Home / Controls lists / Saudi NCA ECC

Saudi NCA ECC Controls List

The Essential Cybersecurity Controls are the minimum cybersecurity requirements the National Cybersecurity Authority sets for Saudi entities. The 2024 edition has four domains and 28 subdomains, covering governance, defence, resilience, and third-party and cloud security.

Download NCA ECC controls list (Excel) Read the list

Free account needed to download. You come straight back to the file.

Who it is for. Government agencies in Saudi Arabia, including ministries and authorities, and their affiliated companies and entities inside and outside the Kingdom, plus private-sector entities that own, operate or host critical national infrastructure. The NCA encourages everyone else to use it.

What this list covers. ECC-2:2024, the English edition published by the National Cybersecurity Authority on nca.gov.sa (document dated 2024, read in November 2026). The Arabic text is the binding one, and the NCA tells readers to check its website for the latest version, so do that before relying on this list: 200 controls. Each has a reference, a heading and a sentence in plain English.

Read it here, download it when you want it. The download is the SecureXcel unified controls workbook for this framework, an Excel file exactly as we maintain it, with a Version History sheet for document control.

1-1. Governance: cybersecurity strategy

Ref	Control	What it requires
1-1-1	Approved cybersecurity strategy	Write down a cybersecurity strategy, get the head of the entity or a delegate to approve and back it, and keep its goals in line with the laws and regulations that apply to you.
1-1-2	Action plan for the strategy	Carry out an action plan that puts the cybersecurity strategy into effect.
1-1-3	Review the strategy	Review the strategy at planned intervals, and again whenever the relevant legal or regulatory requirements change.

1-2. Governance: cybersecurity management

Ref	Control	What it requires
1-2-1	Independent cybersecurity department	Set up a cybersecurity department that is separate from IT and communications. Ideally it reports to the head of the entity or a delegate, with care taken to avoid conflicts of interest.
1-2-2	Full-time Saudi cybersecurity staff	Fill every cybersecurity position with full-time, qualified Saudi professionals.
1-2-3	Cybersecurity supervisory committee	Form a committee, on the authorised official's instruction, to oversee the programmes. Document and approve its members, duties and governance, and include the head of cybersecurity.

1-3. Governance: policies and procedures

Ref	Control	What it requires
1-3-1	Document and approve policies	Have the cybersecurity department write the policies and procedures, covering the controls and requirements, get them approved by the authorised official, and share them with the people concerned.
1-3-2	Put policies into practice	Make sure the approved cybersecurity policies and procedures are actually applied across the entity.
1-3-3	Technical security standards	Back the policies with technical security standards for items such as firewalls, databases and operating systems.
1-3-4	Review and update policies	Review and update policies and procedures at planned intervals or when laws, regulations or standards change. Record and approve each change.

1-4. Governance: roles and responsibilities

Ref	Control	What it requires
1-4-1	Define cybersecurity roles	The authorised official documents and approves the governance structure, roles and responsibilities for cybersecurity, names the people for them, and supports them without creating conflicts of interest.
1-4-2	Review roles	Review and update cybersecurity roles and responsibilities at planned intervals or when the relevant legal or regulatory requirements change.

1-5. Governance: risk management

Ref	Control	What it requires
1-5-1	Risk management method	Define, document and approve a cybersecurity risk method and procedures that take confidentiality, integrity and availability of information and technology assets into account.
1-5-2	Apply the risk method	Have the cybersecurity department put the risk management method and procedures into use.
1-5-3	When risk assessment is mandatory	Run risk assessments at least at the four trigger points listed below.
1-5-3-1	Assess early in technology projects	Carry out a cybersecurity risk assessment at an early stage of each technology project.
1-5-3-2	Assess before major infrastructure change	Carry out a risk assessment before making major changes to technology infrastructure.
1-5-3-3	Assess when planning third-party services	Carry out a risk assessment while planning to obtain services from a third party.
1-5-3-4	Assess before launching services	Carry out a risk assessment while planning, and before releasing, new technology services and products.
1-5-4	Review the risk method	Review and update the risk method and procedures at planned intervals or when laws, regulations or standards change. Record and approve changes.

