Raising the Baseline: What the NCA’s New Non-CNI Cybersecurity Controls Mean for Private Sector Entities in Saudi Arabia

4 min 41 sec October 15, 2026 (Edited)

Written by

David Yates

Partner, Head of Digital & Data

d.yates@tamimi.com View LinkedIn Profile

Ali Abbas

Senior Associate

Ali.Abbas@tamimi.com

The National Cybersecurity Authority (NCA) has issued the Non-CNI Private Sector Entities Cybersecurity Controls (NCNICC-1:2025) (Controls), which establish the minimum cybersecurity requirements for private sector entities in Saudi Arabia that are not classified as critical national infrastructure (CNI). The Controls align with leading international cybersecurity practices and are designed to help private sector entities reduce cybersecurity risks arising from both internal and external threats. The Controls also support the nation’s ‘Vision 2030’ goal of growing the contribution of the private sector, and SMEs in particular, to the Kingdom’s GDP.

Until now, the NCA’s most prescriptive cybersecurity frameworks have been focused on government entities and CNI operators. The Controls mark a significant shift, extending baseline cybersecurity obligations to the wider private sector, including small, medium, and large businesses operating in Saudi Arabia.

In this article, we outline the scope of the Controls, how entities are categorised, what the Controls require in practice, and the key considerations for businesses preparing for compliance.

 Scope and application

The Controls apply to private entities that are not classified as CNI, including small, medium, and large entities operating in Saudi Arabia. Entities that fall outside the formal scope of the Controls are encouraged to leverage the framework as a matter of best practice to enhance their cybersecurity capabilities.

Importantly, the NCA reserves the right to impose additional controls on any entity as it deems necessary, particularly where a business operates in a sensitive sector or is exposed to elevated cyber risks.

 Category A and category B entities

The Controls take a proportionate approach, classifying entities into two categories aligned with the definitions used by the General Authority for Small and Medium Enterprises (Monsha’at). 

1. Category A (Large entities). Entities with more than 250 full-time employees, or annual revenues exceeding SAR 200 million. Category A entities must implement all three main components, covering 22 sub-components and 65 mandatory controls. In practice, this means establishing strong oversight, well-defined processes, and appropriate technical safeguards throughout their operations.

2. Category B (SMEs). Entities with 6 to 249 full-time employees, or annual revenues between SAR 3 million and SAR 200 million. Category B entities are subject to a more streamlined set of 13 sub-components and 26 mandatory controls, focusing on essential cybersecurity functions such as incident handling and core technical safeguards. The remaining Category A controls are designated as “recommended” for Category B entities, allowing SMEs to prioritise implementation based on their resources and risk profile.

What the Controls require

The Controls are built around three pillars (people, processes, and technology) and are divided into three main components. Each control follows a three-stage cycle:

• define, document, and approve;
• implement; and
• periodically review.

1. Cybersecurity governance
   This component sets the foundations for how an organisation manages cybersecurity, centred on leadership accountability, documented policies, risk management, periodic auditing, and employee awareness.
   Category A entities will need to establish a dedicated cybersecurity unit that reports to the head of the entity and is independent from the IT department, with the head of the unit and supervisory positions staffed by qualified, full-time Saudi nationals.
   Category A entities must also have their cybersecurity controls reviewed and audited by a party independent of the cybersecurity unit, and implement role-specific awareness programmes covering topics such as phishing and ransomware.
   For Category B entities, governance controls are “recommended”. However, implementing at least a basic governance framework is good practice. 

2. Cybersecurity defence
   This component addresses the technical and operational safeguards needed to protect systems, networks, and data. It spans 15 sub-components, including asset management, identity and access management, email and network security, mobile device security, data protection, encryption, backups, vulnerability management, penetration testing, event log management and monitoring, incident management, physical security, and web application protection.
   All 15 sub-components are mandatory for Category A entities, including subscribing to a managed security operations centre (SOC) licensed by the NCA and using encryption in accordance with the National Cryptographic Standards.
   For Category B entities, a core set of controls is mandatory, including multi-factor authentication for remote access, email filtering, and domain authentication (SPF, DKIM and DMARC), firewalls, encryption, backup restoration testing, patch management, event log activation, and notification of cybersecurity incidents to the NCA.

3. Third-party and cloud computing cybersecurity
   This component addresses risks arising from vendor and cloud relationships. Entities will need to embed cybersecurity requirements into contracts and service-level agreements (SLAs) with third parties (including confidentiality obligations and incident communication procedures). Entities should also ensure cloud and hosting arrangements provide for data classification before hosting, return of data in a usable format upon termination, and segregation of the entity’s environment from other tenants. This component is mandatory for Category A entities and recommended for Category B entities.

 Interaction with the PDPL

 While compliance with the Personal Data Protection Law (PDPL) is a separate regulatory matter, it feeds directly into the Controls. Since early 2026, the Saudi Data and AI Authority (SDAIA) has moved into active enforcement of the PDPL, and one of the key violation categories it has identified is a failure to implement appropriate technical security measures.

SDAIA enforcement shows that stating protection in a privacy notice is insufficient. Organisations must produce evidence of actual, proportionate measures such as access controls, encryption, monitoring, and incident response capabilities. The PDPL’s Implementing Regulations also point organisations towards adopting NCA cybersecurity controls and standards.

 Accordingly, even where certain controls are only “recommended”, they may still be relevant from a PDPL perspective. In the event of a personal data breach, it is reasonable to expect that the SDAIA would consider whether the organisation had appropriate safeguards in place, including those referenced in the Controls. Demonstrating alignment with the Controls can therefore help evidence due diligence and may reduce regulatory risk if an incident occurs.