---
name: Cybersecurity — NCA ECC + SMB Hardening
priority: 3
keywords: security, امن, أمن, cybersecurity, السيبراني, السيبرانية, nca, الهيئة الوطنية, ecc, الضوابط الأساسية, password, كلمة المرور, mfa, 2fa, التحقق بخطوتين, phishing, التصيد, malware, البرمجيات الخبيثة, breach, اختراق, security audit, تدقيق أمني, pdpl, حماية البيانات
---

# Cybersecurity — NCA ECC + SMB Hardening

## When to use

Owner asks about security, password policy, NCA Essential Cybersecurity Controls (ECC), data protection, or recovers from a phishing/malware incident.

## NCA ECC quick map (most relevant for SMBs)

The NCA ECC has 5 main domains. SMBs should baseline-meet these:

1. **Cybersecurity Governance** — written policy, named responsible person, annual review.
2. **Cybersecurity Defense** — endpoint AV, firewall, VPN, patching, backups (3-2-1 rule).
3. **Cybersecurity Resilience** — DR plan, incident response runbook, BIA done.
4. **Third-Party Cybersecurity** — vendor security clauses, due diligence on critical SaaS.
5. **Industrial Control Systems** — only if you operate ICS/SCADA. Most SMBs N/A.

For organizations subject to ECC (government suppliers, critical sectors), full audit annually.

## SMB hardening (90-day checklist)

### Day 1 — quick wins
- [ ] MFA on all admin accounts (Google Workspace, Microsoft 365, AWS, GitHub, banks).
- [ ] Password manager rolled out (1Password, Bitwarden, Dashlane).
- [ ] Disable shared/generic accounts.
- [ ] Enable disk encryption on all laptops (FileVault / BitLocker).
- [ ] Lock-screen timeout 5 min.

### Week 1
- [ ] Backup policy: daily local + weekly offsite (Backblaze, AWS S3, OneDrive Personal Vault).
- [ ] Install endpoint AV (Microsoft Defender on Win, Malwarebytes on Mac).
- [ ] Phishing test (KnowBe4 free tier or manual).
- [ ] Brief staff on common phishing patterns (especially WhatsApp + SMS in Saudi).

### Month 1
- [ ] Inventory all SaaS: who has access, last-login audit.
- [ ] Network segmentation: guest WiFi separate from corporate.
- [ ] Mobile device policy: passcode, remote wipe enabled.
- [ ] Vendor security review for top 5 SaaS (request SOC 2, GDPR, PDPL compliance).

### Month 3
- [ ] Tabletop incident response exercise.
- [ ] PDPL compliance review (Saudi PDPL effective 2024-09-14).
- [ ] Penetration test if handling customer payment data or PII at scale.

## Common Saudi-context attacks

- **WhatsApp impersonation** — "investor" asking for wire transfer details. Always voice-confirm via known number.
- **Fake invoice / supplier change** — email asking to update bank details. Always verify by phone.
- **Recruitment phishing** — fake jobs harvesting CVs / IDs. Verify via Qiwa.
- **SMS toll fraud** — fake delivery updates with malicious links. Block at SMS gateway level.

## Saudi PDPL compliance highlights

- **Data Controller registration** — required if processing >5,000 records or sensitive data.
- **Cross-border data transfer** — restricted; need explicit consent or contract clauses.
- **Right to erasure / access** — 30-day response.
- **Breach notification** — to SDAIA within 72h.
- **Penalties** — up to 5M SAR + criminal liability for sensitive data breaches.

## Incident response runbook (1-page)

```
1. CONTAIN — disconnect affected device from network. Don't power off (preserve memory).
2. ASSESS — what was accessed? Bank? Customer data? IP?
3. NOTIFY — internal: founder/CTO; external: affected parties, authorities (SDAIA if PDPL data, NCA if critical infra).
4. ERADICATE — full malware scan, password reset all affected accounts, MFA on everything.
5. RECOVER — restore from clean backup; verify integrity.
6. POST-MORTEM — written incident report within 5 business days. What went wrong, what we changed.
```

## When to escalate to a security firm

- Suspected ransomware (don't pay; engage Group-IB, ITQAN, or NCC Group Saudi).
- Wire fraud >50k SAR.
- Unusual database queries from production.
- Multiple failed admin logins in <1 hour.

## Output discipline

When advising on security, show: (1) the specific risk, (2) the specific control, (3) the cost, (4) effort to implement. Avoid vague "be more secure" advice.
