Resources · Compliance
NCA ECC: a practical guide to logging, monitoring and compliance evidence
NCA ECC, the Essential Cybersecurity Controls, is the minimum set of cybersecurity controls issued by the National Cybersecurity Authority in Saudi Arabia; the current edition is ECC-2:2024. Many of these controls are not proven by a policy document alone, but by collected event logs, alerts that have an owner, and documented reviews. This guide shows IT and security managers which areas of the controls depend on logging and monitoring, what evidence is usually expected, and where a platform such as Datadog helps and where it does not.
Published 10 min read
In short, for executives
- What it is: the Essential Cybersecurity Controls, issued by the National Cybersecurity Authority (NCA). The edition published on NCA's site today is ECC-2:2024, an update of the first edition, ECC-1:2018.
- How compliance is measured: NCA states that it evaluates compliance through means including self-assessment, reports from its compliance tool, and field audit visits.
- Where monitoring comes in: one subdomain is titled "Cybersecurity Event Logs and Monitoring Management", and other areas, such as asset, identity, vulnerability and incident management, need logs to show they are working.
- What a platform does: collects logs in one place, keeps them for the period you set, raises alerts and shows dashboards that serve as evidence.
- What it does not do: make an organisation compliant, write the policy, or appoint the people who answer the alerts.
What the NCA Essential Cybersecurity Controls are, and why assessors ask about them
The National Cybersecurity Authority issues the Essential Cybersecurity Controls to raise the level of cybersecurity at national level. The controls are organised in main domains, including cybersecurity governance, cybersecurity defence, cybersecurity resilience, and third-party and cloud computing cybersecurity, each with subdomains and controls beneath it. The implementation guide NCA publishes states that its scope is government organisations in the Kingdom, including their affiliated companies and entities. If you are not a government organisation, read the scope section of the current text with your compliance owner to see whether, and how, it applies to you.
Read more
This guide does not repeat control numbers or retention periods; copying requirements from summaries is how wrong ones spread. Read NCA's own text with someone qualified to read it. NCA also publishes a policy template and a standard template for cybersecurity event logs and monitoring management, which an organisation that has not yet written its policy can start from.
Why so many controls depend on logs
An assessor usually asks two questions about each control: is it documented and approved, and does it actually work. The first is answered by a policy or a procedure. The second is answered by something you can show: a log entry proving an administrator account signed in at a given time, an alert that fired and who received it, a vulnerability report and the date it was fixed, an asset list that matches what is really running.
Read more
When logs stay spread across every server, firewall and application, producing that evidence becomes manual work repeated before every assessment, and that is usually when the gaps show: systems whose logging was never switched on, logs deleted before the required period, alerts nobody read. The aim of monitoring design is to make the evidence a by-product of daily operations, not a project that precedes every audit.
NCA ECC: requirement area, evidence and tool
The names in the first column describe areas of work in plain words; they are not the official control titles. Map each area to the control text in NCA's document before an assessment.
| Requirement area | Evidence usually asked for | Where Datadog helps |
|---|---|---|
| Cybersecurity event logs and monitoring | An approved policy naming the systems that must log, central collection, retention applied, alerts with a recipient, documented periodic reviews | Log Management collecting through the Agent and integrations, Cloud SIEM detection rules, monitors for alerting, Flex Logs and archives for retention |
| Privileged accounts | A log of administrator activity, and proof that it is reviewed | Identity provider and cloud audit logs sent to Cloud SIEM, and a dashboard of privileged sign-ins |
| Asset management | An asset list that matches what is running | The hosts, containers and cloud resources the Agent and integrations discover, to compare with your asset register |
| Vulnerability management | Scan results, remediation dates and what is still open | Vulnerabilities in Datadog Cloud Security for cloud infrastructure, and Code Security for libraries and code. Your scanning programme stays in place |
| Configuration and hardening | A configuration baseline, and proof that drift from it is detected | Misconfigurations in Cloud Security: continuous audits of cloud configuration |
| Incidents and threats | A record from detection to closure for each incident | Cloud SIEM signals, followed through in Case Management |
| Cloud computing and hosting | Where data is processed, and what leaves the Kingdom | The choice of Datadog site, and masking or dropping sensitive fields before they are sent |
| Audit of the monitoring platform itself | Who changed a rule, an alert or a retention setting, and when | Datadog Audit Trail records who uses Datadog and what they do |
Event logs and monitoring management in practice
This is the subdomain that depends on the platform most directly, and the work divides into five questions. The first two alone often expose most of the gaps, because the approved list of systems rarely matches what actually arrives.
| Question | What answers it |
|---|---|
| Which systems are in scope? | A written, approved list, usually starting with identity, cloud, network devices and sensitive servers |
| Do their logs actually arrive? | A dashboard showing the last log received from each source, and an alert when one goes quiet |
| How long are they kept? | The period set by the text that applies to you, applied per class of log |
| Who answers the alerts? | Your team, or a provider you appoint, with written hours of cover |
| When are the rules reviewed? | A periodic review with minutes and a list of who attended |
Cloud SIEM reads the same logs that Datadog Log Management collects, so security does not need a separate collection path. For the idea before the product, the guide what is a SIEM explains how logs become signals. On retention, Datadog lets you choose per class: standard indexing for logs queried often, Flex Logs for long-term logs that may be needed quickly, and archives for logs that are rarely read. The Datadog log cost guide shows what each choice does to the bill.
