NCA · ECC-2:2024

Essential Cybersecurity Controls (ECC)

A regulatory framework issued by the National Cybersecurity Authority (NCA) defining the requirements for protecting the information and technology assets of national organizations. It spans cybersecurity governance, defense, resilience, third-party and industrial systems security — a core reference for compliance across the public and private sectors.

Robust solutions, easy to operate, with practical integration into your environment — full coverage of essential controls.

Issuing AuthorityNational Cybersecurity AuthorityVersionECC-2Year2024Bound AudienceGovernment, private sector, and in-scope entities

Controls covered

25+

Active technologies

Security domains

Who are you?

NCA · ECC-2:2024Coverage map

Essential Cybersecurity Controls (ECC) coverage map

The more controls a technology covers, the closer it sits to the strategic tier. Click a technology to explore it.

Covered controls and matching solutions

Control #	Control name & description	Matching technologies
2-1	Asset Management Inventory, classification, acceptable-use	NDR UEM/MDM NAC Data Classification
2-2	Identity & Access Management Authentication, MFA, least privilege	cIAM PAM MFA SSO Windows MFA Passwordless ZTNA
2-3	Systems & Processing Protection Anti-malware, media control, patching	EDR EPM DLP Watermarking UEM/MDM Cybersecurity Advisory Services
2-4	Email Protection Anti-phishing, DMARC, archiving	Email Security Email Archive DMARC Protection Phishing Simulation MFA
2-5	Network Security Management Segmentation, isolation, IPS, DNS	NAC NDR ZTNA Deception Cybersecurity Advisory Services
2-6	Mobile Devices Security BYOD, data separation, remote wipe	UEM/MDM Secure Mobile Container Secure Communication DLP Data Classification
2-7	Data & Information Protection Confidentiality, integrity, availability	DLP Data Classification Watermarking Email Archive Secure Mobile Container
2-8	Cryptography Key management, in-transit/at-rest	Certificate/Key Management Email Archive Secure Communication Secure Mobile Container
2-10	Vulnerability Management Discovery, prioritization, remediation	EDR WAF/WAAP Microgateway Cybersecurity Advisory Services
2-11	Penetration Testing External attack simulation	Cybersecurity Advisory Services
2-12	Event Logs & Monitoring Log collection, analysis, monitoring	NDR Deception WAF/WAAP NAC Cybersecurity Advisory Services
2-13	Incident & Threat Management Response plans, threat intelligence	NDR Deception EDR Email Security WAF/WAAP Cybersecurity Advisory Services
2-15	Web Application Security WAF, HTTPS, layered architecture	WAF/WAAP Microgateway API Security cIAM MFA SSO Certificate/Key Management Cybersecurity Advisory Services

2-1

Asset Management

Inventory, classification, acceptable-use

NDR UEM/MDM NAC Data Classification

2-2

Identity & Access Management

Authentication, MFA, least privilege

cIAM PAM MFA SSO Windows MFA Passwordless ZTNA

2-3

Systems & Processing Protection

Anti-malware, media control, patching

EDR EPM DLP Watermarking UEM/MDM Cybersecurity Advisory Services

2-4

Email Protection

Anti-phishing, DMARC, archiving

Email Security Email Archive DMARC Protection Phishing Simulation MFA

2-5

Network Security Management

Segmentation, isolation, IPS, DNS

NAC NDR ZTNA Deception Cybersecurity Advisory Services

Advisory services

Cybersecurity Advisory Services

Local delivery depth that complements the technologies: security architecture design, gap assessment, penetration testing, and incident response — addressing 7 of NCA · ECC-2:2024's controls that call for advisory expertise, not a product alone.

Architecture design
Gap assessment
Penetration testing
Incident response

Request advisory services

Need something more specific?

Let's design the right path for you

Every organization has its own regulatory context and priorities. If nothing above matches your situation exactly — or you'd prefer an approach built around your reality — talk to Looptech experts to understand your needs and design a path that fits your environment and requirements.