NCA Compliance Automation: A Practical Guide

NCA's control sets have grown. ECC-2:2024 is the current version of the Essential Cybersecurity Controls for government entities and CNI operators, and since late 2025 NCNICC-1:2025 sets controls for private companies outside CNI. For IT teams already stretched thin, tracking 108 main controls across 4 domains by hand in spreadsheets is hard to keep up.

NCA compliance automation means using software to check, enforce and evidence ECC-2:2024 controls on a schedule, so the evidence is ready before the assessment instead of assembled under deadline. Most of that work sits in Domain 2, Cybersecurity Defense, which holds 61 of the 108 controls. That is where the bulk of your automatable effort lives, and where tooling returns the most.

Automation covers the repetitive technical work: configuration checks, policy enforcement, access reviews and evidence collection. Governance controls such as the strategy, the risk method, the committee charter and independent audits need human decisions. Tools can track those obligations and flag deadlines, but they cannot replace them.

This guide covers the ECC-2:2024 structure, which controls you can automate, how SMEs and startups should sequence their approach, what the tool landscape looks like, and how trio.so handles the endpoint layer.

What NCA ECC-2:2024 Requires and Why It Now Applies to You

If you already know ECC-2:2024's domain structure, skip ahead to Which ECC-2:2024 Controls You Can (and Cannot) Automate.

ECC-2:2024 is built on 4 domains, 28 subdomains, 108 main controls and 92 subcontrols. That is a restructure of ECC-1:2018, which had 5 domains, 29 subdomains and 114 controls; its industrial control systems domain moved to NCA's OTCC. If your team or GRC tool was mapped to the old version, re-map it, because the controls did not carry over one to one. The Saudi staffing rule also widened: all cybersecurity positions, not just the head and critical roles, must be held by full-time, qualified Saudis.

The Four ECC-2:2024 Domains

• Domain 1, Cybersecurity Governance: 10 subdomains, 35 controls. Strategy, the cybersecurity department and committee, policies, roles, risk management, projects, review and audit, HR and awareness.
• Domain 2, Cybersecurity Defense: 15 subdomains, 61 controls. Asset management, identity and access, systems and workstations, email, networks, mobile devices, data, cryptography, backup, vulnerabilities, penetration testing, logs and monitoring, incidents, physical security and web applications. This is the largest domain and the most automatable.
• Domain 3, Cybersecurity Resilience: 1 subdomain, 4 controls, on the cybersecurity side of business continuity and disaster recovery.
• Domain 4, Third-Party and Cloud Computing Cybersecurity: 2 subdomains, 8 controls, on contracts, outsourcing, managed services and cloud.

ECC is not a certifiable standard. There is no badge or certificate at the end of an assessment; NCA checks compliance through self-assessment, reports from its compliance tool and field audit visits. Build your program around keeping controls in place and evidenced, not around a certificate.

Who Must Comply Now

Two NCA sets define who has which obligations. ECC-2:2024 applies to government agencies, their affiliated companies and entities inside and outside Saudi Arabia, and private entities that own, operate or host critical national infrastructure. The ECC itself states no penalty amounts; it rests on NCA's Statute and a High Order that require ongoing compliance.

NCNICC-1:2025 covers private companies outside CNI, as notified by NCA. Large entities (more than 250 staff or over SAR 200 million revenue) have 65 controls; small and medium entities (6 to 249 staff or SAR 3 to 200 million) have 26. For the full picture of who falls under which set, see our guide to NCA compliance.

Working through 108 controls is hard without a structured approach. Going domain by domain, starting with Domain 2 where automation carries the most weight, is where NCA compliance automation becomes the practical path.

Which ECC-2:2024 Controls You Can (and Cannot) Automate

Domain 2 holds 61 of ECC-2:2024's 108 controls, and many of them map to technical settings that software can enforce, check and evidence on a schedule. The aim is to cut manual work on the technical side so your team spends its time where judgment is needed. Choosing the right automated compliance software for your ECC program starts with knowing which controls are machine-friendly and which are not.

What You Can Automate

These seven areas are where automation tools do well across Domain 2.

1. Configuration Checks and Baseline Enforcement

• Check device and server configurations against your approved technical standards (ECC 1-3-3) on a schedule.
• Flag devices that differ from the approved configuration, and review hardening before changes go live (1-6-2).
• Tool types: device management (MDM/UEM) platforms, endpoint management solutions.
• If a configuration check shows unexpected failures after setup, first confirm your baseline was written for ECC-2:2024, not ECC-1:2018.

