Saudi Regulatory Frameworks
Pick the framework that binds you, and see how our technologies translate every control into an applied practice.
| Indicator | ECC | OTCC | CSF | SACS |
|---|---|---|---|---|
| Authority | National Cybersecurity Authority | National Cybersecurity Authority | Saudi Central Bank | Saudi Aramco |
| Audience | Government, private sector, and in-scope entities | Industrial & operational | Financial sector | Aramco suppliers |
| Year | 2024 | 2022 | 2017 | 2026 |
| Version | ECC-2 | OTCC-1 | v1.0 | SACS-210 |
| Controls covered | 13 | 11 | 16 | 15 |
| Document source | Visit | Visit | Visit | Visit |
The national foundation
NCA · ECC-2:2024
National Cybersecurity Authority NCA
Official websiteAudience: Government, private sector, and in-scope entities
The regulatory foundation for cybersecurity in the Kingdom, covering the defensive domain with practical controls for government entities and committed organizations.
13
controls covered
25+
active technologies
Built for operational environments
NCA · OTCC-1:2022
National Cybersecurity Authority NCA
Official websiteAudience: Industrial & operational
Designed to protect operational environments, industrial IoT, and IT+OT architectures — with controls sensitive to production continuity.
11
controls covered
22+
active technologies
Built for your financial compliance
SAMA · CSF v1.0
Saudi Central Bank SAMA
Official websiteAudience: Financial sector
The reference framework for financial institutions under Central Bank supervision — banks, insurance, financing companies, and payments.
16
controls covered
26+
active technologies
Your gateway to the Aramco supplier network
Aramco · SACS-210
Saudi Aramco Aramco
Official websiteAudience: Aramco suppliers
The standard that opens the door to working with Saudi Aramco as a trusted supplier — from cloud to operational environments.
15
defensive areas covered
24+
active technologies
Our consultants are ready to answer your questions.