1-6. Governance: cybersecurity in technology projects

Ref	Control	What it requires
1-6-1	Security in project and change management	Build cybersecurity requirements into project management and technology change management so risks are managed through the project lifecycle, and treat them as a core part of project requirements.
1-6-2	Minimum security for projects and changes	Projects and changes to technology assets must at least meet the two requirements below.
1-6-2-1	Fix vulnerabilities in projects	Assess vulnerabilities and remediate them as part of each project and change.
1-6-2-2	Check hardening before go-live	Review secure configuration, hardening and update packages before a project or change goes live.
1-6-3	Minimum security for software development	Software and application development projects must at least meet the five requirements below.
1-6-3-1	Secure coding standards	Develop software using secure coding standards.
1-6-3-2	Trusted and licensed tooling	Take development tools and libraries only from trusted, licensed sources.
1-6-3-3	Test against security requirements	Test software for compliance with the entity's cybersecurity requirements.
1-6-3-4	Secure application integration	Integrate applications with each other in a secure way.
1-6-3-5	Check hardening before release	Review secure configuration, hardening and update packages before software products are released.
1-6-4	Review project security requirements	Review the cybersecurity requirements for project management periodically.

1-7. Governance: compliance with standards, laws and regulations

Ref	Control	What it requires
1-7-1	Honour international commitments	Where Saudi Arabia has approved international agreements or commitments that carry cybersecurity requirements, identify those requirements and comply with them.

1-8. Governance: periodic review and audit

Ref	Control	What it requires
1-8-1	Internal review of controls	Have the cybersecurity department periodically review how the entity implements cybersecurity controls.
1-8-2	Independent audit of controls	Have people outside the cybersecurity department review and audit the controls, independently and with conflicts of interest considered, in line with generally accepted auditing standards and the law.
1-8-3	Report audit results	Document audit and review results, including scope, observations, recommendations, corrective actions and remediation plans, and present them to the supervisory committee and the authorised official.

1-9. Governance: cybersecurity in human resources

Ref	Control	What it requires
1-9-1	Personnel security requirements	Identify, document and approve cybersecurity requirements for staff and contractors before, during and at the end of their employment.
1-9-2	Apply personnel requirements	Put the personnel cybersecurity requirements into practice.
1-9-3	Minimum requirements before employment	Before staff start, at least the two requirements below must be met.
1-9-3-1	Security and confidentiality clauses	Put cybersecurity responsibilities and non-disclosure clauses in employment contracts, and make them cover the period during and after employment.
1-9-3-2	Screen sensitive roles	Screen or vet people in cybersecurity roles and in technical roles with critical or privileged powers.
1-9-4	Minimum requirements during employment	During employment, at least the two requirements below must be met.
1-9-4-1	Awareness from onboarding onwards	Give staff cybersecurity awareness when they join and throughout their employment.
1-9-4-2	Staff comply with policies	Make sure staff apply and comply with the cybersecurity policies, procedures and operating practice.
1-9-5	Revoke access when employment ends	Review staff access rights and withdraw them immediately when employment ends.
1-9-6	Review personnel requirements	Review the cybersecurity requirements for personnel periodically.

1-10. Governance: awareness and training

Ref	Control	What it requires
1-10-1	Awareness programme	Develop and approve, and refresh periodically, an awareness programme delivered through several channels that builds a positive security culture and explains cyber threats and risks.
1-10-2	Run the awareness programme	Deliver the approved awareness programme within the entity.
1-10-3	Awareness topics to cover	The programme must teach staff to defend against the latest threats, including the four topics below.
1-10-3-1	Email and phishing	Teach safe handling of email, especially phishing messages.
1-10-3-2	Mobile devices and storage media	Teach safe handling of mobile devices and storage media.
1-10-3-3	Safe browsing	Teach safe Internet browsing.
1-10-3-4	Social media	Teach safe use of social media.
1-10-4	Specialist training by role	Give specialised skills and training to people whose jobs relate directly to cybersecurity, pitched to their responsibilities, as covered by the three groups below.
1-10-4-1	Train cybersecurity department staff	Train the people working in the cybersecurity department.
1-10-4-2	Train developers and technology staff	Train staff who build software or applications and those who work on the entity's information and technology assets.
1-10-4-3	Train executives and supervisors	Train people in executive and supervisory positions.
1-10-5	Review the awareness programme	Review periodically how the awareness programme is being carried out.

