Security Awareness Training and the NCA ECC: What's Required

Most organisations know the National Cybersecurity Authority's Essential Cybersecurity Controls (ECC) expect awareness training. Fewer know what the controls actually say, so programmes tend to stop at one annual video. That leaves the specialised training the ECC asks for, and the evidence an assessor wants, as gaps that surface during an assessment.

This guide sets out the ECC's awareness requirements in plain words, based on the current edition, ECC-2:2024. For the framework as a whole, see our overview of Saudi Arabia's NCA Essential Cybersecurity Controls. Here, the focus is what the awareness requirements mean in practice, the evidence to keep, the Saudi factors to plan for, and the mistakes that cost most.

What does the NCA ECC require for awareness training?

The ECC requires a formal, approved awareness programme for all staff, specialised training for key roles, and regular review of how well it works. In plain words, the requirements are:

• An approved programme: a cybersecurity awareness programme that is developed periodically, approved and delivered through multiple channels.
• Implementation: the approved programme is actually carried out across the organisation, not just written.
• Core topics: how to protect the organisation from the most important and latest threats, including phishing email, mobile devices and storage media, safe internet browsing and social media.
• Specialised training: extra skills and training for people in roles linked directly to cybersecurity, grouped by responsibility.
• Employment lifecycle: awareness at onboarding and throughout employment, as part of the organisation's human resources security requirements.
• Periodic review: the way the programme is implemented is reviewed periodically.

Who has to meet these requirements?

The ECC applies to Saudi government agencies and their affiliated companies and entities, inside and outside the Kingdom, and to private sector organisations that own, operate or host Critical National Infrastructure. The NCA strongly encourages every other organisation in the Kingdom to apply the controls too.

How often must training happen?

The ECC does not set a fixed frequency. It requires the programme to be developed and reviewed "periodically", so each organisation must define its own schedule, record it in the approved programme and show it is followed.

Which roles need specialised training?

Three groups, beyond general awareness for everyone. The ECC names cybersecurity department staff, staff who develop software or work on information and technology assets, and executive and supervisory positions, so a single course for all staff does not cover it.

How do you build a programme that meets the ECC?

Start with an approved written programme, then deliver it, measure it and review it on a cycle you define. These are the elements to put in place:

• A written programme: objectives, audiences, topics, channels and schedule, approved by the organisation's authorised official.
• Multiple channels: for example online modules, simulated phishing, posters, email bulletins and short briefings, since the ECC asks for more than one.
• The four core topics: phishing email, mobile devices and storage media, safe browsing and social media, refreshed as threats change.
• Role-based tracks: separate training for the cybersecurity team, developers and IT staff, and executives and supervisors.
• Onboarding: awareness training as part of every new joiner's first weeks.
• A review cycle: a defined interval for reviewing results and updating the programme, with the review recorded.

Does phishing simulation count?

It supports the requirements rather than replacing them. Simulated phishing is one delivery channel and the clearest way to measure progress on the phishing topic, but the ECC also expects the other topics, role-based training and a reviewed programme; our guide to phishing simulation with KnowBe4 covers how campaigns run.

What should executives be trained on?

On the threats aimed at them and the decisions they own. Executives are frequent targets of business email compromise and payment fraud, and they approve the programme itself, so their track should cover those attacks and their role in governance rather than repeat staff basics.

How do the ECC requirements map to evidence?

Each requirement needs a record that shows it was met, and a training platform produces most of them automatically. The table pairs each requirement with the evidence to keep.

ECC requirement	What it means in practice	Evidence to keep	How a training platform helps
Approved awareness programme	A written programme signed off by the authorised official	Approved programme document and approval record	Campaign plans export as the programme schedule
Multiple channels	More than one way of reaching staff	Content calendar listing each channel	Modules, simulated phishing and printable resources
Core topics covered	Phishing, devices and media, browsing, social media	Course list mapped to the four topics	Topic-tagged content library
Specialised training by role	Separate tracks for security, IT and executives	Enrolment lists per role group	Group-based enrolment and role-specific modules
Onboarding and ongoing awareness	Training for new joiners and existing staff	Completion records with dates	Automatic enrolment of new users
Periodic review	Results reviewed and the programme updated	Review minutes and trend reports	Completion and phishing trend reports

What does KnowBe4 add to the evidence?

KnowBe4's security awareness training platform combines training modules, simulated phishing and reporting in one place, so completion and phishing results come from one source. See how KnowBe4 security awareness training works in Saudi Arabia, including the Phish Alert Button staff use to report suspicious email.

