What is the main difference between NCA ECC and SAMA CSF?

NCA ECC-2:2024 is a national framework applicable to all government entities and critical infrastructure operators in Saudi Arabia, including financial institutions. SAMA CSF v1.0 is a sector-specific framework that applies exclusively to SAMA-regulated entities (banks, insurers, finance companies, payment providers). SAMA CSF is generally more prescriptive, with detailed sub-controls for financial services operations, while NCA ECC has broader coverage including AI governance and cloud security.

Can a financial institution use one set of controls for both NCA ECC and SAMA CSF?

Yes, for approximately 70% of controls. The most effective strategy is to use the more stringent SAMA CSF requirements as the baseline and add NCA-specific overlays for areas like AI governance and cloud registry management. A compliance automation platform is essential for maintaining dual-mapped evidence without duplicating effort.

Which framework has stricter incident response requirements?

NCA ECC-2 requires critical incident notification within 1 hour, while SAMA CSF requires 2 hours. NCA also mandates a preliminary report within 24 hours and a final report within 14 days, whereas SAMA requires a root cause analysis within 5 business days. Organizations must follow the strictest timeline for reporting while preparing separate report formats for each regulator.

How often do I need to perform penetration testing for dual compliance?

At minimum, conduct quarterly penetration testing for critical systems (SAMA requirement) and bi-annual testing for all internet-facing assets (NCA requirement). Continuous vulnerability scanning is required by both frameworks. A unified schedule that includes quarterly critical-system tests and bi-annual full-scope tests will satisfy both regulators.

What are the penalties for non-compliance with NCA ECC or SAMA CSF?

NCA ECC non-compliance can result in administrative penalties, restriction of services, or referral to the Public Prosecution for critical infrastructure entities. SAMA CSF non-compliance may lead to fines, license suspension, or restrictions on business activities. For financial institutions, non-compliance with either framework carries significant operational and reputational risk.

Streamline Dual Compliance with Automated Control Mapping

Manual mapping between NCA ECC-2 and SAMA CSF is error-prone and unsustainable. CyberSilo's Compliance Standards Automation platform maps 1,200+ controls to a single evidence set, automates evidence collection, and generates audit-ready reports for both regulators. Book a workshop to see how your organization can achieve dual compliance with 60% less effort.

Ready to Build Your Unified Compliance Program?

Our team has helped over 20 Saudi financial institutions achieve and maintain dual compliance with NCA ECC and SAMA CSF. We offer a structured workshop that maps your existing controls to both frameworks in a single session, identifying gaps and automation opportunities.

NCA ECC vs SAMA CSF — How Saudi Enterprises Achieve Dual Compliance

Saudi financial institutions typically face both the National Cybersecurity Authority’s Essential Cybersecurity Controls (ECC-2:2024) and the Saudi Central Bank’s Cyber Security Framework (SAMA CSF) v1.0. Dual compliance is achievable when you keep one evidence library and two accurate indexes — not when you recycle outdated control counts.

Framework facts: ECC-2:2024 = 4 domains / 28 subdomains / 108 main controls / 92 subcontrols. SAMA CSF v1.0 = 4 domains / 32 subdomains (CLG 7 + CRMC 5 + COT 17 + TPC 3), maturity 0–5, Member Organizations at Level 3 or higher.

Two Regulators, One Operating Programme

NCA — national cybersecurity authority; ECC applies to in-scope government and critical entities (including many financial operators as CNI participants).
SAMA — financial sector regulator; CSF applies to Member Organizations (banks, insurers, finance companies, payment providers, and other licensed entities).

NCA ECC-2:2024 Overview

ECC-2:2024 organises controls into four domains:

Cybersecurity Governance
Cybersecurity Defense (including subdomain 2-12 event logs and monitoring)
Cybersecurity Resilience
Third-Party and Cloud Computing Cybersecurity

Structure: 4 / 28 / 108 / 92. See what changed from ECC-1:2018.

SAMA CSF v1.0 Overview

SAMA CSF is structured as four domains and thirty-two subdomains (official TOC 3.1.1–3.4.3):

Cyber Security Leadership and Governance — 7 subdomains
Cyber Security Risk Management and Compliance — 5 subdomains
Cyber Security Operations and Technology — 17 subdomains
Third Party Cyber Security — 3 subdomains

Each subdomain states a principle, objective, and control considerations. Maturity is scored 0–5; Member Organizations should operate at Level 3 or higher. Full subdomain list: SAMA CSF domains and maturity levels.

Side-by-Side

Dimension

NCA ECC-2:2024

SAMA CSF v1.0

Scope

National essential controls for in-scope entities

Mandatory for SAMA Member Organizations

Structure

4 domains, 28 subdomains, 108 main controls, 92 subcontrols

4 domains, 32 subdomains with control considerations

Assessment model

NCA toolkit / national assessment mechanisms

Maturity 0–5; Level 3+ expected; self-assessment to SAMA

Logging focus

Defense subdomain 2-12

Event & incident management (e.g. 3.3.14 / 3.3.15)

Where Dual Compliance Is Efficient

Governance, roles, and board/management oversight
Risk management and compliance monitoring
IAM, cryptography, vulnerability management
Centralised logging, continuous monitoring, and incident evidence
Third-party / cloud oversight

Design one SIEM and one GRC evidence store, then tag artefacts to ECC control IDs and SAMA subdomain maturity arguments. Prefer the stricter operational outcome where retention or monitoring expectations differ — and confirm wording in the published frameworks.

Where Programmes Still Diverge

Applicability — SAMA is sector-specific; ECC is national essential controls for in-scope entities.
Scoring language — ECC define–implement–minimums–review patterns vs SAMA numeric maturity.
Financial-specific subdomains — payment systems and electronic banking sit under SAMA COT.
Reporting paths — NCA national mechanisms vs SAMA supervisory self-assessment cycles.

Dual-Compliance Workflow

Build a unified control inventory with ECC-2 and SAMA subdomain columns.
Assign owners per subdomain/domain — not per spreadsheet tab.
Automate evidence collection from SIEM, IAM, vuln, and cloud sources.
Score SAMA maturity to Level 3+ while closing ECC gaps (especially 2-12).
Rehearse both reporting packages from the same artefact pool.

How CyberSilo Helps

CSA for NCA ECC and SAMA-oriented automation via SAMA compliance automation
ThreatHawk SIEM + SOAR for shared monitoring evidence
Services context: SAMA CSF compliance services

Map NCA and SAMA from One Evidence Library

Replace conflicting control counts with the official framework structures and continuous monitoring proof.

Talk to CyberSilo Compliance Standards Automation

Frequently Asked Questions

What is the structure of NCA ECC-2:2024?

ECC-2:2024 has 4 domains, 28 subdomains, 108 main controls, and 92 subcontrols.

What is the structure of SAMA CSF v1.0?

SAMA CSF v1.0 has 4 domains and 32 subdomains (CLG 7 + CRMC 5 + COT 17 + TPC 3). Maturity levels run 0–5; Member Organizations should operate at Level 3 or higher.

Can one evidence set serve both frameworks?

Yes for overlapping themes such as governance, IAM, logging, incident response, and third-party oversight — with separate indexes for ECC control IDs and SAMA subdomain maturity arguments.

ECC 2-12 · SIEM for KSA · SAMA maturity · Contact