2-1. Defense: asset management

Ref	Control	What it requires
2-1-1	Asset management requirements	Identify, document and approve the cybersecurity requirements for managing information and technology assets.
2-1-2	Apply asset management requirements	Put the asset management requirements into practice.
2-1-3	Acceptable use policy	Write, approve and communicate a policy on acceptable use of information and technology assets.
2-1-4	Apply the acceptable use policy	Put the acceptable use policy into practice.
2-1-5	Classify, label and handle assets	Classify, label and handle information and technology assets as the relevant laws and regulations require.
2-1-6	Review asset management requirements	Review the asset management requirements periodically.

2-2. Defense: identity and access management

Ref	Control	What it requires
2-2-1	Access management requirements	Identify, document and approve the cybersecurity requirements for identity and access management.
2-2-2	Apply access management requirements	Put the identity and access management requirements into practice.
2-2-3	Minimum access requirements	The requirements must at least cover the five areas below.
2-2-3-1	Username and password login	Provide single-factor authentication based on a username and password.
2-2-3-2	Multi-factor authentication	Use multi-factor authentication for remote access and privileged accounts, choosing the factors, their number and the technique from an impact assessment of authentication failure and bypass.
2-2-3-3	Authorisation by access principles	Grant access by need-to-know and need-to-use, least privilege and segregation of duties.
2-2-3-4	Privileged access management	Manage privileged access.
2-2-3-5	Periodic access review	Review identities and access rights periodically.
2-2-4	Review access management	Review how the access management requirements are implemented, periodically.

2-3. Defense: information systems and processing facilities

Ref	Control	What it requires
2-3-1	System protection requirements	Identify, document and approve the cybersecurity requirements for protecting information systems and processing facilities, including workstations and infrastructure.
2-3-2	Apply system protection requirements	Put those protection requirements into practice.
2-3-3	Minimum system protection	The requirements must at least cover the four areas below.
2-3-3-1	Malware protection	Protect workstations and servers from viruses, suspicious programs and malware using modern, advanced technologies, and manage those tools securely.
2-3-3-2	Restrict external storage media	Restrict the use of external storage media strictly, and secure it.
2-3-3-3	Patch management	Manage patches for systems, applications and devices.
2-3-3-4	Central clock synchronisation	Synchronise clocks centrally against an accurate, trusted source, such as one provided by the Saudi Standards, Metrology and Quality Organization.
2-3-4	Review system protection	Review the implementation of these protection requirements periodically.

2-4. Defense: email protection

Ref	Control	What it requires
2-4-1	Email protection requirements	Identify, document and approve the cybersecurity requirements for protecting the entity's email service.
2-4-2	Apply email protection requirements	Put the email protection requirements into practice.
2-4-3	Minimum email protection	The requirements must at least cover the five areas below.
2-4-3-1	Filter email	Analyse and filter email, especially phishing and spam, using modern, advanced protection techniques.
2-4-3-2	Email multi-factor authentication	Use multi-factor authentication for remote and webmail access, choosing the factors, their number and the technique from an impact assessment of authentication failure and bypass.
2-4-3-3	Email archive and backup	Archive and back up email.
2-4-3-4	Email APT protection	Manage and protect the email service securely against advanced persistent threats, which typically use zero-day malware and viruses.
2-4-3-5	SPF, DKIM and DMARC	Validate the entity's email domains using SPF, DKIM and DMARC.
2-4-4	Review email protection	Review the email protection requirements periodically.

2-5. Defense: network security management

Ref	Control	What it requires
2-5-1	Network security requirements	Identify, document and approve the cybersecurity requirements for managing the entity's network security.
2-5-2	Apply network security requirements	Put the network security requirements into practice.
2-5-3	Minimum network security	The requirements must at least cover the nine areas below.
2-5-3-1	Segment the network	Isolate and segment network zones, logically or physically, using firewalls and defence in depth to control the relevant risks.
2-5-3-2	Separate production from test and development	Keep the production network isolated from testing and development networks.
2-5-3-3	Secure browsing and connectivity	Provide secure browsing and Internet access, with strict limits on suspicious sites, file storage and sharing sites, and remote access sites.
2-5-3-4	Wireless security	Secure wireless networks with strong authentication and encryption, and connect them to the internal network only after a full risk assessment and with the risks handled.
2-5-3-5	Restrict services, protocols and ports	Restrict and manage network services, protocols and ports.
2-5-3-6	Intrusion prevention	Use intrusion prevention systems.
2-5-3-7	DNS security	Secure the Domain Name Service.
2-5-3-8	Browsing channel APT protection	Manage and protect the Internet browsing channel securely against advanced persistent threats, which typically use zero-day malware and viruses.
2-5-3-9	DDoS protection	Protect against distributed denial of service attacks to limit the risk they pose.
2-5-4	Review network security	Review the network security requirements periodically.

