NCA ECC Compliance Services for Saudi Arabian Organisations
Strengthen your cybersecurity posture with ECC-2:2024 compliance support. ValueMentor helps organisations assess gaps, implement controls and prepare evidence for NCA compliance assessments.
You are here:
Accredited by Globally Recognised Authorities
The ValueMentor Advantage
Move from Compliance Gaps to Demonstrable Cybersecurity Readiness.
Our Core NCA ECC Compliance Services
The NCA Critical Systems Cybersecurity Controls (CSCC-1:2019) extend the Essential Cybersecurity Controls (ECC), which are a prerequisite for CSCC compliance. The framework applies to critical systems whose failure or unauthorised access could negatively affect national security, the national economy, public services or businesses.
It comprises four domains, 21 subdomains, 32 main controls and 73 subcontrols. ValueMentor typically scopes CSCC alongside NCA ECC Compliance Services, with standalone engagements available where a specific requirement exists.
ECC-2:2024 – Four Key Domains
Ready to Strengthen Your NCA ECC Compliance Posture?
Our NCA ECC Compliance Process
Scoping & Applicability Confirmation
Determine regulatory applicability, define the assessment scope and identify relevant stakeholders and controls.
Gap Assessment & Control Mapping
Evaluate existing cybersecurity practices against applicable ECC-2:2024 controls and subcontrols.
Risk-Based Remediation Roadmap
Prioritise compliance gaps and establish an actionable implementation plan with defined responsibilities.
Control Implementation & Documentation
Strengthen cybersecurity controls and establish the required governance, policies and procedures.
Validation & Evidence Preparation
Validate control effectiveness, review supporting evidence and address outstanding deficiencies.
Self-Assessment & Continuous Compliance
Support NCA self-assessment activities and establish ongoing compliance monitoring and evidence management.
Build an ECC-Ready Cybersecurity Environment
Why ValueMentor
ValueMentor is registered with the National Cybersecurity Authority as a cybersecurity service provider in Saudi Arabia. We help organisations navigate regulatory requirements through structured assessments, practical control implementation and evidence-driven compliance support.
Our V-TRUST™ methodology combines regulatory expertise, PMO-led delivery and technology-enabled compliance management to help organisations establish sustainable cybersecurity practices.
With bilingual deliverables and ongoing advisory support, we help organisations move beyond compliance documentation towards effective cybersecurity governance.
V-Trust Methodology
PMO-Led Delivery
Faster Delivery Accelerators
Secusy & AI driven GRC platform
Client Retention
Rate
Rate
0
%+
Annual Compliance Assessments
0
+
Successful Assessments
Delivered
Delivered
0
+
Business Sectors
Served
Served
0
+
One partner across the NCA control family, registered to deliver cybersecurity services in the Kingdom.
FAQs
Who must comply with NCA ECC-2:2024?
A system whose failure or compromise could harm national security, the economy or essential services. Each organisation must identify and document its critical systems against NCA criteria.
What are the key changes in ECC-2:2024?
ECC-2:2024 replaced ECC-1:2018 with a revised structure of four domains, 28 subdomains, 108 main controls and 92 subcontrols. Organisations previously assessed against the 2018 edition should review and update their compliance baseline.
How does the NCA assess ECC compliance?
The NCA uses self-assessments, periodic compliance reporting and field audit visits to evaluate compliance. ECC is an ongoing regulatory obligation, not a certification programme.
Does ECC-2:2024 include Saudization requirements?
Yes. ECC-2:2024 includes requirements concerning qualified Saudi nationals in cybersecurity positions and the independence of the cybersecurity function from the IT and communications department. Organisations must address these requirements as part of their governance and compliance planning.
Can ISO 27001 or SAMA CSF evidence be reused for ECC compliance?
Yes. Existing ISO 27001 and SAMA CSF controls and evidence can be mapped against applicable ECC requirements. However, additional evidence may be needed to demonstrate compliance with specific ECC controls and subcontrols.
Is ValueMentor registered with the NCA?
Yes. ValueMentor is registered with the NCA as a cybersecurity service provider in Saudi Arabia and provides advisory and compliance support to organisations working towards ECC requirements.
Explore Our Latest Insights on NCA Regulations and Cybersecurity
Access expert perspectives on Saudi cybersecurity regulations, compliance frameworks and emerging security requirements.
See What Our Customers Say!
Fintech – Bahrain
Our team sincerely appreciates your effort, professionalism, and support throughout the NESA audit. Your guidance kept us on track and ensured success. It was a pleasure working with you, and we look forward to future collaborations.
Financial Tech – Bahrain
We would like to express our sincere appreciation for your service. Ever since we signed our contract, ValueMentor provided quality services, accepted tight schedules, conducted tests repeatedly till technical issues cleared, and handled internal parties and external vendor’s queries effectively. Thank you for your support!
Travel agency – UAE
Thank you for your hard work and dedication in achieving the PCI compliance timelines. Your commitment to excellence is sincerely appreciated.
Healthcare Tech – Bulgaria
Thank you team for cooperating with us for this penetration testing! Your quick and efficient work and responses are much appreciated. I am glad that even with the small setback in the beginning, we managed to meet the established deadline. We hope to work alongside you again in the future!
Healthcare Tech, USA
The effectiveness and quality of your services were evident throughout the project. Your team provided clear guidance, ensured that requirements were addressed appropriately, and helped us stay aligned with timelines.
Healthcare Tech – Texas, USA
The effectiveness and quality of your services were evident throughout the project. Your team provided clear guidance, ensured that requirements were addressed appropriately, and helped us stay aligned with timelines.
ECommerce – UAE
I want to thank the entire ValueMentor team for the continuous support provided; I’m happy to see that your level of commitment and professionalism is always at the top and that we have in ValueMentor a precious partner in supporting our business.
Commercial Bank – Africa
Allow me to extend our heartfelt appreciation to the ValueMentor project team for their dedicated support to us to achieve this objective. At the kick-off of this project, we emphasized the need to complete it within a short period. I am delighted to report that ValueMentor has exceeded our expectations as a partner in this regard.
Healthcare Tech
We are also very grateful that you managed to react so fast to our request and move things along quickly and efficiently in order to achieve the results before the Christmas holidays! Here’s to another successful VAPT!
Customer Experience (CX) Technologies, USA
ValueMentor transformed our complex and intimidating PCI DSS journey into a smooth, structured, and fully manageable process. Their clarity, guidance, and consistent support helped us achieve certification on time with complete confidence.
Hospital – UAE
I would like to extend my appreciation in helping and guiding us to a good ADHICS score. Special thanks to the team in doing a great job, spearheading on the ground, and closing the gaps.
Maritime Trade & Logistics – UAE
I would like to take this opportunity to thank you very much for your incredible support and patience throughout this assessment. We are extremely grateful for this achievement. Thanks for your professionalism and valuable advice. Looking forward to working together again!
Prepare Your Organisation for NCA ECC-2:2024 Compliance
Assess your cybersecurity posture, address control gaps and establish the evidence needed to demonstrate compliance with Saudi Arabia’s National Cybersecurity Authority.
Request a Consultation
We provide tailored security and compliance solutions designed around your business needs. Submit the form and our team will reach out to understand your requirements and guide you through the next steps.