NCA Essential Cybersecurity Controls for Contractors

The NCA Essential Cybersecurity Controls (ECC-2:2024) are issued by Saudi Arabia’s National Cybersecurity Authority and contain 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols. They are mandatory for government entities and their affiliated companies, and for private-sector entities that own, operate or host Critical National Infrastructure.

An electrical contractor may sit outside that scope and still face ECC requirements through the contracts of clients inside it, because the ECC sets minimum clauses for third-party contracts. This guide covers the ECC’s structure, who must comply, how requirements reach contractors and what the controls ask for in identity, access and event logs. It closes with a vendor questionnaire and a look at where ELX’s governance tools fit — with no compliance claim.

What are the NCA Essential Cybersecurity Controls (ECC-2:2024)?

The ECC is organised into four main domains. Each breaks down into subdomains, and each subdomain holds main controls, some of which have subcontrols. The four domains are:

• Cybersecurity Governance.
• Cybersecurity Defense.
• Cybersecurity Resilience.
• Third-Party and Cloud Computing Cybersecurity.

This guide does not walk through every control. It focuses on the three areas closest to a contractor’s daily work: identity and access, event logs, and third-party contract clauses. An in-scope entity, by contrast, must meet every control that applies to it.

The fourth domain brings third-party and cloud computing cybersecurity together, which makes it the domain closest to a contractor’s relationships with clients and vendors. If your own systems, or your vendors’ systems, are delivered as cloud services, it concerns you from both sides.

Which entities must apply the ECC?

The ECC names three groups that must comply:

• Saudi government entities.
• Companies affiliated with government entities.
• Private-sector entities that own, operate or host Critical National Infrastructure.

The NCA strongly encourages every other entity to adopt the controls too. For in-scope entities, compliance is ongoing rather than a one-off report, and the NCA assesses it through means such as self-assessment, compliance-tool reports and field audit visits.

To place your company, answer two questions. Is your company itself in one of the three groups? Are the clients you execute work orders for in one of them? A yes to the first means the obligation is yours directly. A yes to the second means the requirements may reach you through the contract, to the extent the client specifies.

How do ECC requirements reach contractors?

Subdomain 4-1 of the ECC covers third-party cybersecurity. Its minimum contract requirements apply to any third party whose failure could affect the entity’s data or services — and a contractor that executes work orders and handles the client’s data can be one of them.

Contracts with these third parties must include, at minimum, three clauses:

Non-disclosure and secure removal

The third party keeps the entity’s data confidential and securely removes it when the service ends.

Incident communication

Agreed procedures for how both sides communicate when a cybersecurity incident occurs.

The entity’s requirements

The third party commits to applying the entity’s own cybersecurity requirements.

In practice, an electrical contractor handles plenty of client data: work orders, subscriber names, mobile numbers and addresses, site coordinates, drawing files, achievement certificates and extracts. Your commitment under those clauses should therefore cover every place that data is stored.

When a contract arrives with a cybersecurity clause, prepare in five steps:

1. Define the scope

   Read the clause with your advisers and pin down which data and services it covers and which of the client’s requirements it refers to.

2. Map where the data lives

   List every place client data actually sits: your work order system, email, shared folders, Excel sheets and messaging groups.

3. Name an incident owner and channel

   Decide who contacts the client when an incident happens, how, and within the time the contract sets.

4. Plan the exit

   Agree up front how data will be returned or securely removed when the contract ends, and who documents it.

5. Flow the terms down

   If a system vendor or subcontractor processes the client’s data, make sure their commitments cover what you have committed to.

Which identity and access controls matter most?

The identity and access management controls in ECC-2:2024 require multi-factor authentication for remote access and for privileged accounts. They also require access based on need-to-know and need-to-use, least privilege and segregation of duties, together with privileged access management and periodic review of identities and access rights.

The table below maps these principles to a contractor’s environment. The middle column is a plain-language gloss and the last column is our own example — neither is the text of the controls.

