NCA ECC
Essential Cybersecurity Controls (ECC-2:2024), National Cybersecurity Authority of Saudi Arabia
S3M supports seven NCA ECC-2:2024 controls with technical evidence. ConnGuard NAC discovers devices and grants access on need-to-know, CityGate and SpotGate segment networks and guest Wi-Fi, APNZone ties cellular devices to their SIM, and SAMI keeps audit-ready records of access events. The Arabic text of the controls is the binding one.
How S3M supports NCA ECC
Applies to: Saudi government organizations and their companies, and private-sector operators of critical national infrastructure. Read the official text
| Article / control | What it asks | How S3M supports it | Products |
|---|---|---|---|
| 2-1 Asset Management | Keep an accurate, current inventory of information and technology assets. | ConnGuard NAC discovers the devices on the network, managed, IoT or BYOD, which feeds the asset inventory. | |
| 2-2-3-3 | Authorize users on need-to-know, need-to-use, least privilege and segregation of duties. | ConnGuard NAC and CityGate give each identity network access only to what its policy allows. | |
| 2-5-3-1 | Isolate and segment networks logically or physically to control cybersecurity risks. | CityGate segments networks without VLANs, and SpotGate keeps guest traffic apart. Firewalls stay with your network team. | |
| 2-5-3-4 | Protect wireless networks with secure authentication, and connect them to the internal network only after a risk assessment. | ConnGuard NAC authenticates Wi-Fi users and devices with 802.1X, and SpotGate keeps guest Wi-Fi off the internal network. S3M does not provide Wi-Fi encryption. | |
| 2-6-3-2 | Control and restrict mobile device and BYOD use to what the business needs. | ConnGuard NAC admits BYOD devices by identity and posture, and APNZone binds cellular devices to their SIM. | |
| 2-12-3-2 | Turn on event logs for privileged accounts and for remote access. | SAMI keeps audit-ready records of who reached the network, with which device and when, including remote sessions. | |
| 2-12-3-4 | Monitor cybersecurity event logs continuously. | APNZone reports unauthorized SIMs and EndGuard reports posture changes, which give your monitoring team events to watch. |
S3M supports these requirements with technical controls. This is not legal advice or a certification; confirm legal questions with your counsel.
Checked against the official text on .
Frequently asked questions
Which version of the NCA controls does this page use?
ECC-2:2024, which replaced ECC-1:2018. Control numbers follow the English edition; the Arabic text is the binding one.
Does S3M cover the multi-factor controls in 2-2-3?
No. S3M does not provide multi-factor authentication. It supports 2-2-3-3, access on need-to-know and least privilege, at the network layer.
Does S3M keep logs for the 12 months that 2-12-3-5 asks for?
Retention depends on how your deployment is set up, so we do not list 2-12-3-5 in the table. Ask us about storage sizing for your log period.
Last updated