NCA ECC-1 deep-dive: what KSA AI vendors actually need to comply with in 2026

Why ECC sits where it does

NCA ECC is the single document a Saudi government CISO will hand you on the first call if you are trying to sell into a ministry, an authority, a state-owned enterprise, or a critical-infrastructure operator. It is published by the National Cybersecurity Authority, the executive body created by Royal Order in 2017 with regulatory authority over cybersecurity across government and the national critical sectors.⁵ ECC-1 v1.0 was issued in 2018 as the baseline standard.¹

In 2024, NCA published a new standard, ECC-2:2024, that supersedes ECC-1:2018. ECC-2 is the operative document a 2026 KSA buyer will hold you to.² Key changes documented in NCA’s announcement and legal-sector briefings include a reduced overall control count, structural reorganization, and expanded Saudization expectations across cybersecurity positions.²⁶

The controls are not optional. For in-scope entities — every government body, every critical-infrastructure operator (energy, water, telecom, transport, health, financial) — implementation is mandatory. The entities push the obligations down to their vendors through procurement clauses. If you are a foreign AI vendor selling into the Kingdom in 2026, your contract will require you to demonstrate ECC compliance, even if you are not directly regulated by NCA.

This is the layer most vendors underestimate. ISO/IEC 27001 and SOC 2 are necessary, but they are not sufficient. ECC has Saudi-specific requirements that those frameworks do not cover.

ECC-1:2018 — the historical baseline

ECC-1:2018 was organized into five main domains across 29 subdomains and 114 total controls.¹ The five domains were:

• Cybersecurity Governance — strategy, policies, roles, risk management, compliance.
• Cybersecurity Defense — asset management, identity, access, cryptography, network, applications, data protection, logging.
• Cybersecurity Resilience — business continuity, incident management, backup, disaster recovery.
• Third-Party and Cloud Cybersecurity — supplier risk, cloud services, hosted services.
• Industrial Control Systems (ICS) — OT, SCADA, ICS protocols.

The exact per-domain control counts vary across consultancy summaries, and the audit-trail of the NCA PDF is the only authoritative source — practitioners should pull the per-domain breakdown from the NCA PDF directly rather than relying on third-party tables.¹ The phrasing in our audit-log glossary entry and incident-response glossary entry maps to ECC logging and incident management controls directly.

Most AI vendors selling to KSA touch the governance, defense, resilience, and third-party domains. The ICS domain matters only if you are selling to an OT environment — an oil-and-gas operator, a power utility, a water utility, a refinery — in which case it is non-negotiable and you need OT security expertise on the team.

ECC-2:2024 — what changed

ECC-2:2024 replaced ECC-1:2018 as the operative NCA Essential Cybersecurity Controls standard. The widely-reported headline changes from the NCA-published PDF and from legal/consultancy briefings are:²⁶

• Reduced control count. ECC-2:2024 publishes a smaller control set than the 114 controls in ECC-1:2018, with public summaries citing figures in the ~108–110 range. Pull the exact figure from the NCA PDF for any procurement filing.²
• Structural reorganization. ECC-2:2024 restructures domains and subdomains relative to ECC-1.²
• Expanded Saudization. ECC-2:2024 expands the Saudization expectation to all cybersecurity positions, not only senior roles.⁶
• Data-localization treatment moved. In-Kingdom hosting mandates that had been read into ECC-1 are now treated through NDMO/SDAIA frameworks rather than ECC text itself.⁶

The practical implication for vendors: a 2026 compliance program should be designed against ECC-2:2024, with ECC-1 referenced only for historical context. If a procurement questionnaire still names ECC-1, the customer security team will accept ECC-2:2024 evidence — the converse is not true.

Mandatory vs recommended: what binds you

ECC reads as if all controls are mandatory for in-scope entities, and at the entity level that is correct. What is mandatory for you as a vendor depends on what data you touch and what role you play in the customer’s environment.

The framing below is Annota8’s editorial structuring of how ECC controls land in practice on a vendor — it is not NCA terminology. NCA’s own applicability statements live in the ECC PDF itself.¹²

• Always mandatory: Governance, access control, logging, incident response, encryption in transit and at rest, vendor risk management.
• Mandatory when you process Confidential or higher data: personnel security and background verification appropriate to role, processing-location requirements per NDMO classification, hardened endpoints, dedicated SOC coverage.
• Mandatory when you serve a critical-sector entity: 24x7 SOC with documented response SLAs, HSM-backed key custody aligned with NCS-1:2020 for high-classification data, network segmentation that passes NCA audit, ICS-specific controls if any OT integration exists.
• Frequently requested in procurement: Zero Trust Network Architecture, continuous control monitoring, automated evidence collection, threat-intel feed integration.