2. Patch Management and Vulnerability Remediation

• Track and deploy OS and application updates across Windows, macOS, Linux and mobile devices (2-3-3-3).
• ECC 2-10-3-4 asks you to verify patches in a non-production environment before they go live, so build a test group into the process.
• Tool types: vulnerability management and patch management platforms.

3. Evidence Collection and Audit Trails

• Scheduled, automatic capture of evidence (configuration exports, scan results, access review sign-offs) replaces spreadsheet collection.
• This is the highest-value use case for teams with scattered documents and gaps between technical controls and evidence records.

4. Compliance Status Tracking

• Compliance tools show which devices or systems pass or fail each check, so failures are found before the assessment rather than during it.
• When you first turn checks on, expect a backlog of configuration gaps nobody knew about. Plan a fix-up sprint before you schedule the first audit.

5. Identity and Access Policy Enforcement

• Domain 2 access controls include least privilege, MFA for remote access and privileged accounts, privileged access management and periodic access reviews (2-2-3).
• Tool types: identity and access management (IAM) and privileged access management (PAM) platforms.

6. Encryption and Device Security Policy Enforcement

• Enforce disk encryption and screen lock on laptops, phones and tablets, and keep entity data on mobile devices encrypted (2-6-3-1, 2-8-3-3).
• Encryption in transit is set on your network, email and web services, not on the device.
• Tool types: device management platforms for endpoints; network and application tools for data in transit.

7. Reporting and Compliance Dashboards

• Generate compliance reports with device-level results and progress by domain.
• Cuts audit preparation by keeping evidence ready instead of assembling it under deadline.
• Tool types: GRC platforms, device management platforms with built-in reporting.

What Automation Cannot Replace

Automation cannot replace governance, and mixing the two up leads to real gaps.

• Leadership and governance decisions. The strategy, the risk method, the committee charter and the governance structure need human sign-off from the Authorized Official. Tools can track status and flag overdue items, but they cannot author or approve these documents.
• Policy creation and review. The acceptable-use policy (2-1-3), the mobile device and BYOD rules (2-6-1) and the classification scheme (2-1-5) may start from templates, but people review and approve them before they take effect.
• Independent audits. Control 1-8-2 asks for review and audit by parties outside the cybersecurity department. Automation delivers the evidence package; it does not replace the auditor.
• Incident decisions and reporting. Incident response plans, escalation and reporting to NCA (2-13-3) need documented human decisions that tools support but cannot replace.

The right frame is not "automation is limited". Automation handles the large technical domain so your team's time goes to the decisions that need judgment. The tool does the checking; you make the calls.

NCA ECC-2:2024 Compliance Automation: Domain Coverage by Tool Type

How SMEs and Startups Should Approach NCA Compliance Automation

NCNICC-1:2025 brought small and medium private companies (6 to 249 staff, or SAR 3 to 200 million revenue) into NCA's scope, as notified by NCA. NCA compliance automation for a 40-person company looks different from a 500-person enterprise, and the approach should reflect that. You don't need to build every control on day one.

Start with an NCA compliance checklist to see your current gap before you buy any tool. The gap assessment tells you which controls are in place, which are missing and where your highest audit risk sits. That output drives the tool choice, not the other way round.

Download the NCA ECC checklist (PDF + Excel)

Start With What NCNICC-1:2025 Actually Requires of SMEs

The small and medium tier has a reduced set: 26 controls in 13 sub-components, against 65 for large entities and 108 main controls in the ECC. Law-firm summaries say some of the small and medium controls are recommended rather than mandatory, so read the NCNICC text (Arabic is binding) and mark each control before you plan. The risk for smaller organizations is over-engineering: building the full ECC before the NCNICC controls that apply to you are solid.

Smaller teams run lean compliance programs, which is why sequencing tools by impact, not by framework order, matters. The real bottleneck is often internal sign-off on the budget before the first assessment date.

The SME Automation Stack: What to Prioritize

NCA compliance automation for startups works best in order of impact. With a small team and a limited budget:

1. Device management for endpoint controls and configuration checks. Covers the device side of Domain 2 (inventory, encryption, screen lock, OS updates) and gives you a baseline from day one.
2. MFA through your identity provider. MFA for remote access and privileged accounts is one of the first things assessors check.
3. Backup with restore tests, and encryption. Backup and recovery (2-9) and cryptography (2-8) both sit in Domain 2.
4. A light self-assessment or GRC tool for governance documents. Covers the procedural controls in Domains 1 and 4 without an enterprise GRC platform.