2-6. Defense: mobile devices security

Ref	Control	What it requires
2-6-1	Mobile and BYOD requirements	Identify, document and approve the cybersecurity requirements for mobile devices and bring-your-own-device use when they connect to the entity's network.
2-6-2	Apply mobile and BYOD requirements	Put the mobile device and BYOD requirements into practice.
2-6-3	Minimum mobile and BYOD security	The requirements must at least cover the four areas below.
2-6-3-1	Separate and encrypt entity data	Keep the entity's data on mobile devices and personal devices separate from personal data, and encrypt it.
2-6-3-2	Restrict use to business need	Control and restrict device use to what the entity's business needs.
2-6-3-3	Wipe entity data	Delete the entity's data from mobile and personal devices if a device is lost or when the person's employment ends.
2-6-3-4	User awareness for devices	Make users aware of the security of their devices.
2-6-4	Review mobile and BYOD security	Review the mobile device and BYOD requirements periodically.

2-7. Defense: data and information protection

Ref	Control	What it requires
2-7-1	Data protection requirements	Identify, document and approve the requirements for protecting and handling the entity's data and information, in line with the relevant laws and regulations.
2-7-2	Protect data by classification	Put data protection requirements into practice, with the level of protection set by the classification of the data.
2-7-3	Review data protection	Review how the data protection requirements are implemented, periodically.

2-8. Defense: cryptography

Ref	Control	What it requires
2-8-1	Cryptography requirements	Identify, document and approve the cybersecurity requirements for cryptography.
2-8-2	Apply cryptography requirements	Put the cryptography requirements into practice.
2-8-3	Meet the National Cryptographic Standards	Meet at least the NCA's National Cryptographic Standards, at a level matched to data sensitivity and the entity's risk assessment. The three areas below must be covered.
2-8-3-1	Approved cryptographic solutions	Use cryptographic systems and solutions that meet approved standards, within their technical and regulatory limits.
2-8-3-2	Cryptographic key management	Manage cryptographic keys securely through their whole lifecycle.
2-8-3-3	Encrypt data in transit and at rest	Encrypt data in transit and at rest according to its classification and the relevant laws and regulations.
2-8-4	Review cryptography	Review the cryptography requirements periodically.

2-9. Defense: backup and recovery

Ref	Control	What it requires
2-9-1	Backup requirements	Identify, document and approve the cybersecurity requirements for backup and recovery.
2-9-2	Apply backup requirements	Put the backup and recovery requirements into practice.
2-9-3	Minimum backup and recovery	The requirements must at least cover the three areas below.
2-9-3-1	Back up critical assets	Make sure backups cover critical technology and information assets.
2-9-3-2	Recover quickly	Be able to restore data and systems quickly after a cybersecurity incident.
2-9-3-3	Test restores	Test periodically that backups can be restored.
2-9-4	Review backup	Review the backup and recovery requirements periodically.

2-10. Defense: vulnerability management

Ref	Control	What it requires
2-10-1	Vulnerability management requirements	Identify, document and approve the cybersecurity requirements for managing technical vulnerabilities.
2-10-2	Apply vulnerability management	Put the vulnerability management requirements into practice.
2-10-3	Minimum vulnerability management	The requirements must at least cover the five areas below.
2-10-3-1	Periodic vulnerability assessment	Assess and scan for vulnerabilities periodically.
2-10-3-2	Rank vulnerabilities by severity	Classify vulnerabilities by how severe they are.
2-10-3-3	Fix by classification and risk	Remediate vulnerabilities according to their classification and the cyber risk involved.
2-10-3-4	Verified patching	Patch to fix vulnerabilities, and check in a non-production environment that updates are sound and effective before applying them.
2-10-3-5	Trusted vulnerability sources	Keep in touch with, and subscribe to, trusted sources for new and current vulnerabilities.
2-10-4	Review vulnerability management	Review the vulnerability management requirements periodically.

