Saudi Arabia Essential Cybersecurity Controls (NCA)
Saudi National Cybersecurity Authority mandatory controls for government entities and critical infrastructure. Requires protected logs for all national infrastructure.
What ECC-1:2018 draws on
This framework pulls on all three pillars — which is why running them as three separate tools means reconciling three sets of evidence at audit time.
Compliance
Security
What your auditor cites,
and what produces the evidence
The regulator's text is quoted below in italic, exactly as written. What follows each one is what the platform records, detects, or proves — not a claim about your compliance status, which no tool can confer.
Event Logging
Organizations MUST enable and protect logs for systems processing sensitive information.
A record of processing is only as good as the layer producing it. Real-time SQL auditing captures every statement against the data — the identity, the session, the client, the objects touched, the outcome — with no nightly batch window where activity goes unrecorded. Classification is what makes that a record of *regulated* data rather than a log of everything: it tells you which tables are in scope, so the register describes the processing you actually have to declare. Policy templates then produce it in the shape the framework asks for, instead of leaving you to assemble it from raw logs the week before an inspection.
Log Protection
Audit logs MUST be protected from unauthorized access, modification, and deletion.
Discovery locates every column holding a subject's data across every connected store, and the access history for that subject is reportable in minutes rather than reconstructed from tickets. The deletion or correction itself is executed by your application or your DBA — what the platform produces is the evidence of where the data was, who touched it, and that the change happened.
Log Review
Organizations MUST regularly review logs and generate reports on security events.
A record of processing is only as good as the layer producing it. Real-time SQL auditing captures every statement against the data — the identity, the session, the client, the objects touched, the outcome — with no nightly batch window where activity goes unrecorded. Classification is what makes that a record of *regulated* data rather than a log of everything: it tells you which tables are in scope, so the register describes the processing you actually have to declare. Policy templates then produce it in the shape the framework asks for, instead of leaving you to assemble it from raw logs the week before an inspection.
Time Synchronization
All systems MUST be synchronized to authoritative time sources for accurate logging.
A requirement like this is about the record surviving the person who would rather it did not, which means the audit trail has to be protected as carefully as the data. File activity monitoring hashes the datafiles, the transaction logs, the backups, and the audit trail itself with XXH3, then baselines them — so an alteration or a deletion is evident rather than inferred, and it is attributed to the session and OS user behind it. Because the same platform holds the query trail, a destructive statement and the file-level change it produced are two views of one event rather than two investigations.
Events are stamped from one synchronised source at the collector, so ordering across instances is reconstructable without reconciling timestamps host by host at audit time.
What ECC-1:2018 covers
This instrument defines no data category of its own. A control set for organisations. Data classification levels come from the separate Saudi NDMO data management framework, not from the ECC.
How ECC-1:2018 is enforced
Every figure below is the ceiling the instrument publishes about itself, not a prediction of what anything would cost. Enforced by The National Cybersecurity Authority of Saudi Arabia.
The Essential Cybersecurity Controls are mandatory for government entities and for organisations that own or operate critical national infrastructure. The Authority assesses compliance and reports it; the consequence of a poor assessment is directive and reputational rather than monetary, and it reaches procurement.
The Authority does not publish a penalty table. Treat the absence of a figure as an absence of published information, not as an absence of consequence.
Uncapped exposure that sits outside this instrument
These come from company law rather than from ECC-1:2018, and they are not penalties — they are liability for a loss, which is why nothing caps them at a published maximum.
Duty of oversight
Delaware, and followed in most US corporate jurisdictions. It is a rule of company law, not of any privacy or security statute.
Triggered by. A sustained or systematic failure by the board to establish a reporting system for a mission-critical risk — or, having one, consciously disregarding what it reported. The second limb is what a documented, unremediated finding goes to.
Who. Directors, in their personal capacity, in a derivative action brought on behalf of the company.
This is liability for the loss the company suffered, not a statutory penalty, so nothing caps it at a published maximum. A bad-faith finding also takes the conduct outside the exculpation and indemnification the charter would otherwise provide.
In re Caremark Int’l Deriv. Litig. (Del. Ch. 1996); Marchand v. Barnhill (Del. 2019); In re Boeing Co. Deriv. Litig. (Del. Ch. 2021).
Enforcement data reviewed August 2026. Several figures are indexed annually and move.
Built for ECC-1:2018,
not configured for it afterwards
NCA Logging Policy
Mandatory protected logs for national infrastructure databases
ECC-1 Compliance Report
Tamper-proof centralized log documentation for NCA
Sensitive Data Patterns
Identify Saudi government and infrastructure data
Security Event Notification
Per NCA guidelines alert and review capability
Other Critical Infrastructure frameworks
Walk into the ECC-1:2018 audit knowing the answer
228 cited requirements across 57 frameworks are mapped to the controls that evidence them. A fixed-fee gap assessment tells you which of them you can already prove today.