What is NCA ECC?

More context

The Essential Cybersecurity Controls were issued by Saudi Arabia's National Cybersecurity Authority to establish a mandatory minimum bar for the kingdom's most important organizations. Rather than being aspirational guidance, the ECC is enforceable for in-scope entities, and its structure spans strategic governance, defense, resilience, third-party considerations, and industrial control systems, reflecting a national interest in protecting both government functions and critical infrastructure.

Within that structure the controls split roughly into two kinds. Technical configuration requirements, such as hardening systems, enforcing access control, and logging, can be evidenced by scanning infrastructure against a recognized benchmark. Governance and process controls, like appointing responsibilities or maintaining policies, need organizational documentation instead. A configuration scanner therefore addresses the automatable slice of the ECC and leaves the procedural controls to be evidenced separately.