The National Cybersecurity Authority's Essential Cybersecurity Controls framework establishes mandatory requirements for incident response capability across regulated entities in the Kingdom. Control 4-2-1 within Domain 4 requires organisations to develop, document and maintain an incident response plan. Yet a recurring gap emerges during audits: many organisations submit a high-level framework—roles, phases, general procedures—when the control requires scenario-specific playbooks that document exactly what the organisation will do when a particular type of incident occurs.
This article explains the NCA ECC incident response plan playbook requirements, identifies the six scenarios every plan must address, and describes the notification decision matrix that auditors verify in every compliance review. For CISOs, incident response managers and compliance leads preparing or updating their incident response documentation, understanding these specific requirements determines whether your plan will satisfy the control or require remediation.
What NCA ECC Domain 4 Requires in an Incident Response Plan
The National Cybersecurity Authority expects an incident response plan to be an operational document, not a policy statement. The plan must specify how the organisation will detect, assess, contain, eradicate and recover from cybersecurity incidents, and it must include clear procedures for regulatory notification, internal escalation and external communication.
Three elements distinguish a compliant plan from a generic framework:
Scenario-specific playbooks that describe the technical and procedural steps for each major incident type the organisation may face. A single set of generic phases—prepare, detect, analyse, contain, eradicate, recover—does not satisfy the requirement if it fails to address the distinct actions required for ransomware versus data breach versus denial of service.
Defined roles and escalation paths that name or describe by role the individuals responsible for each decision and action during an incident. Auditors look for a contact and escalation matrix that shows who is notified at each severity level, who has authority to declare an incident, who coordinates technical response, and who communicates with executive leadership and the board.
Regulatory notification procedures that specify the criteria triggering notification to the National Cybersecurity Authority, the timeline for that notification, the information to be provided, and the internal approval process before submission. This includes thresholds for customer notification and any sector-specific reporting obligations.
The Six Mandatory Incident Scenarios
While every organisation faces a unique threat landscape, NCA auditors consistently verify that incident response plans address six core scenarios. These scenarios represent the incidents most likely to cause material harm, trigger regulatory reporting, or require coordinated response across multiple teams.
1. Ransomware
The playbook must document the immediate containment steps—network segmentation, system isolation, disabling of remote access—before the malware spreads. It should specify how the organisation will assess the scope of encryption, identify the ransomware variant, determine whether backups are intact and uncompromised, and decide whether to engage law enforcement or external forensic support. The playbook must address the decision process around ransom payment, including legal and regulatory considerations, and the communication plan for affected business units and customers if services are disrupted.
2. Data Breach
This scenario requires procedures for determining what data was accessed or exfiltrated, identifying affected individuals or entities, assessing whether the data was encrypted or otherwise protected, and establishing the timeline of unauthorised access. The playbook should specify how the organisation will preserve evidence, contain further access, and coordinate legal review of notification obligations. Auditors look for clear criteria that trigger customer notification and NCA reporting, and the templates or processes for drafting those notifications.
3. Distributed Denial of Service (DDoS)
The playbook must describe how the organisation will distinguish a DDoS attack from a technical failure, activate mitigation measures such as traffic filtering or upstream provider support, and maintain communication with users during service degradation. It should specify thresholds for escalation based on attack volume or duration, the decision process for engaging a DDoS mitigation service, and the criteria for declaring the incident resolved.
4. Insider Threat
This scenario addresses both malicious and negligent actions by employees, contractors or privileged users. The playbook should specify how the organisation will detect anomalous behaviour, coordinate with human resources and legal teams, preserve evidence without alerting the subject, and revoke access while minimising disruption. It must address the legal and procedural constraints on investigation, the involvement of law enforcement if criminal activity is suspected, and the communication plan that protects both the investigation and the rights of individuals.
5. Supply-Chain Compromise
The playbook must document how the organisation will respond when a vendor, service provider or software supplier discloses a breach or vulnerability that affects the organisation's systems or data. It should specify how the organisation will assess its exposure, identify affected systems or data, determine whether the compromise requires independent investigation, and decide whether the incident triggers its own regulatory reporting obligation. The playbook should address communication with the affected supplier and any contractual or regulatory requirements for vendor incident notification.
6. Cloud Service Failure
This scenario addresses incidents where a cloud service provider experiences an outage, security incident or data loss that affects the organisation's operations or data. The playbook must specify how the organisation will activate business continuity measures, communicate with users, assess data integrity after service restoration, and determine whether the incident requires regulatory notification. It should document the organisation's rights and obligations under cloud service agreements, including the provider's incident notification and reporting responsibilities.
