What Is NCA ECC Control 4-3-2 (Third-Party Security Assessment) and Which Four Evidence Artifacts Satisfy Annual-Review Requirements Without Re-Auditing Every Vendor?
The National Cybersecurity Authority's Essential Cybersecurity Controls framework establishes minimum security requirements for critical infrastructure and government entities in the Kingdom. Among these, Control 4-3-2 addresses NCA ECC third party security assessment obligations, requiring organizations to conduct security assessments of third parties that process, store or transmit their sensitive data or provide critical services. The control's intent is clear: organizations remain accountable for the security posture of their supply chain, and must verify—at least annually—that critical vendors maintain adequate protections.
In practice, many procurement officers, legal counsel and compliance managers interpret this requirement as mandating full security audits of every critical vendor each year. This interpretation creates three immediate problems. First, the cost and resource burden of conducting dozens or hundreds of comprehensive assessments annually becomes prohibitive. Second, many vendors—particularly large international software-as-a-service providers—will not permit customer-initiated audits under standard contract terms. Third, the organization's internal audit and compliance teams lack the capacity to perform this volume of work while meeting other regulatory obligations.
The control does not, however, require organizations to conduct new on-site audits or penetration tests of every vendor every year. What it requires is an annual security assessment—a review of current security posture based on credible, recent evidence. This distinction is critical. Organizations can satisfy the annual-review obligation by collecting and evaluating four types of evidence artifacts from vendors, provided those artifacts are current, relevant to the services provided, and obtained through a contractual right to request.
This guide explains what Control 4-3-2 requires, which four evidence artifacts satisfy the annual-review obligation, how to structure the contract clause that obligates vendors to provide them, and the practical steps to implement a sustainable third-party assessment program.
Understanding Control 4-3-2: What the Regulation Actually Requires
Control 4-3-2 sits within Domain 4 (Third-Party and Cloud Computing Cybersecurity) of the NCA Essential Cybersecurity Controls framework. The control requires organizations to assess the cybersecurity posture of third parties before engagement and periodically thereafter—at minimum, annually for critical vendors.
The control does not prescribe a single assessment methodology. It recognizes that different vendor relationships carry different risk profiles and require different levels of scrutiny. A cloud infrastructure provider hosting customer financial records warrants more rigorous assessment than a vendor providing non-critical administrative software. The regulation's flexibility is intentional: it allows organizations to calibrate their approach based on risk.
Three principles govern compliant implementation:
Risk-based tiering. Not all vendors require the same level of assessment. Organizations must classify vendors by risk—typically based on the sensitivity of data accessed, the criticality of services provided, and the nature of network connectivity—and apply assessment rigor accordingly.
Initial due diligence. Before onboarding a new vendor, organizations must conduct security due diligence appropriate to the vendor's tier. For high-risk vendors, this typically includes reviewing security certifications, completing detailed questionnaires, and evaluating technical controls.
Ongoing monitoring. After onboarding, organizations must reassess vendors at least annually. The reassessment need not replicate the initial due diligence in full, but it must provide current evidence that security controls remain effective.
The common implementation gap is in the third principle. Organizations invest heavily in initial vendor assessments, then struggle to maintain an annual review cycle because they assume "reassessment" means "repeat the initial audit." This assumption is both incorrect and unsustainable.
The Four Evidence Artifacts That Satisfy Annual-Review Requirements
A compliant annual security assessment does not require a new audit. It requires current evidence that the vendor's security posture remains adequate. Four types of artifacts, when collected and reviewed systematically, provide this evidence:
1. SOC 2 Type II Report (Refreshed Within 12 Months)
A Service Organization Control 2 Type II report, issued by an independent auditor, describes a service provider's systems and the suitability of the design and operating effectiveness of controls over a period of time—typically six to twelve months. For vendors that handle sensitive data or provide critical services, a current SOC 2 Type II report is the single most valuable reassessment artifact.
The annual review consists of obtaining the vendor's most recent report (issued within the past twelve months), reviewing the scope to confirm it covers the services your organization uses, examining any control exceptions or qualifications noted by the auditor, and documenting the review. If the vendor's report shows no material exceptions and covers the relevant services, no further assessment is typically required for that year.
2. Penetration-Test Executive Summary (Conducted Within 12 Months)
Many vendors, particularly software providers, commission annual penetration tests of their applications and infrastructure. The executive summary of such a test—showing scope, methodology, high-level findings and remediation status—provides evidence that the vendor actively tests its defenses and remediates identified vulnerabilities.
Organizations need not review the full technical penetration-test report (which vendors often will not share due to security concerns). The executive summary, showing that a test was conducted by a qualified firm within the past year and that critical and high-severity findings have been remediated, is sufficient for annual-review purposes.
3. Vulnerability-Scan Trend Report (Quarterly or Monthly)
Continuous vulnerability management is a core security control. Vendors that provide regular vulnerability-scan trend reports—showing the count of vulnerabilities by severity over time and remediation velocity—demonstrate ongoing attention to patching and configuration hygiene.
For the annual review, request a trend report covering the most recent quarter or, ideally, the past twelve months. The report should show that critical and high-severity vulnerabilities are remediated within the vendor's stated service-level agreements (typically 30 days for critical, 90 days for high). A stable or declining trend in open vulnerabilities is a positive indicator; a rising trend warrants follow-up questions.
4. Incident-Disclosure Attestation (Covering the Past 12 Months)
Organizations need assurance that vendors will disclose security incidents that affect customer data or service availability. An annual attestation—signed by the vendor's chief information security officer or equivalent—confirming whether any material security incidents occurred in the past twelve months, and if so, describing the nature, impact and remediation, satisfies this requirement.
