NCA ECC Event Logs and Monitoring (2-12): SIEM Requirements and Retention

What Assessors Look For

• Documented logging and monitoring requirements approved by the right authority
• Coverage map: critical assets → log sources → collectors → SIEM/analytics
• Privileged and remote-access visibility with integrity protections on logs
• Continuous monitoring / alerting — not batch review only
• Retention configuration and restore/sample evidence for the stated period
• Periodic review of the logging programme (define–implement–minimums–review pattern)

SIEM Design Notes for KSA

Pair NCA 2-12 with any SAMA CSF event-management expectations if you are a Member Organization. Align on the stricter retention and correlation outcomes so one SIEM design serves both. Prefer in-Kingdom or otherwise residency-appropriate storage where sector rules require it.

• On-site posts: SIEM for SAMA · SIEM services KSA · SIEM selection for NCA + SAMA

How CyberSilo Helps

• ThreatHawk SIEM + SOAR centralises collection, continuous monitoring, and retention evidence for 2-12
• CSA links SIEM artefacts to ECC control IDs for assessment packs
• MSSP options via ThreatHawk for teams that need operated SOC capacity

Related Resources

ECC checklist · Audit cycle · Contact

Frequently Asked Questions

What is ECC subdomain 2-12?

2-12 is Cybersecurity Event Logs and Monitoring Management under the Cybersecurity Defense domain. It requires identifying, implementing, continuously monitoring, and retaining cybersecurity event logs for critical assets and privileged/remote access.

How long should NCA ECC logs be retained?

Follow the retention period stated in the published ECC-2:2024 control text. CyberSilo ECC programmes commonly evidence at least 12 months of cybersecurity event-log retention for 2-12; confirm against the current official control wording.

Is a SIEM mandatory by name?

The official control text references SIEM as a relevant capability for meeting event-log and monitoring requirements. Centralised collection, continuous monitoring, and retention are the outcomes assessors look for.