# How We Deliver an NCA ECC Compliance Assessment in Four Weeks: Evidence Collection to Self-Assessment Upload
Preparing your first National Cybersecurity Authority Essential Cybersecurity Controls self-assessment under a tight deadline requires a structured approach. Many CISOs and IT directors at regulated entities in the Kingdom face the same challenge: the NCA ECC compliance assessment process must be thorough, evidence-based and complete within the submission window. This article walks through the four weekly phases—scoping and evidence request, control testing, gap remediation, and portal submission—that we use for every NCA ECC engagement. You will see the exact deliverables, client sign-offs and timeline dependencies that keep the project on track.
The National Cybersecurity Authority published the Essential Cybersecurity Controls framework to establish a minimum cybersecurity posture for entities operating critical infrastructure and information systems in Saudi Arabia. ECC-2:2024 introduced structural changes and new requirements compared to the earlier ECC-1:2018 framework. Entities must complete a self-assessment and submit evidence of compliance through the NCA portal. The assessment covers five domains: cybersecurity governance, cybersecurity defence, cybersecurity resilience, third-party and cloud computing cybersecurity, and industrial control systems cybersecurity.
A four-week engagement is achievable when the entity has existing controls, documentation and a dedicated point of contact who can coordinate evidence collection across departments. The timeline assumes that technical evidence—configuration exports, log samples, vulnerability scan reports—can be retrieved within the first week and that remediation activities address documentation gaps rather than require new technology deployment. Entities starting from a lower maturity baseline or those implementing controls for the first time will require the standard duration.
This article describes the accelerated four-week variant of our compliance assessment, remediation and self-assessment support for the NCA Essential Cybersecurity Controls.
Phase One: Scoping and Evidence Request (Week One)
The first phase establishes the assessment boundary, identifies control applicability and issues the evidence request list. This phase determines whether the four-week timeline is realistic or whether a longer engagement is necessary.
Kick-off and Scoping Workshop
The engagement begins with a scoping workshop attended by the CISO, IT director, compliance lead and representatives from information security, IT operations, human resources and legal. The workshop covers:
- Entity classification under the NCA framework (critical, vital or essential) and the corresponding control applicability.
- System inventory to identify all information systems, cloud services, industrial control systems and third-party connections within scope.
- Existing compliance artifacts such as policies, procedures, risk registers, incident logs and audit reports.
- Organisational structure to map control ownership and identify who will provide evidence for each domain.
At the end of the workshop, the client holds a scoping document that lists all systems in scope, the applicable controls from ECC-2:2024, and the names of the individuals responsible for each evidence category.
Evidence Request and Collection Plan
Immediately after scoping, we issue a detailed evidence request list organised by control domain. The list specifies the type of evidence required for each control: policies, procedures, configuration screenshots, log extracts, training records, vendor contracts, penetration test reports and business continuity plans.
The evidence request includes:
- The specific control reference from ECC-2:2024.
- A description of what the control requires.
- The type of evidence that will demonstrate compliance (for example, a policy document, a configuration export, or a signed attestation).
- The format and level of detail needed (redacted screenshots are acceptable; narrative descriptions alone are not).
- The deadline for submission, typically five business days from the kick-off.
The client appoints a single point of contact who coordinates evidence collection across departments. This role is critical: delays in evidence submission extend every subsequent phase.
At the end of week one, the client holds the scoping document and the evidence request list, and evidence collection is underway.
Phase Two: Control Testing and Gap Analysis (Week Two)
The second phase evaluates the evidence against each control requirement, identifies gaps and assigns a compliance status. This is the most intensive phase and requires daily communication between the assessment team and the client point of contact.
Evidence Review and Control Testing
As evidence arrives, we review each artifact against the corresponding control requirement. The review follows a control-by-control compliance status methodology:
- Compliant: Evidence demonstrates that the control is implemented as required by ECC-2:2024.
- Partially compliant: The control is implemented but does not fully meet the requirement (for example, a policy exists but does not cover all required elements).
- Non-compliant: No evidence of implementation, or the implementation does not address the control objective.
- Not applicable: The control does not apply to the entity's classification or system environment.
For each control, we document:
- The evidence reviewed.
- The compliance status.
- The specific gap, if any, with a reference to the missing or incomplete requirement.
- The recommended remediation action.
Gap Analysis Workshop
Mid-week, we conduct a gap analysis workshop with the same stakeholders from the kick-off. The workshop presents the preliminary findings, discusses ambiguous controls and clarifies any evidence that was unclear or incomplete. This session often reveals that certain controls are implemented in practice but not documented, or that evidence exists but was not initially provided.
The workshop also prioritises gaps. Some gaps can be closed within the remaining two weeks through documentation updates; others require process changes or technology deployment that will extend beyond the four-week window. We distinguish between quick wins (gaps that can be closed before submission) and roadmap items (gaps that will be addressed in a future compliance cycle).
