NCA ECC Third-Party Cybersecurity (4-1): Meeting the Requirement

What 4-1 covers

Within NCA’s Essential Cybersecurity Controls (ECC), subdomain 4-1 addresses third-party cybersecurity: cybersecurity requirements in contracts and agreements with third parties, requirements for outsourcing and managed services, and periodic review of their implementation. Read the controls in the official ECC text for exact wording.

A practical process

1. Classify third parties by the access and data involved.
2. Apply contract clauses: confidentiality, secure data handling, incident notification, return or destruction of data, right to audit.
3. Assess suppliers with questionnaires mapped to ECC.
4. Track issues and remediation.
5. Review periodically and on change.

Overlaps

Evidence for assessments

• Third-party policy and procedures
• Inventory of third parties with classification
• Signed contract clauses
• Completed assessments and findings
• Periodic review records

Contract clauses to include

• Confidentiality and non-disclosure
• Cybersecurity requirements the supplier must meet
• Incident notification within an agreed time
• Right to audit or assess
• Return or secure destruction of data at the end of the contract
• Restrictions on sub-contracting without approval

Making it repeatable

Use one intake and assessment workflow for every supplier, with questionnaire modules mapped to ECC, CCC, SAMA CSF and PDPL as relevant. The same evidence then supports each regulator’s review.

Managed services and outsourcing

Managed security services and IT outsourcing deserve particular care because the provider operates inside your environment. Define the cybersecurity requirements the provider must meet, the access it receives and how that access is monitored, require timely incident notification, and review performance and compliance periodically. Keep the evidence with the supplier record so NCA compliance assessments can be answered quickly.

How NAZZTEC helps

NAZZTEC AI TPRM automates this end to end — with AI assistance, segregation of duties, analytics and signed reports — and is available as SaaS, in your private cloud or on-premises, hosted in the Kingdom. Our consultants design and run the process alongside it through our Cybersecurity Services services.

Next step: request a demo of NAZZTEC AI TPRM or read more on the product page.

Frequently asked questions

NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.