What do Saudi organisations need to consider?

Four local factors decide whether a programme works in practice: language, the current ECC edition, working patterns and personal data. Generic international guides rarely cover them.

Does training need to be in Arabic?

For most Saudi workforces, yes, alongside English. KnowBe4 lists Arabic support for its training and video modules, simulated phishing templates, security awareness resources, Compliance Plus training and the learner experience, so staff can train in the language they work in.

What changed with ECC-2:2024?

ECC-2:2024 replaced ECC-1:2018, and the structure was reorganised into four domains. Any awareness programme or compliance map built against the older edition should be re-checked against the current text rather than relying on old references.

Are phishing results personal data?

Yes, in most cases. Simulation results and training records link named staff to their behaviour, so the Personal Data Protection Law (PDPL) applies to how they are collected, stored and shared; tell staff the programme exists, limit who sees individual results and report trends to management.

How should training fit Saudi working patterns?

Schedule around the working week and seasonal changes such as shorter Ramadan hours. Avoid launching campaigns just before Eid holidays, when staff are least likely to finish training and results are skewed.

Blue Edge Company, founded in 2016 and based in Dammam in the Eastern Province, is a value-added technology distributor and an authorised KnowBe4 distributor in Saudi Arabia, supplying projects across the Kingdom. It supplies and supports KnowBe4 security awareness training and IT technical consultations on setting up the platform; it is not a licensed cybersecurity service provider or compliance assessor.

What are the most common ECC awareness mistakes?

Most of the costly mistakes leave the organisation unable to prove what it did. They are listed worst first.

• Running training without an approved programme. Without a signed-off programme document, completed courses cannot show the ECC requirement was met, and the gap appears at assessment.
• One course for everyone. Leaving out specialised training for security staff, developers and executives fails a named requirement and leaves the most targeted roles least prepared.
• No recorded review. Results that are never reviewed or acted on cannot show periodic review, so record each review and the changes it led to.
• Treating phishing simulation as the whole programme. Simulations cover one topic; devices and media, browsing and social media still need training.
• Building on ECC-1:2018 mappings. Programmes mapped to the old edition can point to requirements that have moved, which wastes time when the assessor works from ECC-2:2024.
• Publishing named phishing results. Sharing who clicked damages trust and raises PDPL issues, while trend reporting gives management what it needs.

Write the programme first, then choose the platform

Start with the approved programme document: audiences, the four core topics, role-based tracks, channels, schedule and review interval. Get it approved by the authorised official before buying any content.

Then choose a platform that delivers the channels and produces the evidence the programme promises. Enrol new joiners automatically, set up separate groups for each role track, and turn on reporting for completion and phishing trends.

Finally, hold the first review at the interval you set, record what changed, and keep the record with the programme. Our guide to security awareness training in Saudi Arabia covers choosing and running the training itself.

Frequently Asked Questions

• Does the awareness programme need formal approval?

  Yes. The ECC requires the awareness programme to be developed and approved, not just delivered, so it should exist as a document signed off by the organisation's authorised official. Keep the approval record with the programme and re-approve it whenever the programme is updated after a review.

• Does the ECC apply to private companies?

  Only to private sector organisations that own, operate or host Critical National Infrastructure. Other private companies are not required to comply but are strongly encouraged to apply the controls, and many use the ECC as their baseline because government clients and partners increasingly expect it in contracts.

• Should new employees be trained before getting system access?

  The ECC requires awareness at onboarding, though it does not say whether it must come before access. Many organisations make a short induction module a condition of receiving email and system accounts, then enrol new joiners in the full programme during their first weeks.

• Is an annual training session enough?

  Usually not on its own. The ECC asks for a multi-channel programme that is developed and reviewed periodically, and a single yearly session covers only one channel. Shorter, more frequent modules combined with simulated phishing and reminders give more evidence and keep awareness current between reviews.

• Can awareness training be outsourced?

  Delivery can, but accountability cannot. An organisation can use an external platform or provider to run training, yet the programme must still be approved, implemented and reviewed under its own governance, and the evidence of completion and review stays with the organisation.

Sources & References

• National Cybersecurity Authority (NCA) — Essential Cybersecurity Controls (ECC-2:2024) regulator
• KnowBe4 — Multi-Language Support and Localization vendor documentation
• Saudi Data and Artificial Intelligence Authority (SDAIA) — Regulations and Policies, including the Personal Data Protection Law regulator

---

Published 13 October 2026 • Last updated 17 October 2026 • This article is reviewed when standards, regulations or product guidance change.