MFA concerns how users sign in; the other principles govern what they are allowed to do once inside. Ask about the two separately when you assess any system. For a step-by-step, role-based permission model, see our guide to user permissions and audit trail in contractor systems.

What does the ECC require for cybersecurity event logs?

Cybersecurity event logs are the technical trail you rely on to detect attacks and to investigate an incident or suspicious activity. Among the ECC’s requirements for them:

• Enable: for critical information assets, for privileged accounts and for remote-access events.
• Monitor: review the logs continuously, not only after something goes wrong.
• Retain: keep them for at least 12 months.

This is where a common mix-up happens. The audit log in a work order system answers a business question: who added, edited or deleted a work order, and when. Cybersecurity event logs cover the technical estate itself, including privileged-account activity and remote-access events.

What are the common mistakes with ECC requirements?

• Taking marketing copy as evidence: a vendor calling its system “secure” or “compliant” is no substitute for specific, written answers.
• Shared accounts: one login for a whole team strips the logs of meaning, because they no longer show who did what, and it weakens privileged access management.
• Forgetting side channels: Excel sheets and messaging groups hold client data too, and your non-disclosure commitment covers them.
• No incident channel: if nobody knows who tells the client, or how, valuable time is lost when an incident happens.
• Keeping data after the contract ends: secure removal at the end of the service is one of the minimum third-party clauses, so plan for it from day one.
• Overlooking subcontractors: if client data reaches a subcontractor, the safest course is to bind them to the same commitments.

Which questions should you ask your system vendor?

Whether you are in scope or a client has passed the requirements on, put these questions to the vendor of any operations system or contractor software you rely on, and ask for written answers:

• Are rights granted per action inside a screen, not just per screen?
• Can each user’s data be limited to their branches and work areas?
• Does the system support MFA for privileged accounts and remote access? If not, what do you propose instead?
• What does the audit log record — user, action, time and record values — and can I view each record’s history?
• Which technical event logs exist, who monitors them and how long are they kept? Is it at least 12 months?
• Is deletion a traceable soft delete, or permanent?
• Is my company’s data kept separate from other customers’ data, and how?
• Where is the data hosted? If the service is cloud-based, how does it address the cloud computing requirements in the ECC’s fourth domain?
• How is data returned or securely removed when the contract ends?
• What is your incident notification procedure, and who is the contact?
• Will you commit in writing to apply the cybersecurity requirements I pass on from my client’s contract?
• Can you provide written evidence for any certification or compliance you mention?

A plain “no, we do not offer that” is more useful than a vague promise: it lets you plan a compensating measure before your client asks.

Where do ELX’s tools help with governance?

ELX is a bilingual (Arabic/English) cloud (SaaS) service hosted and operated by Matrix. It runs in the browser with no servers needed on the contractor’s side, and it is built for electricity-network contractors in Saudi Arabia to carry each utility work order from registration to archive. ELX makes no claim of certification or compliance with NCA controls, but it includes governance tools that answer part of the questionnaire above:

In the permissions and settings module, administrators grant rights from a single matrix, link each user to their branches and districts, browse the audit log and open any record’s full history. These are tools that help you apply least privilege and segregation of duties to your team’s actual roles.

Data separation is covered on the multi-company platform page: each company runs ELX on its own web instance and database, so your company’s data sits in a database separate from other companies’ data. Our security and data governance page sums up all of ELX’s access controls.

Because Matrix hosts and operates ELX as a cloud service, the infrastructure it runs on sits with Matrix rather than with you, and the cloud computing side of the ECC’s fourth domain is part of your evaluation. So put the questionnaire items this section does not cover to Matrix directly: MFA, infrastructure-level event logs and their retention, where the data is hosted, incident notification, and how data is returned or securely removed when the contract ends. Ask for written answers, as you would with any vendor.

Because work orders carry subscribers’ personal data, cybersecurity meets data protection here; see our guide to the Saudi PDPL for contractors. For the wider buying picture, read our guide to choosing electrical contractor software in Saudi Arabia.

To see the permission matrix and audit log in ELX, and to put the questionnaire to the Matrix team directly, request a demo.