At the end of week two, the client holds a draft compliance assessment report with control-by-control compliance status and a preliminary gap list.
Phase Three: Gap Remediation and Documentation (Week Three)
The third phase focuses on closing the gaps identified in phase two, with priority given to documentation and process gaps that can be resolved quickly.
Remediation Planning
We prepare a remediation plan with owners, dates and effort estimates for each gap. The plan categorises remediation activities into three tracks:
- Documentation track: Policies, procedures and records that can be drafted or updated within the week.
- Configuration track: Technical settings that can be adjusted without service disruption (for example, enabling logging, adjusting password complexity settings, or updating firewall rules).
- Deferred track: Gaps that require budget approval, vendor engagement or significant process redesign, which will be addressed after the self-assessment submission.
The client assigns an owner and a target completion date for each remediation item. The remediation plan becomes a tracker that is updated daily as items are completed.
Policy and Procedure Development
For entities that lack formal documentation, we provide policies and procedures aligned to the 2024 controls. These documents are tailored to the entity's environment and include:
- Information security policy.
- Access control policy and procedures.
- Incident response plan.
- Business continuity and disaster recovery plan.
- Third-party risk management policy.
- Acceptable use policy.
- Data classification and handling procedure.
Each document references the specific ECC-2:2024 controls it addresses. The client reviews and approves each document, and the final versions are signed by the CISO or equivalent authority.
Evidence Re-collection
As remediation activities are completed, we re-collect evidence to update the compliance status. For example, once a new policy is signed, it becomes evidence of compliance for the relevant controls. Once a configuration change is applied, we request a fresh screenshot or export.
At the end of week three, the client holds an updated compliance assessment report, a complete set of policies and procedures, and a remediation tracker showing which gaps have been closed and which remain open.
Phase Four: Self-Assessment Submission (Week Four)
The fourth phase finalises the assessment report, prepares the self-assessment responses and uploads all evidence to the NCA portal.
Final Compliance Assessment Report
We finalise the compliance assessment report with the updated compliance status for every control. The report includes:
- An executive summary of overall compliance, organised by domain.
- Control-by-control findings with evidence references.
- A summary of gaps closed during the engagement.
- A summary of open gaps and the remediation roadmap.
- Recommendations for the next compliance cycle.
The report is reviewed and approved by the CISO and, where required, presented to the board or executive committee.
Self-Assessment Portal Preparation
The NCA self-assessment portal requires entities to respond to each applicable control, upload supporting evidence and provide narrative explanations where necessary. We provide support through the NCA self-assessment by:
- Drafting the narrative responses for each control based on the evidence reviewed.
- Organising evidence files with clear naming conventions that map to control references.
- Preparing a submission checklist to ensure no control is missed.
- Conducting a final review of all responses before upload.
The client retains responsibility for the actual portal login and submission, but we prepare all content and provide step-by-step guidance.
Final Deliverables and Handover
At the end of week four, the client holds the complete set of deliverables:
- Compliance assessment report with control-by-control compliance status and evidence references.
- Remediation plan and tracker with owners, dates and effort estimates for open gaps.
- Policy and procedure set aligned to ECC-2:2024.
- Self-assessment submission support including drafted responses and organised evidence files.
- Executive summary suitable for board reporting.
We conduct a handover session to walk through the remediation tracker and establish a timeline for addressing deferred gaps. This session also discusses how the entity can maintain compliance and prepare for the next assessment cycle, creating a baseline you can re-measure every year.
What This Process Delivers
The four-week NCA ECC compliance assessment process is designed for entities that have existing controls and documentation but need expert guidance to map their current state to ECC-2:2024, close documentation gaps and submit a complete self-assessment on time.
The process delivers clarity at every phase. After week one, you know exactly which controls apply and what evidence is needed. After week two, you know your compliance status and the size of each gap. After week three, you have closed the quick wins and have a roadmap for the rest. After week four, you have submitted your self-assessment and hold a compliance baseline for future cycles.
Entities that complied with ECC-1:2018 often ask what changes with the new framework. The structure and several requirements changed, and we map existing compliance to the new controls so you only address what is actually new or different.
The timeline depends on evidence availability, stakeholder availability for workshops and the complexity of remediation. Entities with limited documentation, distributed IT environments or significant control gaps will require the standard duration of six to ten weeks for the assessment.
Moving Forward with Your NCA ECC Compliance Assessment
If your entity is preparing its first NCA Essential Cybersecurity Controls self-assessment or facing a submission deadline, a structured phase-by-phase approach ensures that nothing is missed and that every control is addressed with appropriate evidence.
Our NCA Essential Cybersecurity Controls service provides compliance assessment, remediation and self-assessment support for entities subject to the NCA framework, with readiness for ECC-2:2024 delivered control by control. To discuss your timeline and scope, contact us to begin the scoping phase.
