The National Cybersecurity Authority's controls, such as the Essential Cybersecurity Controls (ECC-2:2024) and Cloud Cybersecurity Controls (CCC-2:2024), mainly bind government bodies, critical national infrastructure and their suppliers. If your startup sells to consumers or ordinary private companies, you are usually not directly bound, but if you want to contract with a government or critical-sector entity, the requirements reach you through the contract. Either way, adopting the basics early makes your product safer and easier to sell to enterprises.
- nca essential cybersecurity controls ecc explained
- do nca controls apply to private companies
- cybersecurity requirements for saudi government contracts
- nca cloud cybersecurity controls ccc
- cybersecurity checklist for saudi startups
Do NCA cybersecurity controls apply to your startup?
If you run a startup in Saudi Arabia and have heard about the Essential Cybersecurity Controls (ECC) or the Cloud Cybersecurity Controls (CCC), the natural question is: do they apply to my company? The usual answer is not directly, unless you are a government body, an entity within critical national infrastructure, or a supplier providing services to those entities.
The current versions are ECC-2:2024 and CCC-2:2024, both issued by the National Cybersecurity Authority (NCA). Their purpose is to raise the security baseline of organizations whose disruption or breach would affect the public interest. A small online store or a salon booking app is not normally asked to prove compliance with them.
The picture changes the moment you decide to sell to a government body or a large company in a critical sector. The requirements then reach you through the contract, the tender documents and security questionnaires, and you may be asked for written evidence of your practices. This guide shows how to tell where you stand and what to start with when you do not have a full security team.
The controls may not bind you today, but your next customer might bind you to them tomorrow.
Who do the ECC and CCC apply to?
| Your situation | Are you involved? | How requirements reach you |
|---|---|---|
| Selling only to consumers (store, booking app) | Usually not directly | Not normally requested, but the basics still protect you |
| Selling to ordinary private companies | Usually not directly | Security questionnaires from some customers |
| Selling to a critical-sector or infrastructure company | Often yes, as a supplier | Contract clauses and security reviews |
| Providing a service or software to a government body | Yes, in most cases | Tender documents, contract and the entity's requirements |
| Providing a cloud service to bound entities | Yes, and the cloud controls apply too | CCC requirements and cloud computing rules |
The core idea is that obligations flow down the supply chain. The bound entity is responsible for the security of what it uses, so it asks its suppliers for assurances. That is why a small company can find itself asked for specific security practices: its customer is the one who is bound.
What do the controls cover, in broad terms?
Without going control by control, the essential controls revolve around familiar cybersecurity themes. Understanding them helps you assess your product and company even if you are not bound.
- Governance: written security policies, a named person responsible for security, risk management and periodic review.
- Defense: identity and access management, protection of systems and networks, encryption, and vulnerability and patch management.
- Resilience: backups, the ability to restore, and business continuity when something goes wrong.
- Third parties and cloud: requirements on suppliers and cloud service providers.
- Logging and monitoring: recording important events, watching them and responding to incidents.
The Cloud Cybersecurity Controls (CCC-2:2024) add requirements specific to cloud providers and the organizations that use them. On data location: ECC-2:2024 no longer contains a blanket in-Kingdom hosting requirement, while government-classified data stays in the Kingdom under the cloud rules of the Communications, Space and Technology Commission (CST). Details are in our guide to hosting your app's data in Saudi Arabia.
What is the minimum a startup should start with?
You do not need a full security team to begin. These basics appear in most security questionnaires, and a two-person company can put them in place within a few weeks.
- 1Name a security owner
Even if it is the founder. What matters is that one named person owns security decisions and follow-up.
- 2Write a short policy
Two pages are enough at first: passwords, permissions, backups, incident handling and suppliers.
- 3Turn on two-factor authentication
On email, the code repository, hosting and payment dashboards, and every admin account.
- 4Apply least privilege
Every employee and user sees only what they need. Clear roles and permissions in the app and the admin panel.