The Notification Decision Matrix Auditors Check First
Beyond the scenario playbooks, auditors consistently examine the notification decision matrix—the documented criteria and process for determining who must be notified, when, and by whom. This matrix typically addresses three categories of notification:
Internal escalation specifies the severity levels or incident types that trigger notification to the chief information security officer, chief information officer, chief executive officer, board of directors, or board risk committee. The matrix should include timeframes—immediate notification for critical incidents, daily briefings for ongoing response, post-incident summary for lower-severity events.
NCA reporting documents the criteria that trigger mandatory notification to the National Cybersecurity Authority. These typically include incidents that affect critical infrastructure, compromise personal data, disrupt essential services, or meet materiality thresholds defined by the regulator. The matrix must specify the timeline for initial notification, the information to be provided, the process for submitting updates as the investigation progresses, and the individual or role responsible for preparing and submitting the report.
Customer and external communication addresses when and how the organisation will notify affected customers, business partners, or the public. The matrix should specify legal and regulatory triggers for notification, the approval process for external communication, the templates or formats to be used, and the coordination with legal counsel and public relations.
Auditors verify that this matrix is not theoretical. They look for evidence that the organisation has tested the notification procedures, that contact information is current, and that individuals in notification roles understand their responsibilities.
Common Gaps in Incident Response Documentation
Three gaps appear consistently when organisations prepare incident response plans for NCA ECC compliance:
Generic procedures without scenario specificity. A plan that describes incident response phases in general terms but fails to document the distinct technical and procedural steps for ransomware, data breach, or other scenarios does not satisfy the control. Each playbook must be actionable by the teams who will execute it during an actual incident.
Undefined decision authority. Plans that assign tasks to roles—"the incident manager will assess severity"—without specifying who holds that role, how they are reached, and who has authority to make critical decisions such as taking systems offline, engaging external support, or notifying regulators. The contact and escalation matrix must be specific enough to use during an incident.
Untested notification procedures. Organisations document notification criteria and timelines but fail to test whether individuals can actually execute those procedures under time pressure. Regulatory reporting templates remain drafts, contact lists are outdated, and the approval process for external communication has never been rehearsed.
A Sensible Order of Work
Developing or updating an incident response plan to meet NCA ECC requirements follows a logical sequence:
Assess current capability. Review existing incident response documentation, past incident handling, and any gaps identified in previous audits or exercises. Identify which of the six mandatory scenarios already have documented playbooks and which require development.
Define roles and authority. Establish the incident response team structure, assign specific roles, document decision authority for critical actions, and build the contact and escalation matrix. Verify that individuals in key roles are aware of their responsibilities and have the access and authority to perform them.
Develop scenario playbooks. For each of the six mandatory scenarios, document the specific technical and procedural steps, decision points, escalation triggers, and coordination requirements. Ensure each playbook addresses the notification decision matrix for that scenario.
Document notification procedures. Specify the criteria, timelines, content and approval process for NCA reporting, internal escalation, and customer communication. Prepare templates for regulatory notifications and external communication.
Test through tabletop exercises. Conduct scenario-based exercises with technical teams and executive leadership to verify that playbooks are actionable, roles are clear, and notification procedures work under time pressure. Document lessons learned and update the plan accordingly.
Maintain and improve. Establish a schedule for plan review and update, incorporate lessons from actual incidents and exercises, and ensure the plan evolves as the organisation's technology, threats and regulatory obligations change.
How We Prepare Organisations to Respond
When an incident occurs, the quality of your documented plan determines whether your teams respond with confidence or improvise under pressure. Our Incident Response Readiness & Tabletop Exercises service prepares organisations to meet NCA ECC Domain 4 requirements and respond effectively when incidents occur.
We assess current capability and past incidents, then develop an incident response plan and policy that includes the scenario playbooks, contact and escalation matrix, and regulatory notification procedures the National Cybersecurity Authority expects. The service includes tabletop exercises with technical teams and executives to test the plan under realistic scenarios, followed by an exercise report with improvements that refine the plan based on lessons learned.
The engagement typically requires four to eight weeks and delivers a complete incident response plan and playbook set, contact and escalation matrix, and exercise report. The service addresses NCA ECC and SAMA Cyber Security Framework requirements, ensuring your documentation satisfies regulatory expectations and your teams know exactly who does what in the first hours of an incident.
For organisations that experience an actual incident, our Digital Forensics & Incident Investigation service provides specialist support to contain the incident, preserve evidence, investigate root cause and scope, and support regulatory reporting and recovery.
Incident response capability is not a document you submit for compliance review. It is the operational readiness that determines whether your organisation can detect, contain and recover from the incidents that will inevitably occur. Meeting NCA ECC 4-2-1 requires scenario-specific playbooks, a tested notification matrix, and teams who have rehearsed their response before the pressure of a real event.
