The National Cybersecurity Authority's Essential Cybersecurity Controls framework requires institutions to maintain a comprehensive set of cybersecurity policies across Domain 1 (Cybersecurity Policies). Many governance and compliance officers preparing for NCA ECC self-assessment or external audit face the same challenge: determining which policies are genuinely mandatory, how to structure them without creating redundant documents, and which clauses must appear in every policy to satisfy the NCA ECC mandatory policies list.
Domain 1 specifies fourteen distinct policy areas covering governance, risk management, asset management, access control, cryptography, physical security, operations security, communications security, system acquisition and development, supplier relationships, incident management, business continuity, compliance and privacy. The framework does not permit institutions to omit any of these fourteen areas, but it does allow certain policies to be consolidated into broader documents provided all required controls and clauses remain traceable during audit.
This checklist identifies the fourteen mandatory policy areas, explains which three can be safely consolidated without losing audit trail, and lists the eleven mandatory clauses that must appear in every policy document to pass NCA self-assessment upload and external review.
The Fourteen Mandatory Policy Areas
Domain 1 of the NCA ECC framework organizes cybersecurity requirements into fourteen distinct policy areas. Each area addresses a specific dimension of cybersecurity governance and must be documented in a manner that demonstrates management approval, implementation guidance and accountability.
1. Cybersecurity Governance Policy
Why it matters: Establishes the overall cybersecurity governance structure, roles, responsibilities and reporting lines to the board or equivalent authority.
This policy defines how cybersecurity decisions are made, who holds accountability for security outcomes, and how cybersecurity performance is measured and reported to senior management. It must reference the institution's risk appetite and explain how cybersecurity objectives align with business strategy.
2. Risk Management Policy
Why it matters: Defines the institution's approach to identifying, assessing, treating and monitoring cybersecurity risks.
The policy must describe the risk assessment methodology, risk treatment options, risk acceptance authority levels, and the frequency of risk reviews. It should reference the institution's risk register and explain how residual risks are escalated and monitored.
3. Asset Management Policy
Why it matters: Governs the identification, classification, handling and disposal of information assets throughout their lifecycle.
This policy ensures that all information assets are inventoried, assigned owners, classified according to sensitivity, and protected proportionately. It must cover both digital and physical assets, including hardware, software, data and documentation.
4. Access Control Policy
Why it matters: Defines how access to systems, applications and data is granted, reviewed and revoked.
The policy must address user access provisioning, privileged access management, access reviews, segregation of duties and remote access. It should specify authentication requirements and explain how access rights are aligned with job roles and business need.
5. Cryptography Policy
Why it matters: Establishes standards for the use of cryptographic controls to protect data confidentiality, integrity and authenticity.
This policy must specify approved cryptographic algorithms, key lengths, key management procedures, certificate management and the circumstances under which encryption is mandatory. It should address both data at rest and data in transit.
6. Physical and Environmental Security Policy
Why it matters: Protects physical facilities, equipment and supporting infrastructure from unauthorized access, damage and interference.
The policy must cover physical access controls, secure areas, equipment security, environmental controls and disposal of physical media. It should define visitor management, monitoring and maintenance procedures.
7. Operations Security Policy
Why it matters: Ensures that operational procedures and responsibilities are documented, implemented and maintained to protect information processing facilities.
This policy must address change management, capacity management, malware protection, backup procedures, logging and monitoring. It should define operational responsibilities and separation of development, testing and production environments.
8. Communications Security Policy
Why it matters: Protects information in transit across networks and between systems.
The policy must cover network security controls, network segregation, secure transfer of information, email security and remote working. It should specify requirements for encryption, network monitoring and acceptable use.
9. System Acquisition, Development and Maintenance Policy
Why it matters: Ensures that security is built into systems throughout the development lifecycle.
This policy must address security requirements analysis, secure development practices, testing procedures, change control and acceptance criteria. It should cover both internally developed and externally acquired systems.
10. Supplier Relationship Policy
Why it matters: Manages cybersecurity risks arising from third-party suppliers and service providers.
The policy must define supplier security assessment, contract security clauses, ongoing supplier monitoring and termination procedures. It should address cloud services, outsourced operations and supply chain risks.
11. Incident Management Policy
Why it matters: Establishes procedures for detecting, reporting, assessing, responding to and learning from cybersecurity incidents.
This policy must define incident classification, escalation procedures, response roles, communication protocols and post-incident review. It should specify reporting timelines to the National Cybersecurity Authority and other regulators.
12. Business Continuity and Disaster Recovery Policy
Why it matters: Ensures that critical business functions can continue or be restored following a cybersecurity incident or other disruption.
The policy must address business impact analysis, recovery time objectives, recovery point objectives, continuity plans and testing schedules. It should define roles during activation and recovery procedures.
13. Compliance Policy
Why it matters: Ensures that the institution identifies, understands and complies with applicable cybersecurity laws, regulations and contractual obligations.
This policy must define the compliance monitoring process, internal audit procedures, regulatory reporting and remediation of non-compliance findings. It should reference the NCA ECC framework and other applicable regulations.
