NCA ECC Control Change Tracker Q1 2025: Eight Amended Requirements and the Evidence Adjustments They Require
The National Cybersecurity Authority periodically updates Essential Cybersecurity Controls (ECC) control language, clarifies evidence expectations, and adds technical specifications to align with evolving threat landscapes and international standards. Many institutions maintaining their self-assessment or preparing for re-certification discover NCA ECC control changes 2025 only when an external assessor flags a gap during fieldwork, triggering last-minute evidence collection and policy revisions that delay certification timelines and consume internal resources.
This checklist presents eight control amendments issued by the NCA in the first quarter of 2025, explains what changed in each—scope, evidence type, or technical threshold—identifies which policies, procedures, or technical configurations you must update, and provides a simple before-and-after comparison so compliance teams can adjust their evidence repository and self-assessment responses without re-doing the entire programme.
Why Control Amendments Matter More Than Annual Reviews
Annual ECC self-assessments typically focus on whether existing controls remain effective. Control amendments, however, introduce new obligations that existing evidence may not satisfy. A scope expansion from "critical systems" to "all systems processing personal data" requires new inventory records, updated risk classifications, and additional technical logs. A shift from "documented procedure" to "automated enforcement with audit trail" demands configuration changes, not just policy updates. Missing these distinctions during self-assessment creates findings during external audits that could have been resolved months earlier with targeted adjustments.
The eight amendments below follow a consistent structure: the control domain, what changed, why the NCA introduced the change, which evidence you must now produce, and which internal documents or technical configurations require updates.
The Eight Amended Controls
1. Asset Management: Expanded Scope to Include Cloud-Hosted Assets
What changed: The asset inventory requirement now explicitly includes assets hosted in public cloud environments, software-as-a-service applications, and platform-as-a-service components, not only on-premises infrastructure.
Why the NCA introduced this: Cloud adoption has accelerated across regulated entities, yet many asset registers still reflect only traditional data-centre inventories, leaving shadow IT and cloud workloads undocumented.
Evidence you must now produce:
- Asset inventory records that list cloud-hosted virtual machines, storage buckets, managed databases, and SaaS subscriptions, with the same metadata fields required for on-premises assets: owner, classification, location, and lifecycle stage.
- Configuration management database exports or cloud asset discovery tool reports showing continuous synchronisation between your inventory and actual deployed resources.
What to update:
- Asset management policy: add cloud asset discovery procedures and define responsibility for maintaining cloud inventory accuracy.
- Asset inventory template: add fields for cloud service provider, region, subscription identifier, and service tier.
- Quarterly inventory reconciliation process: include API-driven discovery scans for cloud environments.
2. Access Control: Multi-Factor Authentication Threshold Lowered
What changed: Multi-factor authentication is now mandatory for all remote access to any system processing or storing regulated data, not only privileged administrative access.
Why the NCA introduced this: Credential-based attacks targeting standard user accounts have become the most common initial access vector in incidents reported to the NCA.
Evidence you must now produce:
- Authentication logs demonstrating MFA enforcement for remote access sessions, segmented by user role and system type.
- Configuration screenshots or policy exports from identity providers showing MFA required for all remote access, with no user exemptions.
What to update:
- Access control policy: remove language limiting MFA to privileged users; specify MFA methods acceptable under the control (hardware tokens, authenticator applications, or biometric factors).
- Identity and access management system configuration: enable MFA requirement for all remote access profiles.
- User access request and approval workflow: add MFA provisioning as a mandatory step before granting remote access.
3. Vulnerability Management: Reduced Patching Timeframe for Critical Vulnerabilities
What changed: The maximum remediation timeframe for critical vulnerabilities in internet-facing systems dropped from 30 days to 14 days from disclosure.
Why the NCA introduced this: Analysis of recent incidents showed that attackers routinely weaponise critical vulnerabilities within two weeks of public disclosure, faster than many organisations' previous patch cycles.
Evidence you must now produce:
- Vulnerability scan reports with remediation timestamps showing closure within 14 days for critical findings on internet-facing assets.
- Exception records for any critical vulnerability exceeding 14 days, including risk acceptance signed by senior management and documented compensating controls.
What to update:
- Vulnerability management procedure: revise patching service-level objectives to reflect the 14-day threshold; define escalation paths for patches that cannot meet the deadline.
- Change management process: create an expedited change approval track for critical security patches on internet-facing systems.
- Vulnerability tracking dashboard: add automated alerts at day 10 for open critical vulnerabilities approaching the 14-day limit.
4. Data Protection: Encryption Key Rotation Frequency Specified
What changed: The control now specifies that encryption keys protecting data at rest must be rotated at least annually, and immediately upon any suspected compromise or personnel departure with key access.
Why the NCA introduced this: The previous control required "periodic" rotation without defining frequency, leading to inconsistent implementation and keys remaining static for years.
Evidence you must now produce:
- Key management system logs showing rotation dates for all encryption keys protecting regulated data, with rotation intervals not exceeding 12 months.
- Incident response records demonstrating key rotation triggered by access events such as administrator termination or security incidents.
What to update:
- Data protection policy: specify annual key rotation requirement and define triggering events for immediate rotation.
