What Is NCA Compliance? NCA Frameworks and Requirements

NCA compliance means following the cybersecurity controls issued by Saudi Arabia's National Cybersecurity Authority (NCA). The core set is the Essential Cybersecurity Controls, ECC-2:2024, which binds government entities, their affiliated companies and private operators of critical national infrastructure (CNI). Private companies outside CNI have their own set, NCNICC-1:2025, and extra NCA sets cover cloud, telework, operational technology, critical systems, data and social media accounts.

This guide explains who must comply with which NCA requirements, how the framework family fits together, how NCA checks compliance and why there is no NCA certificate. It is written for IT and security leads at Saudi government bodies, banks and CNI operators.

What NCA Compliance Means

The National Cybersecurity Authority was set up by Royal Order No. 6801 in 1439H as the Kingdom's cybersecurity regulator. It issues binding control sets, policies and guidelines, and it checks that the entities in scope follow them. Article 10(3) of its Statute and High Order No. 57231 require those entities to keep "ongoing and continuous compliance", which is why NCA compliance is an ongoing program, not a one-off project.

NCA's documents are published in Arabic and English, and the Arabic version is binding. Everything lives on NCA's regulatory documents page; always check there for the latest version before you plan work.

Who Must Comply With NCA Requirements

Which NCA framework applies depends first on what your organization is, then on what it runs.

Within ECC scope, you apply every control that is applicable to you. Cloud subdomain 4-2, for example, applies only if you use or plan to use cloud or hosting services.

The NCA Framework Family

NCA describes most of its control sets as extensions of the ECC: you put the ECC in place first, then add the set for the technology or situation you have. Current versions as of October 2026:

The Telework Cybersecurity Controls matter to most IT teams: they apply to the same entities as the ECC and set concrete numbers, such as patches on mobile devices at least every month, telework systems patched at least every three months and backup restore tests at least every six months.

ECC-2:2024 at a Glance

ECC-2:2024 has 4 main domains (Governance, Defense, Resilience, Third-Party and Cloud), 28 subdomains, 108 main controls and 92 subcontrols. It replaced ECC-1:2018, which had 5 domains and 114 controls; the industrial control systems domain moved to OTCC. Several requirements are specific enough to plan around:

• A cybersecurity department independent of IT, and every cybersecurity position held by a full-time, qualified Saudi professional (1-2).
• An independent audit of your controls by people outside the cybersecurity department (1-8-2).
• MFA for remote access and privileged accounts (2-2-3-2).
• Cybersecurity event logs kept for at least 12 months (2-12-3-5).
• Managed security operations centers that use remote access based fully in Saudi Arabia (4-1-3-2).

Our NCA ECC compliance checklist lists all 108 controls with the evidence to keep, in a free PDF and Excel tracker.

Download the NCA ECC checklist (PDF + Excel)

NCNICC-1:2025 for Private Companies Outside CNI

The Non-CNI Private Sector Entities Cybersecurity Controls (NCNICC-1:2025) fill the gap the ECC left: private companies that are not CNI operators. The set has three components (Cybersecurity Governance, Cybersecurity Defense, and Third-Party and Cloud Computing Cybersecurity) and two tiers:

Law-firm summaries say the controls apply to these categories as notified by NCA, and that some small and medium controls are recommended rather than mandatory. Secondary sources date the adoption to 28 December 2025. We found no published compliance deadline as of October 2026. If you are a private company, don't assume the full ECC applies to you; check whether NCA has notified you under NCNICC.

How NCA Assesses Compliance

The ECC says NCA evaluates compliance through multiple means, such as self-assessment by the entity, periodic reports from NCA's compliance tool and field audit visits, as NCA sees fit. External evaluations run through NCA's Haseen e-service.

Inside your organization, control 1-8 asks for three things: the cybersecurity department reviews the controls periodically, parties outside that department audit them independently, and the results go to the cybersecurity supervisory committee and the head of the entity. That cycle produces most of what NCA will ask to see.

ECC-2:2024 says NCA will issue an assessment and compliance tool for it. In October 2026 the ECC page listed the document and an implementation guide but no tool, while the TCC, DCC and OTCC pages offer xlsx tools.

Is There an NCA Certification?

