Sharing Indicator : White Essential Cybersecurity Controls Executive Summary The Kingdom of Saudi Arabia’s Vision 2030 aims at a comprehensive improvement of the nation and its security, economy and citizens’ well-being. One of the essential goals of Vision 2030 is continued transformation into the digital world and improvement of the digital infrastructure in order to keep up with the accelerated global progress in digital services, renewable global networks and IT/ OT systems in line with improved computer processing, massive data storage and exchange capabilities for data, in order to be prepared for handling artificial intelligence and 4th industrial revolution transformations. This transformation requires easing the flow of information, securing it and preserving the integrity of all systems. It also requires maintaining and supporting the cybersecurity of the Kingdom in order to protect its vital interests, national security, critical infrastructures, high priority sectors and governmental services and practices. To accomplish this objective, the National Cybersecurity Authority (NCA) was established, and its mandate was approved as per the Royal Decree number 6801, dated 11/2/1439H making it the national and specialized reference for matters related to cybersecurity in the Kingdom. NCA’s mandates and duties fulfill the strategic and regulatory cybersecurity needs related to the development of cybersecurity national policies, governance mechanisms, frameworks, standards, controls and guidelines. They also fulfill the need to continuously monitor the compliance of organizations to support the important role of cybersecurity which has increased with the rise of security risks in cyberspace more than any time before. NCA’s mandate states that its responsibility for cybersecurity does not absolve any public, private or other organization from its own cybersecurity responsibilities as confirmed by the Royal Decree number 57231, dated 10/11/1439H, which states that “all government organizations must improve their cybersecurity level to protect their networks, systems and data, and comply with NCA’s policies, framework, standards, controls and guidelines” From this perspective, NCA developed the Essential Cybersecurity Controls (ECC-1: 2018) to set the minimum cybersecurity requirements for national organizations that are within its scope of ECC implementation. This document highlights the details of these controls, goals, scope, statement of applicability, compliance approach and monitoring. All national organizations must implement all necessary measures to ensure continuous compliance with the ECC as per item 3 of article 10 of NCA’s mandate and as per the Royal Decree number 57231, dated 10/11/1439H. 6 Document Classification: Unclassified