14. Privacy and Data Protection Policy
Why it matters: Protects personal data in accordance with the Saudi Personal Data Protection Law and related regulations.
The policy must address lawful processing, data subject rights, cross-border transfers, breach notification and privacy by design. It should define roles including the data protection officer where required.
The Three Policies You Can Consolidate
While all fourteen policy areas must be addressed, the NCA ECC framework permits certain policies to be consolidated into broader documents provided all required controls remain documented and traceable. Three policy areas are commonly consolidated without losing audit trail:
Physical and Environmental Security
Can be consolidated into: Information Security Policy or Operations Security Policy.
Physical security controls are often integrated into a comprehensive information security policy or included as a dedicated section within the operations security policy. The key requirement is that all physical security controls specified in Domain 1 remain documented, assigned to responsible parties and subject to the same approval and review cycle as standalone policies.
Communications Security
Can be consolidated into: Network Security Policy or Information Security Policy.
Communications security controls frequently overlap with network security and can be documented within a broader network security policy. Alternatively, they may be included as a section within a comprehensive information security policy that addresses multiple technical domains.
Privacy and Data Protection
Can be consolidated into: Data Governance Policy or Information Security Policy.
Privacy controls are often integrated into a broader data governance policy that addresses data quality, data lifecycle and data ethics alongside privacy and protection requirements. Institutions with mature data governance frameworks typically consolidate privacy into this broader policy rather than maintaining a separate document.
Important caveat: Consolidation is permissible only when the consolidated policy clearly addresses all controls specified in the NCA ECC framework for each area, maintains the same level of detail and specificity, and undergoes the same approval and review process. During audit, assessors will verify that consolidated policies contain all required elements and that no controls have been omitted.
The Eleven Mandatory Clauses for Every Policy
Regardless of whether policies are standalone or consolidated, every cybersecurity policy submitted for NCA ECC self-assessment or external audit must contain eleven mandatory clauses. These clauses ensure that policies are complete, approved, implemented and maintained.
- Purpose and Scope: A clear statement of what the policy governs and which parts of the institution it applies to.
- Regulatory and Legal References: Citation of applicable laws, regulations and frameworks, including the NCA ECC framework and any sector-specific requirements.
- Roles and Responsibilities: Identification of who is responsible for implementing, monitoring and enforcing the policy, including escalation paths.
- Policy Statements: The specific requirements, controls and standards that must be followed, written in clear, mandatory language.
- Exceptions Process: Procedures for requesting, approving and documenting exceptions to policy requirements, including time limits and re-approval criteria.
- Compliance Monitoring: How adherence to the policy will be measured, monitored and reported, including audit procedures.
- Enforcement and Consequences: The consequences of policy violations, including disciplinary measures and remediation requirements.
- Related Documents: References to supporting standards, procedures, guidelines and other policies that provide implementation detail.
- Approval Authority: Identification of the individual or committee that approved the policy, with signature and date.
- Review Cycle: The frequency at which the policy will be reviewed and updated, typically annually or following significant changes.
- Version Control: Document version number, revision history and effective date to maintain audit trail and ensure users reference current versions.
Policies missing any of these eleven clauses are routinely flagged during NCA self-assessment upload or external audit and must be revised and resubmitted.
Common Pitfalls in Policy Inventory Management
Institutions preparing for NCA ECC assessment frequently encounter four pitfalls when building their policy inventory:
Duplication without differentiation: Creating separate policies for closely related areas without clearly distinguishing scope and controls, resulting in conflicting or redundant requirements.
Generic templates without localization: Adopting international policy templates without adapting them to Saudi regulatory requirements, institutional context or the NCA ECC control language.
Missing implementation linkage: Publishing policies without corresponding standards, procedures or guidelines, leaving staff unclear on how to comply.
Inconsistent approval and review: Maintaining policies with different approval authorities, review cycles or version control practices, creating gaps in governance oversight.
Building a Policy Inventory That Passes Audit
A compliant NCA ECC Domain 1 policy inventory requires more than drafting fourteen documents. It demands alignment between business priorities, regulatory obligations and operational reality.
The Cybersecurity Strategy & Roadmap service translates your business priorities, regulatory obligations and threat landscape into a costed, prioritized cybersecurity strategy and multi-year roadmap. The process begins with interviews with leadership, review of the business plan, risk appetite and regulatory position, followed by a maturity baseline against the applicable frameworks and the current threat picture. The design phase produces objectives, initiatives, sequencing and investment, tested with stakeholders, culminating in a board-ready strategy, roadmap and measures, presented and adjusted for approval.
Deliverables include a cybersecurity strategy document, three-year roadmap with budget estimates, target operating model, board presentation pack and KPI and KRI dashboard definition. SAMA, NCA and other obligations that apply to you are built into the objectives and the roadmap, so compliance and security move together. The engagement runs six to ten weeks and provides current-state and maturity baseline, business and regulatory alignment, threat and risk-informed priorities, costed multi-year initiative roadmap, and KPIs and KRIs for the board.
When your policy inventory is part of a broader cybersecurity strategy aligned to business objectives and regulatory requirements, it becomes a governance tool rather than a compliance burden—and it passes audit the first time.