- 5Encrypt and protect data
HTTPS everywhere, encryption at rest, and keys and secrets kept out of the code.
- 6Back up and test restores
At least daily backups and a documented restore test from time to time, because an untested backup cannot be trusted.
- 7Log and monitor
Access logs for the admin panel and sensitive actions, plus alerts on outages or unusual activity.
If your app was built with AI, also run through the security checklist for AI-built apps before pitching to an enterprise customer.
How to prepare a security pack for government and enterprise buyers
What delays large deals most is rarely a weak product. It is the lack of ready answers. Prepare a short security pack for your product that answers the recurring questions.
| Pack section | What to write |
|---|---|
| Product and data overview | What the product does, what data it stores and how that data is classified |
| Hosting and data location | Geographic region, backups, and an in-Kingdom hosting option if available |
| Identity and access | Sign-in method, two-factor authentication, single sign-on (SSO) and roles |
| Encryption | In transit and at rest, plus how keys and secrets are managed |
| Continuity | Backups, restore, update rollback and the committed service level |
| Logs and incidents | Audit logs, monitoring and incident response steps |
| Sub-processors | List of third-party providers and the role of each |
Common startup mistakes
- Believing every Saudi company is bound by every control, and delaying launch
- Or the opposite: ignoring security entirely, then bidding for a government tender
- One admin account shared by the whole team
- Backups that have never been restored
- Hosting whose exact location the founder does not know
- Work out first whether you or your customer is a bound entity
- Adopt the basics early, then extend them per contract
- One account per person, with roles and access logs
- A periodic, documented restore test
- Data location and suppliers documented on one page
Remember too that cybersecurity is tied to the Personal Data Protection Law, which applies to anyone processing personal data in the Kingdom regardless of size.
How Fanann helps you get ready
When you build with Fanann, many basics come ready: in-region hosting with SSL, daily backups and instant rollback, a managed database, phone-number sign-in, and roles and permissions. Enterprise plans add in-country hosting, single sign-on (SSO), audit logs, approvals and an SLA. Because you own the full code and can export it to GitHub, your customer's security team can review it when needed.
This does not make you compliant with the controls automatically; compliance also covers your company's policies, procedures and people. But it spares you from building the technical foundation from scratch.
Build an internal maintenance request system for a company that serves government clients. Roles: requester, maintenance technician, supervisor and system admin. Each role sees only what belongs to it. Add an audit log that records who signed in, when, and what they changed on each request, and that nobody can delete. Use phone-number sign-in with an OTP code and an automatic sign-out after inactivity. Do not store national ID numbers. Add an admin dashboard showing open and overdue requests, and a page to export logs as CSV. Deploy on in-region hosting with daily backups, and make the interface Arabic right-to-left with both Hijri and Gregorian dates.
Try it in FanannKey takeaways
- ECC and CCC mainly bind government bodies, critical infrastructure and their suppliers, not every Saudi company.
- A startup becomes involved in practice when it contracts with a bound entity, which passes the requirements down.
- ECC-2:2024 dropped a blanket in-Kingdom hosting requirement, but government-classified data stays in the Kingdom under the CST cloud rules.
- The basics behind the controls help any product: clear permissions, encryption, backups, logs and supplier management.
- Prepare a short security pack for your product before your first tender. It saves weeks in any large deal.
Frequently asked questions
Do NCA cybersecurity controls apply to private companies?
What is the difference between ECC and CCC?
What cybersecurity requirements apply to Saudi government contracts?
Do the NCA controls require hosting data inside Saudi Arabia?
How can a startup prepare for cybersecurity without a big team?
Ask your AI assistant about this
Copy this prompt into the AI assistant you use, then add the details of your own case.
I am reading this guide: “NCA cybersecurity controls: do they apply to your startup?” https://fanann.com/en/blog/nca-cybersecurity-controls-startups/ My question: nca essential cybersecurity controls ecc explained Use that page as a source and explain the answer step by step for my situation, tell me what to check before I start, and cite the page link.