If the vendor reports no incidents, the attestation serves as a clean bill of health. If incidents occurred, the attestation provides an opportunity to evaluate the vendor's incident-response capability and transparency. Vendors that refuse to provide any incident disclosure should be considered higher risk.
The Contract Clause That Obligates Evidence Provision
Collecting these four artifacts annually is only feasible if the vendor is contractually obligated to provide them. The initial vendor contract or a subsequent amendment must include a security schedule or addendum that establishes this obligation.
The clause should specify:
Obligation to provide. The vendor agrees to provide, upon written request and within 30 calendar days, current copies of the four evidence artifacts described above (or equivalent evidence demonstrating comparable security assurance).
Frequency. The customer may request these artifacts no more than once per twelve-month period, unless a material security incident or change in service scope occurs, in which case the customer may request updated evidence on reasonable notice.
Confidentiality. The customer agrees to treat all evidence artifacts as confidential, to use them solely for security-assessment purposes, and not to disclose them to third parties except as required by law or regulation.
Alternative evidence. If the vendor does not produce one or more of the specified artifacts (for example, a vendor that does not obtain SOC 2 certification), the vendor agrees to provide alternative evidence of equivalent assurance, subject to the customer's reasonable approval. Alternatives might include ISO 27001 certification, a recent third-party security assessment summary, or responses to a detailed security questionnaire.
Right to audit. For high-risk vendors or in the event that provided evidence reveals material control deficiencies, the customer reserves the right to conduct an on-site or remote security assessment at mutually agreed times, with reasonable advance notice and no more than once per year.
This clause balances the organization's need for ongoing assurance with the vendor's operational and confidentiality concerns. It avoids the cost and friction of annual audits while preserving the right to audit when risk warrants.
Implementing a Sustainable Third-Party Assessment Program
Organizations that successfully implement Control 4-3-2 without drowning in audit work follow a consistent sequence:
1. Inventory and tier all vendors. Compile a complete list of third parties that access your data, systems or facilities. Classify each vendor into risk tiers—typically critical, high, medium and low—based on data sensitivity, service criticality and access level.
2. Develop the assessment framework. Define what evidence is required for each tier. Critical and high-risk vendors require all four artifacts annually. Medium-risk vendors might require SOC 2 or ISO certification plus an incident attestation. Low-risk vendors might require only an annual questionnaire refresh.
3. Update contract templates and negotiate amendments. Add the security schedule to your standard vendor contract template for all new engagements. For existing critical and high-risk vendors, negotiate an amendment or side letter adding the evidence-provision obligation. Expect some vendors to push back; be prepared to accept alternative evidence or, in rare cases, to conduct a remote assessment.
4. Establish the annual review calendar. Create a calendar of vendor reassessment due dates, typically aligned with the anniversary of contract signature or initial assessment. Assign responsibility for requesting evidence, reviewing it and documenting findings.
5. Request, review and document. Thirty days before each vendor's reassessment due date, send a written request for the four evidence artifacts. When received, review each artifact for currency, scope and findings. Document the review in a vendor assessment report, noting any control gaps or follow-up actions required. Store the evidence securely and retain it for audit purposes.
6. Escalate exceptions. If a vendor fails to provide required evidence, provides evidence that reveals material control deficiencies, or discloses a significant security incident, escalate to the vendor relationship owner and, if necessary, the organization's risk committee. Decide whether to accept the risk, require remediation, conduct a deeper assessment or terminate the relationship.
This process transforms an overwhelming compliance obligation into a manageable, repeatable cycle. The key is to recognize that annual assessment does not mean annual audit—it means annual evidence review.
Common Implementation Pitfalls
Three mistakes undermine third-party assessment programs:
Treating all vendors identically. Applying the same assessment rigor to every vendor wastes resources and creates bottlenecks. Risk-based tiering is not optional; it is the only way to scale the program.
Requesting evidence without contractual right. Many organizations send evidence requests to vendors, only to be refused because the contract contains no obligation to provide. Negotiate the right before you need it.
Failing to document reviews. Collecting evidence is not enough. Each annual review must be documented in a vendor assessment report that records what was reviewed, what was found and what action was taken. Without documentation, the organization cannot demonstrate compliance to NCA auditors.
How We Support Third-Party Cyber Risk Programs
We set up and run your third-party cyber risk program: vendor tiering, due-diligence questionnaires, contract clauses, assessments and ongoing monitoring.
The engagement begins with inventory: identifying all vendors, the services they provide and the data they access. We then apply a risk-based tiering methodology to classify vendors into categories that determine assessment depth. For each tier, we define the assessment approach—questionnaires, evidence requirements and review procedures.
We develop the program's foundational documents: a third-party risk policy and procedure that defines roles, responsibilities and workflows; a tiered vendor register that tracks each vendor's risk classification and assessment status; a questionnaire library tailored to different vendor types and risk levels; and a contract security schedule that establishes the vendor's obligations to provide evidence and permit assessments.
For initial and ongoing assessments, we conduct due-diligence questionnaires, review evidence artifacts and produce vendor assessment reports that document findings and recommend risk-treatment actions. We establish the reassessment cycle and issue-tracking process that keeps the program running year over year.
Setup takes four to six weeks, after which the program continues on an ongoing retainer basis. The service is mapped to both the NCA Essential Cybersecurity Controls and SAMA Cyber Security Framework, ensuring that the program satisfies regulatory requirements for organizations subject to either or both regimes.
Organizations that lack the internal capacity to design and operate a third-party risk program, or that need to bring an existing program into compliance with NCA ECC Control 4-3-2, engage this service to establish a sustainable, evidence-based assessment process that satisfies the regulator without requiring annual re-audits of every vendor.