Cross-reference our ZTNA glossary entry and the HSM glossary entry for the technical detail.

Where foreign AI vendors usually fail

Four gaps recur in conversations with KSA buyer security teams. None of them is unsolvable, but each requires deliberate operational design — they cannot be retrofitted in a week before a procurement deadline.

Gap 1 — Personnel security for privileged staff. ECC personnel-security controls require background and identity verification appropriate to the role. For KSA-resident staff this typically uses Absher and adjacent national systems. For staff resident outside the Kingdom, the vendor needs verifiable checks from the staff member’s country of residence in line with the customer’s policy. ECC-2:2024 also expanded the Saudization expectation to cover all cybersecurity positions, not only senior ones — material for any vendor planning a KSA delivery team.⁶

Gap 2 — 24x7 SOC with documented evidence. A SOC tool subscription is not a SOC. NCA auditors expect tickets, shift rosters, escalation runbooks, mean-time-to-detect and mean-time-to-respond metrics, and a named analyst on call at any hour. See our SOC glossary entry. A small AI vendor can satisfy this through a managed-detection-and-response partner — there are several Saudi MSSPs and a handful of regional ones with the right footprint — but the contract has to be in place and the evidence has to have history. Six months of SOC tickets carries more weight than a license renewal dated last week.

Gap 3 — Timely breach notification to NCA. NCA operates a Cyber Incident Response framework with a dedicated reporting portal; in-scope entities are required to notify NCA via the portal, and vendors inherit the obligation through customer contracts.⁷ Specific timelines vary by sector and incident classification — practitioners should read the applicable sectoral directive rather than treat any single number as a universal SLA. PDPL adds a separate 72-hour notification to SDAIA for personal-data breaches; the timelines are different and you may have to fire both.³ Coordinating the two is the single hardest tabletop exercise foreign vendors run.

Gap 4 — HSM-backed key custody. ECC cryptography controls reference NCA’s National Cryptographic Standards (NCS-1:2020) for approved cryptographic standards. NCS-1 is where HSM expectations and FIPS 140-2/140-3 Level 3 surface for advanced or high-assurance use cases — vendor and NCA-aligned guidance commonly cite Level 3 HSM-backed key custody for high-classification workloads.⁸ Software key vaults do not pass. Cloud KMS satisfies this only if the underlying HSM has the right certification and the customer accepts the cloud model — many KSA customers do not, for high-classification workloads. Vendors selling into critical infrastructure typically end up either using an in-Kingdom cloud region’s HSM service or running their own HSM on customer premises. Our HSM glossary entry covers the practical procurement notes.

Gap 5 — Network segmentation and IAM that survives an audit. ECC expects segmented network zones with documented flows, role-based access with periodic recertification, MFA for privileged access, and audit logs retained for a defined period. See our IAM glossary entry. Most cloud-native AI vendors have flat networks and IAM roles that grew organically. The remediation work — drawing zones, writing flow policies, recertifying every privileged role, enabling MFA universally — typically takes a full quarter for a 50-person company.

A note on maturity scoring

ECC does not publish a formal 1–5 maturity scale in the public ECC-1 or ECC-2 text — the formal six-level (0–5) cyber-security maturity model used in KSA financial-sector compliance work belongs to SAMA’s Cyber Security Framework, the central bank’s framework, not to NCA ECC.⁹ If you see a vendor gap-assessment scoring ECC controls on a 1–5 scale, treat it as the consultancy’s editorial scoring lens, not an NCA artifact. For a procurement-grade self-assessment, score against the literal ECC control text and document evidence per control rather than a synthetic level.

For a small vendor, the right question is not “how do I hit Level 5” but “where are my gaps that will fail a procurement audit, and how do I close them in the next six months.”

How ECC interacts with SAMA CSF, NDMO, and PDPL

ECC is the baseline. Sector-specific frameworks stack on top.