A stacked approach, device management plus a light GRC or self-assessment tool, usually costs an SME less than a full enterprise GRC suite at this stage. If device results look inconsistent after you start, check whether all devices were enrolled before the first check ran; devices added later show gaps that may not be real failures.

The NCA Compliance Automation Tool Landscape

The market for NCA compliance software has grown since ECC-2:2024 was published. Four tool categories serve most organizations, and knowing the differences helps you avoid buying the wrong layer first.

1. Dedicated NCA GRC platforms. Mapped to ECC-2:2024 controls, usually in Arabic and English, with evidence and audit management built in; some add NCNICC-1:2025 modules. Confirm the platform maps to the 4-domain, 108-control structure of ECC-2:2024, not the older version.
2. Vulnerability and patch management tools. These handle the most technical Domain 2 controls and often sit inside a larger stack. Some include NCA ECC templates, which cuts the mapping work at setup.
3. Device management (MDM/UEM) platforms. These handle the device-level controls in Domain 2 and matter most for organizations with mixed or mobile fleets. For most endpoint-heavy organizations, device management is the logical starting point. See the next section for what trio.so does.
4. AI-assisted compliance platforms. A newer category offering gap analysis, policy drafting and vendor risk management in one interface. Vendor claims about how much they automate vary widely, so check the underlying control mappings carefully.

If you are moving from ECC-1:2018 tools, check whether your current tool has an ECC-2:2024 module. A tool still mapped to the old 5-domain framework will give you a misleading baseline, so re-run your gap assessment against the right version before you trust any automated score. The ECC is one part of a broader IT compliance program, and tools are best judged in that wider context. Banks that also follow SAMA's framework can read our SAMA compliance automation guide for the SAMA side.

How trio.so Helps With NCA ECC Compliance Automation

trio.so supports NCA compliance automation at the device and endpoint layer: the Domain 2 controls that land on laptops, desktops, phones and tablets. It manages Windows, macOS, Linux, iOS, iPadOS and Android devices from one console, which suits the mixed fleets common in Saudi organizations, and the console is available in Arabic as well as English.

Here is what that covers in practice:

• NCA ECC template: trio.so's compliance engine includes an NCA ECC (ECC-2:2024) template. It is off by default: you turn it on, see device results and export the evidence for your assessment.
• Device checks: the engine checks each enrolled device's settings, such as disk encryption, screen lock, host firewall, OS updates and secure boot. If a check fails, the device shows as failing so you can fix the setting through your device policies.
• Encryption and screen lock: trio.so enforces BitLocker on Windows, FileVault on Mac and encryption on phones, and sets passcode and screen-lock policies, which supports ECC's data protection and mobile device requirements at the endpoint.
• Lost devices and leavers: wipe a lost company-owned device remotely, or lock a lost Mac, iPhone, iPad or Android device, for ECC's mobile device requirement to delete entity data from lost devices (2-6-3-3). There is no wipe of personal (BYOD) devices.
• OS updates and vulnerabilities: OS update status per device, with CVE findings that carry CVSS, EPSS and KEV data.
• Inventory: a device inventory that includes installed apps on Windows, macOS, iOS and Android, for asset management (2-1).
• Evidence export: device results per framework that you can export for your self-assessment or audit.

The same engine has templates for other frameworks, including ISO 27001, SOC 2, PCI DSS and NIST. In each case it checks device controls, not the governance layers of the framework.

The template checks device settings only. It does not cover the governance, network, logging, testing, physical, continuity or third-party controls, and trio.so does not assess or certify ECC compliance. For the governance side, pair it with a light GRC or self-assessment tool.

One expectation to set up front: the first time the compliance engine checks a fleet, it often shows configuration failures nobody knew about. Plan a fix-up sprint before you export your first evidence; that first check reflects your actual state, which may differ from what was assumed.

Per-device pricing suits small and medium companies starting under NCNICC-1:2025 without an enterprise budget. Plans start at $5 per device. Learn more about trio.so's approach to compliance automation.

Start free trial Book a demo

14-day free trial. No credit card required.

Sources. Last reviewed October 2026 against ECC-2:2024, the current version on 27 October 2026. Control IDs and names are NCA's; every description is our own paraphrase, and the Arabic ECC text is binding. This article is guidance, not legal advice or an assessment. trio.so is not affiliated with or endorsed by NCA.

• NCA: Essential Cybersecurity Controls ECC-2:2024 (PDF)
• NCA: ECC page and implementation guide
• NCA: ECC-1:2018 (PDF)
• NCA: NCNICC-1:2025 (Arabic PDF)
• NCA: Telework Cybersecurity Controls TCC-1:2021 (PDF)
• NCA: Regulatory documents