers a joiner, mover and leaver discipline that closes forgotten accounts, and an awareness programme that builds habits.

Practice: Practice: People: HR, awareness and training · 3 questions

Starts with a count of the devices, accounts and badge each learner uses for work. Explains subdomain 2-1: an asset inventory, an acceptable use policy shown through four lines from RST Digital's, and classification, labelling and handling, with sensitive citizen data shared only through the approved secure transfer service. Covers subdomain 2-2: from single-factor authentication to multi-factor authentication for remote and privileged access, privileged access management and access reviews, with need to know, least privilege and segregation of duties defined. Lists the three kinds of authentication factor and uses a Singapore bank employee approving repeated prompts to show MFA fatigue. Sets out the five e-mail minimums in subdomain 2-4, including SPF, DKIM and DMARC. Covers subdomain 2-6 on BYOD, with a London manager's phone left in a taxi, and subdomain 2-14 on physical security.

What you will be able to do

• Explain how asset classification, labelling and handling decide how information is shared
• Apply need to know, least privilege and segregation of duties to access requests
• Recognise an unexpected sign-in prompt as a sign that a password has been stolen

Why it matters

Turns the ECC defence domain into daily habits that reduce account takeover, data leaks from lost devices and unauthorised entry to critical areas.

Practice: Practice: Everyday defences · 3 questions

Opens with the Verizon findings that exploiting a vulnerability was the way in for 20% of breaches and ransomware was present in 44%. Covers subdomain 2-3: malware protection, restricted storage media shown through a drive labelled salaries found in RST Digital's car park, patch management and clock synchronisation. Groups the nine network subcontrols of subdomain 2-5, including segmentation, secure browsing, intrusion prevention and the new protection against distributed denial of service attacks. Explains data protection by classification, the referral to the National Data Management Office, and the National Cryptographic Standards. Sets out backup and recovery testing, with a Hong Kong trading firm whose connected backups were encrypted by ransomware. Lists the five vulnerability management steps, linking patch testing to the July 2024 outage, then penetration testing of internet-facing services and web application firewalls, and why postponed updates leave a door open.

What you will be able to do

• Explain why patch management, restricted storage media and clock synchronisation matter
• Explain why backups must be kept apart from live systems and their restores tested
• Describe the five ECC vulnerability management steps and the scope of penetration testing

Why it matters

Helps staff support technical teams, and gives IT the ECC minimums on patches, backups and testing that an assessor is likely to ask about.

Practice: Practice: Technical defences · 3 questions

Compares two versions of the same intrusion, one with logs switched off and one watched around the clock, to show you can only respond to what you can see. Explains subdomain 2-12: logs on critical assets, privileged accounts and remote access, a SIEM, continuous monitoring and retention of at least twelve months. Distinguishes an event from an incident using the ECC definitions. Sets out subdomain 2-13: response plans and escalation, incident classification, reporting to the NCA, sharing indicators of compromise and threat intelligence feeds. Includes a ransomware screen exercise with four good-practice actions: stop, disconnect, report and preserve evidence, and a New York retailer clerk who hid a click. Covers subdomain 3-1 on resilience, with RST Digital's citizen portal outage handled through incident response and disaster recovery plans, and the mistake of a plan never exercised.

What you will be able to do

• Distinguish a cybersecurity event from an incident using the ECC definitions
• Apply stop, disconnect, report and preserve evidence when an incident appears
• Describe how incident response and disaster recovery plans keep critical e-services running

Why it matters

Ensures incidents are reported fast so the cybersecurity department can contain them and report to the NCA, with continuity plans tested in advance.

Practice: Practice: Detect, respond and recover · 3 questions

Links back to the Aramco contractor data release and the Verizon finding that third parties were involved in 30% of breaches. Explains subdomain 4-1, its three arrangements of IT outsourcing, cybersecurity outsourcing and managed services, and the contract minimum: non-disclosure and secure data removal, incident communication, and an obligation to follow the entity's requirements, shown through RST Digital's contract with its Mumbai software partner. Covers a risk assessment before signing and remote monitoring centres fully located in the Kingdom, with a cheaper bidder abroad turned down. Sets out subdomain 4-2: service and deployment models, protecting data by classification, returning it in a usable format and separating the entity's environment. Clarifies that ECC-2:2024 moved data localisation to the National Data Management Office at SDAIA. Uses an Abu Dhabi hospital group's unreadable records and an unapproved file-sharing service as examples.

What you will be able to do

• Identify the clauses the ECC expects in contracts with third parties
• Explain the extra requirements for outsourcing, managed services and remote monitoring centres
• Describe what the ECC requires of cloud and hosting providers, including data return

Why it matters

Prepares procurement and contract managers to involve cybersecurity early and agree security and exit terms in writing before any service starts.

Practice: Practice: Third parties and cloud · 3 questions

Follows a Sunday evening incident in which a help desk agent enters his password on a fake cloud provider page, then reports it within minutes. Shows the controls working together: awareness from subdomain 1-10, monitoring from 2-12 by a centre in the Kingdom as 4-1 requires, multi-factor authentication from 2-2, and reporting to the NCA from 2-13. Sets out what everyone, managers, leaders and specialists each do day to day. Revisits ongoing compliance and the NCA's three means of evaluation, with evidence from the implementation guide: the approved strategy, committee charter and minutes, policy acknowledgements and access review records. Warns against treating compliance as a yearly project, and gives long-term habits such as checking the NCA website. Answers three common questions on suppliers, deadlines and incident reporting, then lists five first-week actions and explains the thirty-question exam.

What you will be able to do

• Explain how several ECC subdomains work together during a single phishing incident
• Describe the cybersecurity duties of employees, managers, leaders and specialists
• Identify the evidence an entity uses to show ongoing ECC compliance

Why it matters

Leaves each learner clear on their ECC role and the records they create, so the entity can show ongoing compliance on any assessment day.

Practice: Practice: Your role, compliance and the exam · 3 questions