NCA ECC-2:2024 Explained: What Changed from ECC-1:2018

Structure Growth: ECC-1 to ECC-2

ECC-1:2018 used 5 main domains, 29 subdomains and 114 controls. ECC-2:2024 moves to 4 domains, 28 subdomains, 108 main controls and 92 subcontrols. The Industrial Control Systems domain that appeared in ECC-1 is no longer embedded in ECC; operational technology is covered by NCA’s separate OT control set where that programme applies.

Practically, programmes that still cite “5 ECC domains” or ECC-1 control IDs need a remapping exercise before self-assessment or field review.

High-Level Theme Updates

• Cloud and third parties — Domain 4 elevates third-party and cloud computing cybersecurity as a first-class domain rather than a peripheral annex.
• Logging and monitoring — Defense subdomain 2-12 (Cybersecurity Event Logs and Monitoring Management) remains a frequent assessment focus, with continuous monitoring and multi-month retention expectations.
• AI and modern workloads — ECC-2 reflects contemporary risk themes (including AI/cloud-oriented governance and defense expectations at a thematic level). Confirm exact control wording in the published ECC-2:2024 text rather than relying on secondary summaries.
• Resilience — Continuity and recovery themes sit in the Cybersecurity Resilience domain, separate from day-to-day Defense controls.

What Teams Should Do Now

1. Replace ECC-1 control libraries with ECC-2:2024 domain/subdomain indexes.
2. Re-run gap assessment against the four domains and 108 main controls.
3. Re-validate 2-12 SIEM coverage, retention, and privileged/remote-access logging.
4. Scope OT separately under OTCC if industrial systems are in play.

How CyberSilo Helps

• CSA for NCA ECC maps ECC-2:2024 domains and controls to living evidence
• ThreatHawk SIEM + SOAR operationalises 2-12 logging and monitoring
• Workshops to remap dual NCA + SAMA programmes — see ECC vs SAMA CSF

Related Resources

NCA ECC hub · Self-assessment · Audit cycle · CSCC

Frequently Asked Questions

What is the structure of NCA ECC-2:2024?

ECC-2:2024 organises controls into 4 domains, 28 subdomains, 108 main controls, and 92 subcontrols.

Does ECC-2 still include a dedicated ICS domain?

No. ECC-1:2018’s fifth Industrial Control Systems domain is no longer part of ECC-2:2024; OT is addressed through separate NCA OT controls (OTCC) where applicable.

Should we remap ISO 27001 evidence to ECC-2 numbering?

Yes. Control libraries indexed to ECC-1 subdomain IDs are outdated and should be remapped to the ECC-2:2024 structure before assessment.