Saudi Arabia Compliance
One ISMS. Multiple Saudi frameworks.
ISO 27001 is the international standard that underpins Saudi Arabia's cybersecurity regulatory landscape. The NCA Essential Cybersecurity Controls, SAMA CSF, and every sector-specific framework are built on it. We implement the controls once in your Microsoft 365 environment — then map the evidence to every framework you're measured against.
The Saudi cybersecurity framework hierarchy
Every Saudi cybersecurity framework traces back to international standards. ISO 27001 certification is the most efficient path to compliance across all of them.
The international foundation. All Saudi frameworks reference or extend it.
Baseline for all government entities and critical national infrastructure operators.
Financial sector: banks, insurance, payment providers regulated by SAMA.
Our ISO 27001 controls cover KSA requirements
of 93 ISO controls map to NCA ECC
of 93 ISO controls map to SAMA CSF
NCA ECC controls covered via ISO 27001 mapping
Framework details
NCA Essential Cybersecurity Controls (ECC-2:2024)
The baseline cybersecurity framework for Saudi Arabia. ECC-2:2024 replaced ECC-1:2018 in October 2024 with explicit alignment to ISO/IEC 27001:2022 and NIST Cybersecurity Framework.
Strategy, roles, risk management, compliance, awareness, third-party management, programme management
Asset management, identity & access, data security, network, endpoint, application, vulnerability, monitoring, incident, cryptography, configuration
Business continuity, backup & recovery, physical security, secure development, change management
Emerging technologies, security architecture, threat intelligence, security testing, continuous improvement
Applies to: All government entities and critical national infrastructure operators
Browse controls by ECC domainSAMA Cyber Security Framework
Mandatory for all SAMA-regulated financial institutions. Built on ISO 27001, NIST CSF, PCI-DSS, and BASEL standards. Uses a 6-level maturity model (0-5) where Level 3 ("Structured and Formalised") is the minimum compliance target.
Governance framework, strategy, policies, organisational structure
Risk framework, assessments, treatment, monitoring
Asset management, identity, data protection, network, endpoint, application security, incident management
Architecture standards, cryptography, secure development, cloud security
Performance measurement, audit, compliance monitoring, continuous improvement
Applies to: Banks, insurance companies, payment service providers, and other SAMA-regulated entities
Assess your compliance across all Saudi frameworks
Our free assessment evaluates your Microsoft 365 configuration against ISO 27001 and maps findings to NCA ECC and SAMA CSF requirements — showing you exactly where you stand across all applicable frameworks.