Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
108 controls across 4 domains from the NCA, a parallel framework from SAMA for banks, what a Saudi financial institution is actually accountable to, and how the two align.
Saudi Arabia runs two of the region's most actively enforced cybersecurity frameworks side by side, the National Cybersecurity Authority's Essential Cybersecurity Controls (ECC) and the Saudi Central Bank's own Cyber Security Framework (SAMA CSF), and for a regulated financial institution, both apply at once. Understanding how they actually fit together, rather than treating them as two separate compliance exercises, is what makes a scoped assessment actually useful.
The ECC is the National Cybersecurity Authority's foundational framework: the minimum cybersecurity requirements that in-scope Saudi organizations are expected to meet, covering governance, cyber defense, cyber resilience, and third-party/cloud cybersecurity. The current version, ECC-2:2024, restructures the standard into 4 main domains, 28 subdomains, and 108 main controls, a genuinely comprehensive baseline, not a light-touch checklist. It underpins the Kingdom's broader cybersecurity strategy and applies across government entities and critical-sector organizations, with related NCA frameworks (like the CSCC for cloud-specific controls) extending the same model into other contexts.
The Saudi Central Bank (SAMA) issues its own Cyber Security Framework specifically for the financial institutions it regulates, banks, insurance companies, and financing companies. SAMA CSF requires regulated entities to establish formal cybersecurity governance, implement both preventive and detective technical controls, and maintain real mechanisms for managing cyber risk on an ongoing basis, not just at audit time.
A typical Saudi bank answers to both regulators at once: SAMA as its primary financial regulator, and the NCA wherever its systems are classified as critical national infrastructure or hosted in Saudi data centers that fall under NCA's own scope. Recognizing the duplication risk this created, SAMA has aligned its CSF with the NCA's ECC specifically to reduce redundant reporting for institutions caught under both, but "aligned" doesn't mean "identical," and a testing program built only around one framework's control language can still leave real gaps against the other's specific expectations.
The practical takeaway is that a Saudi engagement needs to name which framework, or both, it's actually being scoped and reported against, the same way we approach Saudi Arabia's data protection regime as its own distinct scoping exercise rather than folding it into a generic GDPR-style template. For a financial institution specifically, that usually means mapping findings to both the NCA's control domains and SAMA's governance and technical-control expectations in the same report, not producing two disconnected documents. This is the same reasoning behind how we scope our Middle East security services more broadly, and it runs on the same manual testing methodology behind our core Penetration Testing and Security Consulting services, applied against the specific regulatory language a Saudi auditor or regulator will actually be checking evidence against. See our dedicated page on offensive security services in Riyadh for what that looks like for a Riyadh-based organization specifically.
Tell us about your environment and goals, we'll help you scope the right engagement.