National Baseline · Saudi Arabia

NCA ECC on Microsoft 365 and Azure

Technical Implementation Guide for Essential Cybersecurity Controls

The Essential Cybersecurity Controls (ECC) issued by the National Cybersecurity Authority (NCA) represent the primary regulatory cybersecurity standard in the Kingdom of Saudi Arabia. Meeting ECC requirements is mandatory for national entities, critical infrastructure operators, and organisations managing vital assets.

While governance and administrative policies must be managed by your leadership and compliance teams, the vast majority of the defensive technical mandates live natively within Microsoft 365 and Microsoft Azure. PolicySecOps configures, hardens, and documents these technical controls directly within your existing subscriptions.

Standing Disclaimer

We configure and document the technical controls inside your Microsoft environment. We are not an auditor or certification body and we don't give legal advice. Meeting a regulation also depends on policies, people and physical controls that stay with your organisation.

Licence Dependency Notice

What we can switch on depends on the Microsoft licences you already have. The assessment shows you exactly what is possible today and what would need an extra licence. We don't sell licences, so we have nothing to push.

Applicability Matrix

Who NCA ECC Is For

NCA ECC applies to public and private sector organisations across the Kingdom of Saudi Arabia:

Government Entities & Ministries

Saudi government ministries, authorities, and public institutions mandated to demonstrate compliance with national baselines.

State-Owned & PIF Companies

State-owned enterprises and portfolio companies of the Public Investment Fund (PIF) operating under high-assurance governance.

Critical National Infrastructure

Operators in energy, water, utilities, transportation, financial services, and healthcare safeguarding vital national assets.

Government Contractors & Vendors

Commercial suppliers, consultancies, and technology vendors handling sensitive government data or connecting to state networks.

Commercial Enterprises

Private organisations choosing the NCA ECC standard as their primary architectural cybersecurity benchmark.

Demarcation of Responsibility

Audit Scope Breakdown

A clear demarcation between Microsoft technical controls engineered by PolicySecOps and governance responsibilities retained by your organisation.

Technical Engineering

What We Help You Put in Place

Defensive technical cybersecurity, resilience, and cloud domains specified in the ECC standard, implemented natively in Microsoft 365 and Azure:

Identity and Access Management

Phishing-Resistant Verification: Enforcing modern multi-factor authentication with geographic context and number matching for all personnel, and hardware-bound keys for privileged operators.
Closure of Legacy Authentication: Completely blocking older, insecure protocols that bypass multi-factor authentication and leave credentials vulnerable.
Risk-Based Access Policies: Dynamically evaluating user risk, sign-in anomalies, and device state before granting session access to cloud workloads.
Zero Standing Privileges: Implementing just-in-time role activation with mandatory justifications and approvals, eliminating permanent administrative rights.
Scheduled Access Certifications: Enforcing recurring access reviews across privileged roles and external accounts, automatically revoking unverified permissions.
Lifecycle Automation: Automatic access adjustments when people join, move, or leave, where licensed.

Information Systems and Endpoint Protection

Standardized Baseline Hardening: Deploying operating system security baselines across Windows, macOS, and Linux endpoints that disable unneeded protocols and services.
Attack Surface Reduction: Blocking known exploitation techniques, including credential theft from local system memory, malicious macro execution, and unauthorized script execution.
Automated Disk Encryption: Requiring full-disk encryption across all corporate workstations and laptops, with recovery keys secured in your cloud directory.
Local Administrator Password Management: Eliminating shared local passwords by automatically generating and rotating unique passwords on every machine.
Patch and Vulnerability Management: Configuring automated operating system and third-party application patch rings, paired with continuous vulnerability tracking.
External Media Controls: Blocking or strictly restricting unapproved USB mass storage devices on corporate endpoints.