SAMA CSF (Cybersecurity Framework) is the central bank’s framework for financial-sector entities — banks, insurers, payment companies, fintechs under SAMA. SAMA published its Cyber Security Framework v1.0 in May 2017; it is mandatory for SAMA-regulated entities and structurally similar to NIST CSF and ISO 27001 with finance-specific controls.¹⁰ A vendor selling to a Saudi bank must demonstrate ECC compliance and SAMA CSF compliance for the financial-sector controls. See our SAMA CSF glossary entry.

NDMO governs data classification and management. The data category determines which controls apply, where the data may be processed, and whether cross-border transfer is even legal. The exact classification labels should be matched against the NDMO Data Management standard directly before any contractual claim — public summaries vary in label choice. See NDMO data classification glossary.

PDPL governs personal data specifically. ECC covers cybersecurity; PDPL covers privacy. The two overlap in incident notification and access control but the obligations are distinct. PDPL imposes a 72-hour notification to SDAIA for personal-data breaches, with administrative fines up to SAR 5 million (doubled for repeats) and criminal liability up to two years’ imprisonment plus SAR 3 million for intentional disclosure of sensitive personal data.³ See PDPL compliance and our PDPL 2026 deep-dive.

NIST CSF is what most foreign vendors come in already aligned to. ECC maps reasonably well to NIST CSF, and you can use the mapping as a starting point — but treat it as a starting point only. The Saudi-specific requirements (Saudization, processing-location rules under NDMO, NCA notification channels, NCS-1 cryptographic standards, Arabic-language documentation in some cases) are not in NIST CSF. See our NIST CSF glossary entry.

What to implement first: a practical sequence

If you are starting from a NIST-CSF / ISO 27001 / SOC 2 baseline and you have a 6-month runway to a KSA contract, this is a defensible sequence:

1. Month 1 — Gap assessment against ECC-2:2024. Map your existing controls to the published ECC-2:2024 control set and identify the gaps. Plenty of Saudi consultancies do this; you can also do it internally if you have a security lead with KSA experience.
2. Month 1–2 — Governance and policy refresh. Update your information security policy, your acceptable use, your access policy, your incident response policy, and your supplier security policy to explicitly reference ECC-2:2024 and to satisfy the documentation evidence requirements.
3. Month 2–3 — Identity, access, and MFA. Get to MFA-everywhere, role-based access, periodic recertification, and privileged-access logging. This is the highest-leverage Tier-1 work and clears multiple controls at once.
4. Month 3–4 — SOC and logging. Either build a 24x7 SOC capability or contract one. Configure logging to satisfy retention and audit requirements. Start collecting evidence — tickets, runbook executions, MTTD/MTTR metrics — because evidence with history matters more than fresh evidence.
5. Month 4–5 — Encryption, key management, HSM. Inventory all cryptographic operations, move keys to an NCS-1-aligned HSM configuration, document the key-management lifecycle. This is where many vendors discover they need a cloud-region or on-prem HSM that they did not budget for.
6. Month 5–6 — Incident response, breach notification, third-party. Run a tabletop with the NCA portal-reporting flow and the 72-hour PDPL SDAIA notification clock. Update your vendor risk management to push ECC obligations to your sub-processors. Prepare the procurement evidence pack.

This is a compressed schedule. Nine months is more realistic; twelve is comfortable. The vendors who hit it in six were already at SOC 2 Type II with a mature security org going in.

For the procurement-side deliverables, see our security questionnaire response template and the government tender response playbook.

How this lands for an AI annotation and data-ops vendor

ECC was not written with AI annotation in mind, and that creates two specific challenges. First, annotation workforces are distributed and often international — personnel-security checks for every privileged annotator are a real cost, and ECC-2:2024’s expanded Saudization expectation tightens the local-talent requirement.⁶ Second, training data is frequently sensitive under NDMO classification, which can drive processing-location requirements that put parts of the work physically inside the Kingdom. The hybrid model — Cairo for Public / Internal data, KSA for Confidential and above — is the operationally honest answer.

How Annota8 is approaching this

Annota8 is in early-stage operations. We are not certified against ECC (and ECC is not a certification framework in the ISO sense — there is no NCA-issued certificate to hold up). Our approach is to design the workforce, data flows, and incident-response patterns toward the ECC-2:2024 control set, and we will share a gap-remediation roadmap with any KSA customer that requests it. This post is a practitioner’s reading of ECC-1:2018 and the superseding ECC-2:2024, not a regulatory filing.

References