Three ways to produce the evidence, each with a price
| Approach | What you gain | What you pay | When it fits |
|---|---|---|---|
| Logs on each system, reviewed by hand | No new licence | People gathering screenshots before every assessment, and incidents not caught while they happen | A very small estate only |
| A log platform and SIEM you run in your own data centre | The data stays in systems you control | Capacity, upgrades and rule maintenance are all yours, with a team that owns the platform | When your policy keeps most logs inside your network and you have people to run it all year |
| A SaaS platform that combines observability and security, such as Datadog | Faster set-up, operations and security logs in one place, and capacity is the provider's problem | Data is processed on the provider's site, so classifying logs and masking the sensitive ones before sending becomes part of the design | When most log classes may leave, or their sensitive values can be masked |
Many estates end up with a mix: sensitive classes stay in the Kingdom, the rest go to the platform.
Before the NCA ECC self-assessment: what you should be able to show
Practical questions to answer before filling in the assessment tool, whichever platform you use:
- A list of systems that must log, approved and dated, matching what actually reaches the platform.
- A written retention period for each class of log, taken from the text that applies to you and applied in the settings.
- An alert when any source goes quiet, so the assessor does not find the gap before you do.
- An owner for every security alert, with written hours of cover, whether the team is internal or appointed.
- A detection-to-closure record for at least one incident, shown end to end.
- Minutes of the last review of detection rules and alerts, and who attended.
- An audit log of the monitoring platform itself, showing who changed its settings and when.
- A dashboard for each area in the evidence table, opened in front of the assessor instead of new files each time.
Where Datadog fits, and where it does not
Datadog fits an organisation that wants logs, alerts, dashboards and operating evidence on one platform used by operations and security together. Datadog security monitoring comes from the same data used to diagnose outages, and Datadog Audit Trail records what happens inside the platform. Datadog's documentation states that Audit Trail keeps events for 90 days by default once enabled, and that they can be archived to Amazon S3, Google Cloud Storage or Azure Storage for longer keeping.
Read more
It does not fit in three cases. First, if you expect it to deliver compliance itself: compliance is policies, people and decisions, and the platform only produces the evidence. Second, if a class of logs may not leave the Kingdom and cannot be masked: that class stays in a system inside the Kingdom. Third, if nobody will answer the alerts: a platform raising alerts nobody reads adds risk rather than reducing it.
Data residency, support from Riyadh, and Interkey's part
Datadog is a SaaS platform, and as of November 2026 its documented sites are in the US, Germany, Japan, Australia and the UK, none in the Middle East. So before the first Agent is installed we settle with your security team which classes of log may leave, which fields are masked or dropped inside your network before sending, and we record the decision. The observability data residency guide sets out the options, and the guide to the Personal Data Protection Law covers the personal data that turns up in logs.
Read more
Interkey's team works from Riyadh, with engineers who write the documents and meet your teams in Arabic and English, and provides technical support after go-live.
Interkey sells Datadog licences in Saudi Arabia, implements the platform and provides technical support. We start a monitoring review from your policy and your list of systems, not from a product list, and we tell you plainly if the tools you already have are enough. Read about Datadog implementation and operations with Interkey.
Relatedobservability data residency guidePersonal Data Protection LawDatadog implementation and operations with Interkey
How an ECC monitoring review with Interkey runs
-
Scope.
The systems that must log, who owns each one, and what reaches any platform today.
-
Read the gaps.
Compare what arrives with what your policy requires: missing sources, shorter retention, alerts with no owner.
-
Design the platform.
Sources and network path, masking before sending, retention per class, alerts and their recipients.
-
Quote.
Datadog licences sized to log volumes and retention, with implementation and technical support in one proposal.
-
Implement and produce the evidence.
Connect the sources, build dashboards that show the evidence in the table above, and a runbook that says who does what.
-
Operate or hand over.
Interkey operates the platform, or hands it to your team with documentation and stays on for technical support.
Questions security managers ask about NCA ECC
What are the NCA ECC controls?
The Essential Cybersecurity Controls: the minimum cybersecurity requirements issued by the National Cybersecurity Authority in Saudi Arabia. The current edition on NCA's site is ECC-2:2024, an update of the first edition, ECC-1:2018. They are organised in main domains including governance, defence, resilience, and third-party and cloud computing cybersecurity.
Does ECC apply to private-sector companies in Saudi Arabia?
NCA's implementation guide states that its scope is government organisations in the Kingdom, including their affiliated companies and entities. Other organisations should read the scope section of the current text with their compliance owner, because the answer depends on the nature of the organisation and its relationship with government entities.
How long must cybersecurity event logs be kept under ECC?
The minimum is set by the control text that applies to you, and we do not copy it here from summaries. Read it in the official document, then apply it per class of log. Datadog lets you set retention per class through indexing, Flex Logs or archives.
Does Datadog make us ECC compliant?
No. Compliance is policies, people and decisions that the organisation makes. Datadog helps produce the evidence: collected logs, alerts, dashboards and an audit log of the platform itself. The policy, and appointing who answers the alerts, stay with you.
Can our security logs stay in Saudi Arabia with Datadog?
Logs you send are processed on the Datadog site you choose, and as of November 2026 none is in the Middle East. Whatever must stay in the Kingdom is masked or dropped inside your network before sending, or kept in a system inside the Kingdom. This is settled with your security team before set-up.
How long does an ECC monitoring review take, and what drives its cost?
The duration depends on the number of systems in scope, how ready the logging policy is, and whether each system has an owner who can answer, so we estimate it after scoping, not before. Datadog cost follows log volumes, retention and the products enabled, and we quote it with implementation and technical support in one proposal.
Next
Related pages
Next step
Book an ECC monitoring review
Tell us which systems are in scope, what logs you collect today, and when your next assessment is due if you know it. We will come back with a first step that shows what your logs can prove and what is missing.
Or directly
+966-11-2180999 [email protected]Tawuniya Towers, North Tower, 7th Floor, King Fahad Highway, Olaya, P.O. Box 56835, Riyadh 11564, Saudi Arabia