Email and Collaboration Security

Anti-Phishing and Impersonation Protection: Deploying machine-learning inspection to intercept spear-phishing and executive impersonation attempts.
Attachment and Link Sandboxing: Detonating email attachments in real-time virtual containers and inspecting URLs at click time across emails, documents, and chat messages.
Strict Email Domain Authentication: Publishing and enforcing strict sender policy frameworks, cryptographic key signatures, and domain message authentication records (SPF, DKIM, DMARC) to prevent spoofing.
Prevention of External Auto-Forwarding: Disabling automatic mailbox forwarding rules to external destinations to thwart unauthorized data diversion.

Data Protection and Leakage Prevention

Sensitivity Labelling and Encryption: Creating classification tiers that apply persistent encryption and access restrictions to sensitive internal information.
Data Loss Prevention: Enforcing rules that detect and block the exfiltration of confidential records across email, cloud storage, collaboration platforms, and endpoints.
Automated Retention and Disposal: Implementing data lifecycle policies that retain regulatory records for required periods and initiate formal disposition reviews upon expiry.

Threat Detection, Containment, and Incident Response

Endpoint Detection and Response: Providing real-time behavioural monitoring to identify, track, and block advanced malware and fileless intrusion techniques.
Identity Threat Tracking: Monitoring on-premises directories and cloud identities for credential theft, suspicious ticket requests, and anomalous administrative behaviour.
Automated Attack Disruption: Programmatically isolating infected endpoints and revoking compromised user credentials within seconds of high-confidence threat detection.
Centralized Event Logging: Maintaining twelve-month tamper-proof audit trails for identity, mailbox, and file events. Central security monitoring is configured where your licences and Azure budget allow.

Cloud Infrastructure Security in Azure

Governance and Management Groups: Establishing structured subscription hierarchies and management group boundaries to enforce segregation of duties.
Architectural Guardrails: Applying cloud policies that enforce encryption standards, prohibit public storage exposure, and restrict workload deployments to approved regions.
Network Isolation and Perimeter Defence: Segmenting cloud workloads using virtual network boundaries, private endpoints, and web application firewalls to protect against common web vulnerabilities.

Client Governance Scope

What Stays With Your Organisation

Achieving alignment with NCA ECC requires operational, legal, and physical measures that cannot be resolved through software configuration alone:

Cybersecurity Governance

Defining the organizational cybersecurity strategy, chartering the cybersecurity steering committee, and maintaining the enterprise risk register.

Policy Authoring

Drafting, formally approving, and maintaining internal corporate information security policies, standards, and employee codes of conduct.

Human Resources Vetting

Performing candidate background screening, security clearances, and executing contractual non-disclosure agreements.

Physical Facility Security

Managing physical building access, server room entry controls, security personnel, CCTV coverage, environmental systems, and physical document shredders.

Penetration Testing

Commissioning independent external penetration testing and vulnerability assessments from accredited testing providers.

Business Continuity Planning

Developing enterprise business continuity plans, operational disaster recovery strategies, and managing crisis communications.

Regulatory Communication

Submitting formal compliance self-assessments, audit documentation, and mandatory incident reports directly through official NCA platforms.

Engagement Outputs

Technical Deliverables You Receive

At the conclusion of an ECC implementation project, your team receives tangible operational assets and audit evidence:

Asset 01

Hardened Tenant Configuration

Every approved technical control configured, validated, and actively operating across your Microsoft environment.

Asset 02

As-Built Technical Documentation

Comprehensive workbooks detailing every applied policy setting, group assignment, exclusion rule, and architectural boundary.

Asset 03

Evidence Your Auditors Can Review

Detailed exportable reports that your compliance officers and external auditors can verify against regulatory expectations.

Asset 04

Operational Handover

A structured walk-through and knowledge transfer session for your internal IT and security operations staff.

Pre-Audit Gap Assessment

Prepare Your Microsoft Environment for NCA ECC

We assess your existing subscriptions and configurations to identify the technical gaps between your current state and ECC requirements.

Request a Scoped Proposal