NCA ECC Compliance Audit and Reporting Cycle

Typical Audit and Reporting Cycle

1. Scope — Confirm which NCA control sets apply (ECC baseline; CSCC or other sets if critical systems, cloud, OT, etc. are in scope).
2. Self-assessment — Score against ECC-2:2024 domains and subdomains using the NCA toolkit and your control owners.
3. Evidence pack — Collect policies, configurations, SIEM retention proofs, incident samples, third-party clauses, and review minutes.
4. Remediation — Track gaps to owners and dates; re-test high-risk Defense and Resilience items.
5. Continuous improvement — Treat assessment as recurring — configuration drift and vendor change invalidate stale scores.

Evidence That Survives Review

• Board/management approval of cybersecurity strategy and roles
• Asset inventories tied to Defense subdomain 2-1
• IAM reviews and privileged-access logs
• 2-12 continuous monitoring with retention meeting published ECC expectations (commonly evidenced at least 12 months on CyberSilo ECC programmes)
• Incident tickets mapped to playbooks and lessons learned
• Third-party and cloud oversight artefacts under Domain 4

How CyberSilo Helps

• CSA organises ECC control status and evidence URLs for assessment windows
• ThreatHawk supplies continuous monitoring artefacts for 2-12
• Dual-framework packaging for financial entities also under SAMA — see ECC vs SAMA

Related Resources

ECC-2 changes · 2-12 logging · Contact

Frequently Asked Questions

Is NCA ECC certified by a commercial auditor like ISO 27001?

NCA programmes centre on national assessment and continuous improvement mechanisms rather than a commercial ISO-style certificate. Follow current NCA guidance and toolkit expectations.

What evidence do assessors usually expect?

Approved policies, ownership records, implementation proof per subdomain (including define–implement–minimums–review patterns), monitoring/retention evidence for 2-12, and remediation tracking.

Do you list fine amounts for ECC non-compliance?

No. Penalties and enforcement actions depend on entity type and current NCA authority. Use official NCA publications rather than secondary summaries for enforcement figures.