AI agents and NCA ECC-2:2024, subdomain by subdomain

ECC is NCA’s baseline for national entities: government organisations, companies they own, and operators of critical national infrastructure. ECC-2:2024 has four main domains. Review hosting and transfer requirements against data classification and the controls and regulations applicable to each organisation.

How an AI agent fits the ECC scope

An AI agent platform is an information system with users, privileged access to other systems, stored data and outside suppliers (the model provider and the skill publisher). That puts it squarely inside the defense domain and the third-party domain. The mapping below follows ECC-2:2024’s own subdomain numbers.

How AcTree supports each subdomain

Each row names the ECC subdomain and the platform controls that support it. The wording is “supports”: the control is yours to implement, document and assess.

2-2 Identity and access management

Customer-hosted installations support an identity provider through OIDC with PKCE. Hosted workspace SSO must be confirmed for the agreed deployment.

OIDC sign-in uses PKCE, nonce and state, and hands the session over with a one-time cookie-bound code — never a bearer token in a URL.

2-3 Information system and processing facilities protection

Read-only execution policy is the default on every enrolled host; the full policy is an explicit, per-host choice.

Changing a host's execution policy from read-only to full is an administrator-only action.

2-7 Data and information protection, and 2-8 Cryptography

Customer-controlled inference and execution boundaries.

Bring your own model — OpenAI-compatible endpoints, Ollama, Anthropic, or Cloudflare AI Gateway / Workers AI — with keys envelope-encrypted at rest.

2-12 Cybersecurity event logs and monitoring management

Administrative actions — such as raising a host's execution policy or moving a host between workspaces — are recorded to an audit log with the actor, the action, the subject and the values before and after the change.

Host investigations show the commands that ran, their exit codes and output, per host.

4-1 Third-party cybersecurity

Skills ship with the release, come from AcTree's signed skill catalogue, or are your own uploads, and each workspace enables or disables each one.

The signed vendor skill feed is rollback-protected: an older signed catalogue cannot replace a newer one.

Each skill is a versioned package. Uploads are checked before they install, every version is archived, and each workspace enables or disables each skill.

4-2 Cloud computing and hosting cybersecurity

Customer-hosted deployments use packaged deployment configuration. An offline deployment requires an accepted bundle, local model and disconnected installation tests.

The security and compliance page carries the same mapping for NCA ECC, PDPL and SAMA CSF in one table.

What stays your organisation’s work

• The cybersecurity policies and procedures that say how the platform is used (domain 1).
• The risk assessment of the model you choose and the data you let it see (1-5, risk management).
• Classifying data before an agent can reach it (2-7).
• Sending the platform’s logs to your monitoring and reviewing them (2-12).
• Your ECC self-assessment and any NCA review.

Using agents for the ECC work itself

Collecting evidence for an assessment is repetitive: which servers have password login enabled, which certificates expire soon, which accounts still exist after someone left. An agent can gather that evidence across hosts and show the command behind each value, which is what an assessor asks for. The GRC and security films in the use-case library show two of these, with sample data.