NCA ECC vs SAMA CSF: Choosing the Right Framework for KSA Organisations

The National Cybersecurity Authority Essential Cybersecurity Controls (ECC-1:2018, updated periodically) is the baseline mandatory framework for government entities, critical national infrastructure, and organisations whose disruption would affect national interests in Saudi Arabia.

It defines 114 controls across five main domains: governance, defence, resilience, third-party cybersecurity, and industrial control systems. Compliance is mandatory, and entities are subject to NCA assessments and reporting obligations.

The Saudi Central Bank Cyber Security Framework is mandatory for all SAMA-regulated entities banks, insurance companies, finance companies, and payment service providers operating in the Kingdom.

It is structured around four domains (leadership and governance, risk management and compliance, operations and technology, third-party cybersecurity) and uses a maturity model where entities are expected to reach defined maturity levels within set timeframes.

Government bodies and CNI operators: NCA ECC is mandatory, and sector-specific extensions (such as ECC for cloud, OTCC for operational technology, CCC for critical systems) may also apply.

Banks, insurers, and financial institutions: SAMA CSF is mandatory. Most of these entities also fall under NCA ECC because finance is treated as critical national infrastructure, meaning both frameworks apply simultaneously.

Private sector outside financial services: NCA ECC applies if you operate critical infrastructure or process sensitive government data; otherwise the framework is strongly recommended as the de facto baseline.

NCA ECC is control-based. Each control is either implemented or not, with evidence required to prove implementation. Assessments check coverage and effectiveness of each control.

SAMA CSF is maturity-based. Each control area is rated on a scale (typically 1 to 5), and entities must demonstrate progression toward target maturity levels. Evidence must show not only that a control exists but that it operates consistently and is measured.

NCA ECC covers identity and access, data protection, cryptography, vulnerability management, incident response, business continuity, physical security, and third-party risk with a strong emphasis on national security considerations and sovereignty (data residency, cloud usage restrictions).

SAMA CSF goes deeper on financial-sector-specific risks: secure software development, online banking and payment channel security, cyber threat intelligence, fraud monitoring integration, and customer-facing service protection. It also places heavier weight on board-level accountability and KPI reporting.

NCA ECC requires periodic self-assessments submitted to the NCA, with on-site audits for higher-tier entities. Findings must be remediated within defined timeframes and reported back.

SAMA CSF mandates annual self-assessments, independent assessments at defined intervals, and ongoing reporting through SAMA's supervisory channels. Maturity ratings are tracked over time, and stagnation or regression triggers regulatory follow-up.

Both frameworks address governance, risk management, asset management, identity and access, vulnerability management, incident response, business continuity, and third-party risk. In practice, a single underlying control (for example MFA on privileged accounts) can satisfy requirements in both frameworks if it is documented, evidenced, and assessed against each.

This overlap is the single biggest opportunity for efficiency map once, evidence once, satisfy both.

NCA ECC enforces stricter requirements on data sovereignty, cloud usage approvals, and national-level incident reporting. SAMA CSF enforces stricter requirements on board oversight, maturity progression, fraud-related controls, and customer-channel security.

Treating them as identical leads to gaps; treating them as fully separate leads to wasted effort. The correct approach is unified governance with framework-specific overlays.

Running two parallel compliance programmes with separate teams, tools, and evidence repositories. Building control libraries that map to only one framework, forcing rework when the other is assessed. Treating SAMA CSF as a checkbox exercise instead of a maturity journey, leading to plateau at low maturity levels. Underestimating NCA ECC scope and discovering during assessment that subsidiaries or shared services were not included.

The most efficient model is a single Cyber GRC programme with a unified control library, where each control is tagged to the NCA ECC and SAMA CSF requirements it satisfies, evidence is collected once and reused, gap assessments run in parallel against both frameworks, and maturity scoring is layered on top for SAMA reporting.

This approach typically reduces compliance effort by 40 to 60 percent compared to managing the frameworks separately.

Waaqi (واقي) ships with pre-built control mappings for both NCA ECC and SAMA CSF, automated gap assessments against either framework, a single evidence repository that satisfies multiple controls simultaneously, maturity scoring aligned to SAMA's model, third-party risk management aligned to both frameworks' TPRM requirements, and executive dashboards that show posture per framework and overall.

Hosted in-Kingdom to satisfy data residency expectations for both regulators.

Phase 1: establish the unified governance structure, control library, and evidence model. Phase 2: complete a baseline NCA ECC self-assessment and remediate critical gaps. Phase 3: run a SAMA CSF maturity assessment, set target maturity levels, and build the roadmap. Phase 4: move to continuous compliance with automated evidence collection and quarterly maturity reviews.

This sequence ensures regulatory obligations are met first, then maturity is built systematically.

For most Saudi organisations especially in financial services the question is not NCA ECC or SAMA CSF, but how to manage both efficiently. A unified Cyber GRC programme delivers regulatory compliance, measurable maturity, and operational efficiency at the same time.

Want to see how Waaqi maps NCA ECC and SAMA CSF in one platform? Book a demo at www.waaqi.ai and get a tailored compliance roadmap for the Kingdom.