2-11. Defense: penetration testing

Ref	Control	What it requires
2-11-1	Penetration testing requirements	Identify, document and approve the cybersecurity requirements for penetration testing.
2-11-2	Apply penetration testing	Put the penetration testing requirements into practice.
2-11-3	Minimum penetration testing	The requirements must at least cover the two areas below.
2-11-3-1	Test every Internet-facing service	Include in scope all services provided over the Internet and their technical parts: infrastructure, websites, web applications, mobile apps, email and remote access.
2-11-3-2	Test periodically	Run penetration tests periodically.
2-11-4	Review penetration testing	Review the penetration testing requirements periodically.

2-12. Defense: event logs and monitoring

Ref	Control	What it requires
2-12-1	Logging and monitoring requirements	Identify, document and approve the cybersecurity requirements for event logs and monitoring.
2-12-2	Apply logging and monitoring	Put the logging and monitoring requirements into practice.
2-12-3	Minimum logging and monitoring	The requirements must at least cover the five areas below.
2-12-3-1	Log critical assets	Turn on cybersecurity event logs for the entity's critical information assets.
2-12-3-2	Log privileged and remote access	Turn on event logs for critical and privileged accounts that access information assets, and for remote access events.
2-12-3-3	SIEM collection	Decide which Security Information and Event Management techniques are needed to collect event logs.
2-12-3-4	Continuous monitoring	Monitor cybersecurity event logs continuously.
2-12-3-5	Keep logs for at least 12 months	Set a retention period for event logs of at least 12 months.
2-12-4	Review logging and monitoring	Review the logging and monitoring requirements periodically.

2-13. Defense: incident and threat management

Ref	Control	What it requires
2-13-1	Incident and threat requirements	Identify, document and approve the requirements for managing cybersecurity incidents and threats.
2-13-2	Apply incident and threat management	Put the incident and threat management requirements into practice.
2-13-3	Minimum incident and threat management	The requirements must at least cover the five areas below.
2-13-3-1	Response plans and escalation	Have incident response plans and escalation procedures.
2-13-3-2	Classify incidents	Classify cybersecurity incidents.
2-13-3-3	Report incidents to the NCA	Report cybersecurity incidents to the NCA.
2-13-3-4	Share information with the NCA	Share incident notifications, threat intelligence, indicators of compromise and incident reports with the NCA.
2-13-3-5	Threat intelligence feeds	Collect and handle threat intelligence feeds.
2-13-4	Review incident and threat management	Review the incident and threat management requirements periodically.

2-14. Defense: physical security

Ref	Control	What it requires
2-14-1	Physical protection requirements	Identify, document and approve the requirements for protecting information and technology assets against unauthorised physical access, loss, theft and damage.
2-14-2	Apply physical protection	Put the physical protection requirements into practice.
2-14-3	Minimum physical protection	The requirements must at least cover the five areas below.
2-14-3-1	Authorised access to critical areas	Allow only authorised people into critical areas such as data centres, disaster recovery sites, surveillance centres and network rooms.
2-14-3-2	Access and CCTV logs	Keep access logs and monitor with CCTV.
2-14-3-3	Protect access and monitoring records	Protect the access log and monitoring records.
2-14-3-4	Secure destruction and re-use	Destroy or re-use physical assets that hold classified information, including paper and storage media, securely.
2-14-3-5	Secure equipment on and off site	Secure devices and equipment inside and outside the entity's facilities.
2-14-4	Review physical protection	Review the physical protection requirements periodically.

2-15. Defense: web application security

Ref	Control	What it requires
2-15-1	Web application requirements	Identify, document and approve the cybersecurity requirements for the entity's external web applications.
2-15-2	Apply web application requirements	Put the web application security requirements into practice.
2-15-3	Minimum web application security	The requirements must at least cover the five areas below.
2-15-3-1	Web application firewall	Use a web application firewall.
2-15-3-2	Multi-tier architecture	Build applications on the multi-tier architecture principle.
2-15-3-3	Secure protocols	Use secure protocols such as HTTPS.
2-15-3-4	Secure use policy for users	Make the secure usage policy clear to users.
2-15-3-5	User authentication	Authenticate users, with factors, their number and technique chosen from an impact assessment of authentication failure and bypass for user access.
2-15-4	Review web application security	Review the web application security requirements periodically.

