Compliance & AssuranceNCA Compliance
We assess your organisation against the NCA Essential Cybersecurity Controls and its companion controls, build the policies and technical controls that close the gaps and prepare the evidence the NCA expects.
01Overview
The Essential Cybersecurity Controls (ECC) are the minimum cyber security requirements set by Saudi Arabia's National Cybersecurity Authority. They apply to government bodies and to private organisations that own, operate or host critical national infrastructure, and cover governance, defence, resilience and third-party and cloud security.
The NCA publishes further controls alongside the ECC: the Cloud Cybersecurity Controls (CCC), Critical Systems Cybersecurity Controls (CSCC), Operational Technology Cybersecurity Controls (OTCC) and Data Cybersecurity Controls (DCC). Which apply to you depends on what you operate.
The current baseline edition is ECC-2:2024, which updated the 2018 original. Many private organisations also adopt it voluntarily, because customers and regulators increasingly expect it.
Key facts
02What we do
Use them in order, or pick the one you need now.
Identify which NCA documents, facilities and systems are in scope.
What you receive
A defensible scope.
Evidence-based assessment against ECC-2:2024 and companion controls.
What you receive
A scored gap register with priorities.
Policies, standards and procedures tailored to the ECC and your organisation.
What you receive
An approved policy framework.
Identity, network, endpoint, logging, backup and vulnerability controls built and tested.
What you receive
Controls that operate, with evidence.
Controls for organisations that use or provide cloud services.
What you receive
Cloud use that meets the CCC.
Additional controls for critical systems and operational technology.
What you receive
Critical systems with stronger protection.
Prepare for the NCA's assessment.
What you receive
Confidence on audit day.
03How we work
Typical stages. Duration depends on size and starting maturity.
Confirm applicability and governance.
Assess against ECC and companions.
Prioritised, costed plan with owners.
Policies and technical controls.
Collect evidence and test it.
Support the NCA assessment and fix findings.
04Reference
A map from the control domains to our work.
| Domain | What it covers | What we implement |
|---|---|---|
| Cybersecurity governance | Strategy, policies, roles, risk management, awareness, compliance | Policy set, risk register, training programme, steering committee |
| Cybersecurity defence | Assets, identity, systems and network protection, mobile, data, cryptography, backup, vulnerabilities, penetration testing, logging, incident and threat management, physical and web application security | Technical controls, testing, monitoring and incident capability |
| Cybersecurity resilience | Business continuity and disaster recovery from a cyber perspective | Continuity plans, backup design and recovery tests |
| Third-party and cloud | Supplier and cloud service security | Vendor assessment, contract clauses, cloud controls |
Summary of the ECC structure. Domain and control details are set out in the NCA's published documents.
05NCA documents
Which document covers what.
The baseline controls for all in-scope organisations.
How we help: Baseline programme.
Controls for cloud service providers and cloud consumers.
How we help: Cloud assessment and controls.
Additional controls for systems identified as critical.
How we help: Hardening critical systems.
Controls for operational technology of critical infrastructure.
How we help: OT security services.
Controls for protecting data throughout its life.
How we help: Data protection programme.
Controls for secure remote working.
How we help: Remote access and endpoint controls.
06Saudi Arabia and the GCC
Lessons from regulated organisations in the Kingdom.
The ECC expects top management to sponsor and review cyber security. We help leaders understand their role.
Assessors want records that show controls operating over time, not one-off screenshots.
Where monitoring is outsourced, providers must be licensed by the NCA for your category. We help you choose.
Policies and procedures are normally prepared in Arabic and English.
07Why GoAgile
Controls that run, evidence that holds up.
We build the technical controls.
Documents and records prepared for assessors.
Findings before the real assessment.
SOC and data lake support the logging controls.
Public-sector programmes delivered.
Both languages on every document.
Credentials
08Clients
Organisations in regulated sectors choose GoAgile because security is delivered by the team that also builds and runs their infrastructure.
SAMI
Defence and industry
Tier-1 Saudi bank
Banking
National energy operator
Oil, gas and power
Government authority
Public sector
Regional telecom operator
Telecommunications
Healthcare group
Hospitals and clinics
Retail and e-commerce group
Retail
Ports and logistics operator
Logistics
Insurance company
Insurance
Fintech and payments provider
Financial technology
Industrial manufacturer
Manufacturing
SAMI engaged GoAgile to strengthen its cyber security posture with protection aligned to the rigorous security and compliance standards of its sector.
The authority had to demonstrate compliance with the NCA Essential Cybersecurity Controls and did not know where to start.
Result: A clear compliance position, a funded roadmap and audit-ready evidence.
Patient data sat in many systems, with no single record of what was held, why, or who could see it.
Result: A defensible PDPL position and a process the privacy team could run day to day.
GoAgile strengthened our cybersecurity posture with enterprise-grade protection aligned to the rigorous security and compliance standards our sector demands. Their team has been a dependable partner on a mission-critical engagement.
Client names are withheld for confidentiality.
09Related services
Each service stands alone and works better with the others.
Tell us your sector and facilities. We will confirm what applies and propose a gap assessment.
Start an NCA programme10Questions answered
Tell us about your environment and what you need. We will respond with a scoped proposal, not a brochure.
Specialists who do this work every week, reporting in Arabic and English.