Essential Cybersecurity Controls Sharing Indicator: White Scope of Work and Applicability ECC Scope of Work These controls are applicable to government organizations in the Kingdom of Saudi Arabia (including ministries, authorities, establishments and others) and its companies and entities, as well as private sector organizations owning, operating or hosting Critical National Infrastructures (CNIs), which are all referred to herein as “The Organization”. The NCA strongly encourages all other organizations in the Kingdom to leverage these controls to implement best practices to improve and enhance their cybersecurity. ECC Statement of Applicability These controls have been developed after taking into consideration the cybersecurity needs of all organizations and sectors in the Kingdom of Saudi Arabia. Every organization must comply with all applicable controls in this document. Applicability to implement these cybersecurity controls depends on the organization’s business and its use of certain technologies. For example: • Controls in subdomain 4-2 (Cloud Computing and Hosting Cybersecurity) are applicable and must be implemented by organizations currently using or planning to use cloud computing and hosting services. • Controls in main domain 5 (Industrial Control Systems Cybersecurity) are applicable and must be implemented by organizations currently using or planning to use industrial control systems. Document Classification: Unclassified 9