No. Nothing in the ECC describes a certificate, seal or badge, and NCA does not certify companies the way an ISO 27001 certification body does. Compliance is shown through the self-assessments, tool reports and audits above, and it has to be kept up, not earned once.

So treat "NCA certified" products and services with care. A vendor can say its product supports some controls; it cannot do your compliance work for you, and NCA does not endorse it. The same goes for trio.so: TrioSoft holds no NCA attestation of any kind.

What the ECC Says About Penalties

ECC-2:2024 states the duty to comply and its legal basis, but no penalties or fine amounts. We found no official NCA penalty schedule for ECC non-compliance, so treat any specific figure you see quoted with caution and ask NCA or your legal counsel. What is clear from the Statute is that no entity is relieved of responsibility for its own cybersecurity.

NCA and SAMA: Banks Often Face Both

Banks, finance companies and payment providers regulated by the Saudi Central Bank follow SAMA's Cyber Security Framework. If NCA treats your institution as critical national infrastructure, the ECC applies as well. No NCA or SAMA document we found says how the two relate or which takes precedence, so plan for both and confirm with your regulators. Many controls overlap, such as asset inventory, MFA, encryption, patching and logging, so one set of evidence can often serve both. Our SAMA CSF checklist covers the SAMA side.

Where to Start

1. Confirm which NCA sets apply: ECC or NCNICC first, then TCC, CCC, OTCC, CSCC, DCC and OSMACC for what you run.
2. Download the current documents from nca.gov.sa and note that the Arabic text is binding.
3. Run a gap analysis control by control, with an owner and evidence for each row.
4. Fix the structural items first: the independent cybersecurity department, Saudi staffing, the supervisory committee and approved policies.
5. Set up the review cycle under 1-8 and a calendar for the recurring work.

Tools can take over the repetitive evidence work on the technical side; our guide to NCA compliance automation covers what can and can't be automated.

Where trio.so Fits

Most of the ECC is governance, network, logging, testing, continuity and third-party work, and trio.so does none of that. It is device management software for Windows, macOS, Linux, iOS, iPadOS and Android, and it supplies device evidence for several controls, most of them in the Defense domain:

trio.so's compliance engine includes an NCA ECC (ECC-2:2024) template. It is off by default: you turn it on, see device results and export the evidence for your assessment.

• Disk encryption on laptops (BitLocker on Windows, FileVault on Mac) and encryption on phones, with status per device.
• Screen lock and passcode policies.
• Host firewall status on Mac, Windows and Linux.
• OS update status per device, with CVE findings that carry CVSS, EPSS and KEV data.
• Secure boot status.
• Device inventory, including installed apps on Windows, macOS, iOS and Android.
• Wipe a lost company-owned device remotely, or lock a lost Mac, iPhone, iPad or Android device; there is no wipe of personal (BYOD) devices.
• Evidence export for your self-assessment, NCA reports or audit.
• A console in Arabic as well as English.

The template checks device settings only. It does not cover the governance, network, logging, testing, physical, continuity or third-party controls, and trio.so does not assess or certify ECC compliance. Learn more about compliance automation. Plans start at $5 per device.

Start free trial Book a demo

14-day free trial. No credit card required.

Sources. Last reviewed October 2026 against ECC-2:2024, the current version on 27 October 2026. Control IDs and names are NCA's; every description is our own paraphrase, and the Arabic ECC text is binding. This article is guidance, not legal advice or an assessment. trio.so is not affiliated with or endorsed by NCA.

• NCA: Regulatory documents
• NCA: Essential Cybersecurity Controls ECC-2:2024 (PDF)
• NCA: ECC page and implementation guide
• NCA: NCNICC-1:2025 (Arabic PDF)
• NCA: Telework Cybersecurity Controls TCC-1:2021 (PDF)
• NCA: Cloud Cybersecurity Controls (CCC)
• NCA: Operational Technology Cybersecurity Controls (OTCC)
• NCA: Critical Systems Cybersecurity Controls (CSCC)
• NCA: Data Cybersecurity Controls (DCC)
• NCA: Organizations' Social Media Accounts Cybersecurity Controls (OSMACC)
• NCA: External Evaluations e-service (Haseen)
• SAMA Rulebook: Cyber Security Framework