Essential Cybersecurity Controls (ECC – 2 : 2024) Cybersecurity Management

• 1-2-1

  A dedicated cybersecurity function (e.g., division, department) must be established within the organization. This function must be independent from the Information Technology/Information Communication and Technology (IT/ICT) functions (as per the Royal Decree number 37140 dated 14/8/1438H). It is highly recommended that this cybersecurity function reports directly to the head of the organization or his/her delegate while ensuring that this does not result in a conflict of interest.

• 1-2-2

  All Cybersecurity positions must be filled with full-time and experienced Saudi cybersecurity professionals.

• 1-2-3

  A cybersecurity steering committee must be established by the Authorizing Official to ensure the support and implementation of the cybersecurity programs and initiatives within the organization. Committee members, roles and responsibilities, and governance framework must be defined, documented and approved. The committee must include the head of the cybersecurity function as one of its members. It is highly recommended that the committee reports directly to the head of the organization or his/her delegate while ensuring that this does not result in a conflict of interest.

Need help putting this into practice? See our NCA ECC compliance services or read our NCA ECC articles.