Managed IT and cyber security for regulated firms in Riyadh and KAFD
Managed IT and cyber security for regulated firms in Riyadh and KAFD
The Non-CNI Private Sector Entities Cybersecurity Controls (NCNICC-1:2025) are the NCA’s minimum cybersecurity requirements for private companies in Saudi Arabia that are not critical national infrastructure. Large companies (Category A: more than 250 staff or more than SAR 200 million revenue) must meet 65 mandatory controls. SMEs (Category B: 6 to 249 staff or SAR 3 million to 200 million revenue) must meet 26. The controls cover governance, technical defence, and third parties and cloud. The NCA can assess compliance at any time, so the practical goal is to have the controls running and the evidence ready.
The controls apply to private sector organisations in Saudi Arabia that are not classified as critical national infrastructure. They are split by size:
| Category | Who | Controls |
|---|---|---|
| Category A: large entities | More than 250 full-time employees, or annual revenue above SAR 200 million | 65 mandatory controls across 22 sub-components |
| Category B: small and medium entities | 6 to 249 full-time employees, or annual revenue between SAR 3 million and SAR 200 million | 26 mandatory controls across 13 sub-components; the rest are recommended |
Very small companies below the Category B thresholds are not currently in scope, although the NCA keeps the discretion to bring specific organisations in where the risk warrants it. Organisations already subject to the NCA’s Essential Cybersecurity Controls (ECC-2:2024) or to SAMA’s cybersecurity framework follow those instead. See our guide to NCA ECC-2:2024.
The controls sit under three main components, built on people, processes and technology. Each control follows the same cycle: define, document and approve it; implement it; and review it periodically.
| Component | Sub-components | Category B? |
|---|---|---|
| 1. Cybersecurity governance | Cybersecurity management; policies and procedures; risk management; review and audit; awareness and training | All five |
| 2. Cybersecurity defence | Assets; identities and privileges; systems and devices; email; backups; vulnerabilities; incident management | These seven |
| 2. Cybersecurity defence (Category A only) | Networks; mobile devices; data protection; encryption; penetration testing; security monitoring; physical security; web applications | Recommended, not mandatory |
| 3. Third-party and cloud cybersecurity | Suppliers, contracts, cloud computing and hosting | Yes |
Law firm summaries of the controls highlight requirements such as:
There is no single published national deadline. Reports from compliance advisers indicate the NCA is applying the controls by notifying organisations individually and giving each a compliance timeline. Separately, the NCA can assess compliance at any time and without advance notice, and expects compliance to be continuous rather than a one-off project.
In practice, the risk is being asked to show evidence at short notice. Companies that start now, with a gap assessment and a plan, are in a much better position than those that wait for a letter.
They are separate rules from separate regulators, but they overlap. The NCA’s controls set the cybersecurity baseline. The Personal Data Protection Law, enforced by SDAIA, separately requires appropriate security for personal data and breach notification. SDAIA has also proposed changes to the PDPL’s Implementing Regulation that point organisations outside the NCA’s scope to “recognised cybersecurity standards”.
In practice, one set of well-run controls serves both. See our Saudi PDPL IT checklist and our guide to SDAIA’s proposed PDPL changes.
Cre8 IT is registered with the National Cybersecurity Authority (NCA) as a cybersecurity service provider through the Haseen platform. We’re also ISO 27001:2022 certified, and we help Riyadh organisations run the controls in this guide day to day: Microsoft 365 security, multi-factor authentication, endpoint protection, patching, backups, 24/7 monitoring and incident response, with the evidence kept ready.
Not sure whether you’re Category A or B, or how far you are from compliance? Ask us for a gap assessment.
Last reviewed 10 November 2026. This guide explains the IT side of the rules and is not legal advice. Check the current position with the regulator or your legal adviser.
The Non-CNI Private Sector Entities Cybersecurity Controls, issued by Saudi Arabia’s National Cybersecurity Authority. They set minimum cybersecurity requirements for private companies that are not critical national infrastructure.
Category A covers large entities with more than 250 full-time employees or more than SAR 200 million annual revenue. Category B covers small and medium entities with 6 to 249 employees or revenue between SAR 3 million and SAR 200 million.
Category B entities must meet 26 mandatory controls across 13 sub-components. The remaining controls that apply to large entities are recommended for SMEs rather than mandatory.
There is no single national deadline. The NCA is reported to be notifying organisations individually with their own timelines, and it can assess compliance at any time, so it is sensible to start now.
No. ECC-2:2024 continues to apply to government entities and critical national infrastructure. The Non-CNI controls cover private companies outside that scope.