The National Cybersecurity Authority's Essential Cybersecurity Controls framework requires essential entities to monitor the cybersecurity posture of third parties on a continuous basis. Control 3-3-2 addresses NCA ECC third party monitoring, but the framework does not prescribe the frequency of reviews, the triggers that should prompt reassessment, or the forms of evidence that auditors will accept. For compliance managers, procurement leads, and CISOs preparing for or undergoing NCA ECC assessments, this ambiguity creates a practical challenge: how do you demonstrate that monitoring is genuinely continuous, rather than a single due-diligence exercise at onboarding followed by silence?
This article explains what continuous monitoring means in operational terms, the four mechanisms we implement to satisfy the requirement, and how to document each for NCA audits.
Why Control 3-3-2 Exists
Third parties—cloud providers, managed security services, payment processors, software vendors—often hold privileged access to your systems or process sensitive data on your behalf. Their cybersecurity posture is not static. A vendor that passed your initial assessment may suffer a breach, lose key personnel, change ownership, or fall behind on patching. The risk you accepted at contract signature can degrade silently unless you have a mechanism to detect and respond to changes.
Control 3-3-2 requires that essential entities do not treat third-party risk as a point-in-time exercise. The intent is to ensure that you know, at any moment, whether a vendor still meets the security standard you require, and that you can act when it does not.
What 'Continuous' Does Not Mean
Continuous monitoring does not mean real-time telemetry from every vendor's environment, nor does it require daily questionnaires. The term is better understood as ongoing and event-driven, rather than uninterrupted. What the NCA expects to see is a documented program that combines scheduled reviews with mechanisms to detect material changes between those reviews.
Many essential entities make the mistake of conducting a thorough assessment at onboarding, filing the report, and doing nothing until the contract renews three years later. When the NCA auditor asks for evidence of continuous monitoring, the organization has none. A single annual questionnaire is better, but still insufficient if a vendor suffers a breach in month two and you learn about it from the news.
The Four Monitoring Mechanisms
We implement four complementary mechanisms that together satisfy the continuous-monitoring requirement. Each serves a different purpose, and the combination provides both scheduled checkpoints and event-driven alerts.
1. Threat-Feed and Breach-Intelligence Alerts
The first mechanism is passive monitoring of external threat intelligence. We subscribe to commercial and open-source feeds that track data breaches, ransomware incidents, and security disclosures affecting organizations worldwide. When a vendor in your tiered register appears in a breach report, you receive an alert.
This mechanism does not require the vendor's cooperation and operates continuously in the background. It is particularly valuable for detecting incidents that vendors may be slow to disclose or may not disclose at all if they believe your data was not affected.
Documentation for NCA audits: Maintain a log of alerts received, the vendors affected, and the action taken—whether that was a formal inquiry, an emergency reassessment, or a determination that the incident did not affect your data. The log demonstrates that you are monitoring vendor risk between scheduled reviews.
2. Annual or Risk-Based Questionnaires
The second mechanism is a scheduled reassessment cycle. We set reassessment intervals based on the vendor's risk tier: critical vendors are reassessed annually, high-risk vendors every 18 months, and lower tiers every two or three years.
Each reassessment uses the same questionnaire and evidence requests as the initial assessment, updated to reflect any changes in your requirements or the regulatory landscape. The vendor submits current policies, recent penetration-test reports, ISO 27001 certificates if applicable, and answers to control-specific questions.
This mechanism is the backbone of continuous monitoring. It ensures that even if no external alert fires, you refresh your understanding of the vendor's posture at defined intervals.
Documentation for NCA audits: The tiered vendor register should record the last assessment date and the next scheduled review for each vendor. Questionnaire responses, evidence files, and the resulting assessment report are filed together. The auditor should be able to see that no critical vendor has gone more than 12 months without reassessment.
3. Contractual Breach-Notification Obligations
The third mechanism is a contract clause that requires the vendor to notify you of any security incident, data breach, or material change in its security posture within a defined period—typically 24 or 72 hours for incidents, and 30 days for changes such as new subprocessors or relocation of data.
This obligation shifts some of the monitoring burden to the vendor and creates a legal duty to disclose. It is not foolproof—vendors may interpret 'material' narrowly or delay notification—but it provides a formal channel and a basis for remedies if the vendor fails to notify.
Documentation for NCA audits: The contract security schedule or data-processing addendum should include the notification clause. When a vendor does notify you of an incident or change, document the notification, your review, and any follow-up actions. The existence of the clause and evidence that you act on notifications shows that monitoring is embedded in the contractual relationship.
4. Trigger-Based Reviews at Contract Renewal or Change
The fourth mechanism is a policy rule that requires reassessment whenever a vendor relationship changes materially: contract renewal, expansion of scope, addition of a new service, or a change of control such as acquisition.