- Key management procedure: document rotation process, including pre-rotation testing, rotation execution, and post-rotation validation steps.
- Key lifecycle calendar: schedule annual rotation tasks for each key, with reminders at 10 and 11 months.
5. Logging and Monitoring: Retention Period Extended
What changed: Security event logs must now be retained for a minimum of 24 months, increased from 12 months.
Why the NCA introduced this: Investigations of sophisticated attacks often require log analysis extending beyond one year to identify initial compromise vectors and lateral movement patterns.
Evidence you must now produce:
- Log retention configuration screenshots or policy exports showing 24-month retention for security event logs across all critical systems.
- Storage capacity calculations demonstrating sufficient infrastructure to support extended retention without data loss.
What to update:
- Logging and monitoring policy: update retention schedule to 24 months for security event logs; define which log categories qualify as security events.
- Security information and event management (SIEM) or log aggregation platform configuration: adjust retention settings and verify storage allocation.
- Log archival procedure: if using tiered storage, ensure archived logs remain searchable and accessible for the full 24-month period.
6. Incident Response: Tabletop Exercise Frequency Increased
What changed: Incident response plan testing through tabletop exercises must now occur at least twice annually, up from once annually.
Why the NCA introduced this: Single annual exercises often focus on the same scenario type, leaving gaps in response capabilities for other incident categories such as ransomware, data exfiltration, or supply-chain compromise.
Evidence you must now produce:
- Tabletop exercise reports for at least two exercises conducted within the past 12 months, covering different incident scenarios.
- Action registers showing findings from each exercise, assigned owners, due dates, and closure evidence.
What to update:
- Incident response policy: specify semi-annual tabletop exercise requirement and mandate scenario diversity across exercises.
- Annual training and exercise calendar: schedule two tabletop exercises at six-month intervals, with scenario selection criteria.
- Exercise planning template: add section for scenario justification to ensure each exercise addresses a distinct threat vector.
7. Third-Party Risk Management: Annual Re-Assessment Requirement
What changed: Third-party service providers with access to regulated data or critical systems must now undergo annual cybersecurity re-assessments, not only initial due diligence at onboarding.
Why the NCA introduced this: Third-party security postures degrade over time due to personnel turnover, infrastructure changes, and evolving threats, yet many entities performed assessments only at contract signature.
Evidence you must now produce:
- Third-party risk assessment reports completed within the past 12 months for each vendor with access to regulated data or critical systems.
- Risk register entries showing assessment dates, risk ratings, and remediation plans for identified third-party risks.
What to update:
- Third-party risk management policy: add annual re-assessment requirement; define assessment methodology and acceptable evidence types (questionnaires, certifications, audit reports).
- Vendor management database: add fields for last assessment date and next assessment due date; configure automated reminders.
- Third-party contract templates: include clause requiring vendors to participate in annual cybersecurity assessments and provide requested evidence within specified timeframes.
8. Business Continuity: Recovery Time Objective Documentation Mandated
What changed: Business continuity plans must now document specific recovery time objectives (RTOs) for each critical business process and supporting system, not only general recovery priorities.
Why the NCA introduced this: Plans listing systems as "high priority" without quantified RTOs left recovery teams without clear targets during actual incidents, delaying restoration decisions.
Evidence you must now produce:
- Business impact analysis documenting RTOs for each critical business process, expressed in hours or days.
- Business continuity plan sections mapping each critical system to its RTO and describing recovery procedures designed to meet that objective.
- Test reports showing actual recovery times achieved during exercises, compared against documented RTOs.
What to update:
- Business continuity policy: define RTO as a mandatory component of business impact analysis; specify RTO review and approval authority.
- Business impact analysis template: add RTO field for each critical process and system; include justification for selected RTO.
- Business continuity plan structure: reorganise recovery procedures by RTO tier (for example, 0-4 hours, 4-24 hours, 24-72 hours) to prioritise restoration activities during incidents.
Adjusting Your Evidence Repository Without Starting Over
For each amended control, follow this three-step process:
- Compare your current evidence against the new requirement. Open your existing self-assessment response and evidence file for the control. Identify which elements satisfy the amended language and which gaps remain.
- Update the minimum necessary documents or configurations. Rather than rewriting entire policies, add specific clauses addressing the new scope, threshold, or evidence type. For technical controls, adjust configuration settings and capture new screenshots or exports.
- Document the change in your self-assessment tracker. Record the amendment date, what changed, which evidence you updated, and the date you completed the update. This audit trail demonstrates proactive compliance monitoring during your next assessment.
How CISO Consulting Supports Regulatory Updates
Tracking control amendments across NCA ECC, SAMA frameworks, and PDPL guidance requires continuous monitoring of regulator publications, technical circulars, and industry advisories. CISO Consulting provides timely intelligence, impact analysis, and practical implementation guidance to help regulated entities stay ahead of SAMA, NCA, and PDPL regulatory changes.
If your compliance team needs support translating control amendments into specific evidence updates, policy revisions, or technical configurations, the Regulatory Updates service delivers the analysis and implementation guidance required to adjust your programme efficiently.
