Saudi companies that start looking into cybersecurity compliance usually meet two names: the NCA Essential Cybersecurity Controls (ECC) and Saudi Aramco’s SACS-210. They cover similar ground, but they come from different authorities, apply to different companies and are proven in different ways. Treating one as a replacement for the other is a common and expensive mistake.
Two Authorities, Two Purposes
NCA ECC is issued by the National Cybersecurity Authority, the national regulator for cybersecurity. It sets the minimum cybersecurity requirements for government entities and their companies, and for private-sector entities that own, operate or host critical national infrastructure. The current version is ECC-2:2024, which updated the original 2018 release.
SACS-210 is Saudi Aramco’s Third-Party Cybersecurity Standard. It replaced SACS-002 in February 2026. It is not a national regulation: it is a requirement Aramco places on the companies it works with. Every third party that processes Aramco information, connects to its network, accesses its endpoints or supplies it with technology must meet it, whatever its size.
How Each One Is Structured
ECC-2:2024 is organized into four main domains:
- Cybersecurity governance.
- Cybersecurity defence.
- Cybersecurity resilience.
- Third-party and cloud computing cybersecurity.
SACS-210 starts with 33 General Requirements (TPC-1.1 to TPC-1.33) that apply to every third party, grouped as Govern, Identify, Protect, Detect and Respond. Companies in specific classes, such as those with network connectivity to Aramco or those processing critical data, have additional requirements on top.
Where They Overlap
Both frameworks ask for the same foundations:
- Governance: approved cybersecurity policies and defined responsibilities.
- Identity and access: unique accounts, least privilege and multi-factor authentication.
- Email security: anti-spam, attachment scanning, SPF, DKIM and DMARC.
- Endpoint protection: anti-malware, firewalls and patching.
- Logging and monitoring: audit logs that are enabled and protected.
- Incident response: a documented process for handling incidents.
A company that has built one of them properly has already done much of the technical work for the other.
Where They Differ
- Depth of governance. The ECC goes further on strategy, risk management, roles and business continuity. SACS-210’s General Requirements focus on practical controls a contractor can implement and evidence quickly.
- Specific requirements. SACS-210 has items the ECC does not phrase the same way, such as notifying Aramco within 24 hours of a cybersecurity incident (TPC-1.32), a private company email domain (TPC-1.23) and blocking Office macros from external files (TPC-1.24).
- How compliance is shown. For SACS-210, the company obtains a Cybersecurity Compliance Certificate (CCC) from an authorized audit firm, after an evidence report and a live audit session, and renews it before it expires. ECC compliance is demonstrated to the NCA through the assessment process that applies to the entity.
Which One Applies to You?
- You work with Saudi Aramco as a vendor, contractor or service provider: SACS-210 applies, and you need the CCC.
- You are a government entity, a government-owned company, or you operate critical national infrastructure: the ECC applies.
- Both: common for larger contractors. Build one security program that meets the stricter of the two in each area, then produce the evidence each framework asks for.
- Neither yet: the ECC is still a strong, recognized baseline, and the NCA encourages other organizations to use it as good practice.
One Program, Two Frameworks
The efficient approach is not two parallel projects. Build the shared foundation once, identity, email, endpoints, logging and policies, then add what each framework needs on top: the governance and resilience depth of the ECC, and the specific controls and certificate process of SACS-210.
For the full SACS-210 list, read SACS-210 controls explained.
How SirajTech Helps
We implement both: SACS-210 certification for Aramco contractors, with more than 300 certificates delivered, and NCA ECC compliance from gap assessment to evidence pack.
Tell us which framework you need and we will show you where you stand.