3-1. Resilience: business continuity

Ref	Control	What it requires
3-1-1	Continuity requirements	Identify, document and approve the cybersecurity requirements within business continuity management.
3-1-2	Apply continuity requirements	Put the cybersecurity requirements for business continuity into practice.
3-1-3	Minimum continuity requirements	The requirements must at least cover the three areas below.
3-1-3-1	Keep security systems running	Keep cybersecurity systems and procedures running through a disruption.
3-1-3-2	Incident plans for continuity	Develop plans for responding to cybersecurity incidents that could disrupt the business.
3-1-3-3	Disaster recovery plans	Develop disaster recovery plans.
3-1-4	Review continuity requirements	Review the cybersecurity requirements for business continuity periodically.

4-1. Third-party and cloud: third-party cybersecurity

Ref	Control	What it requires
4-1-1	Third-party contract requirements	Identify, document and approve the cybersecurity requirements for the entity's contracts and agreements with third parties.
4-1-2	Minimum third-party contract terms	Contracts and agreements, such as service level agreements, with third parties whose failure could affect your data or services must at least include the three terms below.
4-1-2-1	Confidentiality and secure data removal	Include non-disclosure clauses, and secure removal of the entity's data by the third party when the service ends.
4-1-2-2	Incident communication	Set out how to communicate when a cybersecurity incident occurs.
4-1-2-3	Third party applies your requirements	Oblige the third party to apply the entity's cybersecurity requirements and policies and the relevant laws and regulations.
4-1-3	Terms for IT outsourcing and managed services	Contracts with providers of IT or cybersecurity outsourcing or managed services must at least cover the two points below.
4-1-3-1	Assess risk before signing	Assess cybersecurity risk and confirm mitigating controls exist before signing, or when relevant laws and regulations change.
4-1-3-2	Managed security centres in Saudi Arabia	Locate cybersecurity managed service centres for monitoring and operations that use remote access entirely inside the Kingdom.
4-1-4	Review third-party requirements	Review the cybersecurity requirements for third parties periodically.

4-2. Third-party and cloud: cloud computing and hosting

Ref	Control	What it requires
4-2-1	Cloud and hosting requirements	Identify, document and approve the cybersecurity requirements for using cloud computing and hosting services.
4-2-2	Apply cloud and hosting requirements	Put the cloud and hosting security requirements into practice.
4-2-3	Minimum cloud and hosting security	On top of the controls in domains 1, 2 and 3 and subdomain 4-1, the requirements must at least cover the two areas below.
4-2-3-1	Provider protects data, then returns it	Make sure the provider protects the entity's data according to its classification, and hands it back in a usable format when the service ends.
4-2-3-2	Separate your environment	Separate the entity's environment, especially virtual servers, from those of the provider's other customers.
4-2-4	Review cloud and hosting requirements	Review the cloud computing and hosting requirements periodically.

Download NCA ECC controls list (Excel)Free account needed. You come straight back to the file.

SecureXcel unified controls workbook

Alongside the list above, SecureXcel keeps a unified set of practical controls. For each control the workbook gives the risk it addresses, the objective, a description, whether it is preventive or detective, how often to run it, the design and operating test procedures, and the evidence to collect, with the references it covers in this framework. There is one workbook per framework, supplied as it is, with a Version History sheet for document control. Free account needed; you come straight back to the file.

A summary, not the source. The references and short headings identify each item. The wording beside them is our own summary and is not a quotation, a legal opinion or advice. Check the published source for the exact requirement. We help organisations with this: see our Cybersecurity Assessment service.

Questions people ask

Who has to comply with the NCA ECC?

Government agencies and their affiliated companies, and private entities that own, operate or host critical national infrastructure. Other entities are encouraged to adopt it as good practice. The cloud and hosting controls bind those using, or planning to use, such services.

What changed between ECC-1:2018 and ECC-2:2024?

The industrial control systems domain was removed and its controls moved to the NCA's separate operational technology controls (OTCC). Data localisation moved to the National Data Management Office, and some controls were clarified, such as multi-factor authentication and email domain checks.

Do the ICS and operational technology controls appear here?

No. ECC-2:2024 has four domains and no longer holds the industrial control systems controls, so they are not in this list. If you run industrial systems, look at the NCA's OT cybersecurity controls.

Why does the list show sub-controls such as 2-2-3-2 as well as 2-2-3?

The ECC states some controls as a minimum set of items and numbers each item. We list the parent control and every numbered item so you can track each one on its own.

Is this a complete statement of the ECC?

No. It is a plain-English summary in our own words. The NCA's document is the authority, and the Arabic version is the binding text, so check the published source for the exact requirement.