These events are natural checkpoints. A contract renewal is an opportunity to update security requirements and refresh evidence. An expansion of scope—such as moving from a single application to enterprise-wide deployment—may elevate the vendor's risk tier and trigger a more rigorous assessment.
Documentation for NCA audits: The third-party risk policy should list the triggers that require reassessment. Procurement and legal teams should be trained to notify the cybersecurity or compliance function when a trigger event occurs. The vendor register should record the reason for each reassessment, whether scheduled or triggered.
How to Document Continuous Monitoring for NCA Audits
The NCA auditor will ask for evidence that monitoring is happening, not just that a policy exists. The following artifacts, taken together, demonstrate a functioning continuous-monitoring program:
- Third-party risk policy that defines reassessment intervals, trigger events, and responsibilities.
- Tiered vendor register showing the last assessment date and next review date for each vendor, with risk tier clearly marked.
- Threat-intelligence alert log recording external alerts, the vendors affected, and actions taken.
- Reassessment reports for each vendor, filed chronologically, showing that critical vendors are reviewed at least annually.
- Breach-notification clauses in contracts, and a log of notifications received and reviewed.
- Change-request or procurement records showing that reassessments were triggered by contract renewals or scope changes.
The auditor is looking for a system, not perfection. If a vendor was reassessed 13 months after the last review instead of 12, that is acceptable if the register shows the schedule and the delay was brief. What is not acceptable is a vendor that was assessed three years ago and has not been reviewed since, with no alert log, no contract clause, and no explanation.
Common Gaps and How to Close Them
Gap one: The organization has a vendor inventory, but no risk tiers and no reassessment schedule. Every vendor is treated the same, and none are reassessed because the volume is overwhelming.
Solution: Tier the vendors by risk—data sensitivity, access level, criticality to operations—and apply different reassessment intervals. Focus resources on the critical and high-risk tiers first. We use a risk-based classification to make the program sustainable.
Gap two: The organization sends annual questionnaires, but has no mechanism to detect incidents between questionnaires.
Solution: Add threat-feed monitoring and contractual breach-notification obligations. These mechanisms operate continuously and catch events that would otherwise go unnoticed until the next scheduled review.
Gap three: The organization monitors vendors, but does not document what it does. The work happens in email threads and spreadsheets that are not retained or organized.
Solution: Centralize documentation in a vendor register and a monitoring log. Every alert, every reassessment, every notification should be recorded with a date, the action taken, and the outcome. The documentation is the evidence.
When to Seek Support
You should consider external support if any of the following apply:
- You are preparing for an NCA ECC assessment and have no documented third-party monitoring program.
- You have a vendor inventory, but no risk tiers, no reassessment schedule, and no process for responding to vendor incidents.
- You conduct initial due diligence at onboarding, but nothing happens after contract signature.
- You lack the internal capacity to design questionnaires, review evidence, or maintain a monitoring log while managing other compliance priorities.
- You need contract security clauses drafted in Arabic and English that reflect NCA ECC requirements and are acceptable to vendors.
How We Run Third-Party Monitoring Programs
We set up and run your third-party cyber risk program: vendor tiering, due-diligence questionnaires, contract clauses, assessments and ongoing monitoring.
The process follows four steps. First, we build an inventory of vendors, the services they provide, and the data they access or process. Second, we apply risk-based classification to tier the vendors—critical, high, medium, low—based on data sensitivity, access level, and operational criticality. Third, we assess each vendor using questionnaires, evidence reviews, and where warranted, on-site or remote assessments. Fourth, we establish the monitoring and reassessment cycle, including threat-feed alerts, scheduled questionnaires, breach-notification tracking, and trigger-based reviews.
Deliverables include a third-party risk policy and procedure, a tiered vendor register, a questionnaire library tailored to your risk tiers and the frameworks you must meet, a contract security schedule with notification and audit clauses, and vendor assessment reports for each third party.
The frameworks we apply include the NCA Essential Cybersecurity Controls and the Saudi Central Bank Cybersecurity Framework.
Setup takes four to six weeks, after which the program runs on an ongoing retainer basis. We maintain the vendor register, send and review reassessment questionnaires, monitor threat feeds, log incidents and notifications, and prepare reports for internal governance and NCA audits.
Closing
Control 3-3-2 requires continuous monitoring, but does not tell you how to do it. The four mechanisms—threat-feed alerts, scheduled reassessments, contractual breach notifications, and trigger-based reviews—provide a practical, auditable answer. Together, they ensure that you know whether your vendors still meet your security standard, and that you can demonstrate that knowledge to the NCA.
If you need to design, document, or operate a third-party monitoring program that satisfies NCA ECC requirements, we can help. Our Third-Party & Supply-Chain Cyber Risk service builds the program from inventory to ongoing monitoring, with all documentation in Arabic and English, and delivers the evidence auditors expect to see.
