NCNICC-1:2025 Explained: NCA Cybersecurity Controls for Saudi Private Companies

WaqiSec Compliance Team · Last reviewed: 2026-09-26

What is NCNICC-1:2025?

Until recently, Saudi Arabia's best-known cybersecurity baseline, the NCA's Essential Cybersecurity Controls (ECC), was aimed at government bodies and operators of critical national infrastructure. Most private companies (a fintech, a clinic group, an e-commerce brand, a logistics firm) had no NCA framework written specifically for them.

NCNICC-1:2025 closes that gap. The NCA published it in Arabic on 28 December 2025 as ضوابط الأمن السيبراني لجهات القطاع الخاص من غير ذوات البنى التحتية الحساسة, which translates as the cybersecurity controls for private-sector entities that are not critical infrastructure. There is no official English version; law firms use translations such as "Cybersecurity Controls for Private Sector Entities Not Considered Critical Infrastructure."

The document requires continuous compliance rather than setting a one-off deadline. In practice that means you should be able to show, at any time, that the controls apply in your company and are documented.

Who has to comply?

The controls cover small, medium and large private-sector entities operating in Saudi Arabia that are not classified as critical national infrastructure (CNI). They do not cover:

• Government entities and CNI operators. These follow ECC-2:2024 and other NCA frameworks instead.
• Micro entities. The Category B threshold starts at 6 employees, so very small businesses fall outside the two categories.

Commentary from Baker McKenzie also notes that the NCA may apply the controls "as notified by the Authority" in borderline cases. If you are unsure, assume you are in scope and confirm your category.

Category A vs Category B

Your category depends on either headcount or revenue. Meeting one test is enough.

Category B still moves toward the same baseline over time. "Recommended" controls are the first thing an auditor, a bank partner or an enterprise client will ask about after an incident, so treat them as your roadmap.

The 3 components and what they cover

1. Cybersecurity governance

Cybersecurity management and roles, policies and procedures, risk management, periodic review and audit, and awareness and training.

2. Cybersecurity defense

Asset management, identity and access management, system protection, email protection, network security, mobile devices, data protection, cryptography, backups, vulnerability management, penetration testing, logging and monitoring, incident management, physical security and web application protection.

3. Third-party and cloud cybersecurity

Cybersecurity requirements for suppliers and service providers, and for cloud computing and hosting.

The official document is Arabic-only and lists each control and sub-control. Always map your gap assessment to the official control numbers, not to a vendor summary.

Notable requirements

Based on the published controls and legal commentary from firms such as Baker McKenzie, requirements that surprise companies most include:

• An independent cybersecurity function. It sits separately from IT operations, with a defined head of cybersecurity.
• Saudi nationals in key roles. The head of cybersecurity and other sensitive roles should be qualified, full-time Saudi nationals.
• A managed security operations centre (SOC) from an NCA-licensed provider. This is mandatory for Category A and recommended for Category B.
• Multi-factor authentication for remote access. It also applies to privileged accounts, and cryptography must follow the National Cryptographic Standards.
• Cybersecurity clauses in third-party contracts. These are required, along with data classification and environment separation in the cloud.

Enforcement and penalties

There is no NCNICC certificate. The NCA assesses compliance "by the mechanism it deems appropriate," which in practice means documented evidence: policies, a gap assessment, procedures, logs and records.

The NCA's statutory violations framework (Royal Decree M/117, 1446H) lists failure to comply with NCA controls among its violations. It allows warnings, licence or service suspension, and fines of up to SAR 25 million. That figure is a maximum, and enforcement practice for NCNICC specifically is still developing. The more immediate commercial risk is losing tenders, bank partnerships and enterprise contracts that now ask for proof of NCA alignment.

NCNICC-1:2025 vs ECC-2:2024

See our full ECC-2:2024 guide for the details of the essential controls.

A fintech licensed by SAMA must also meet the SAMA Cyber Security Framework. Every company handling personal data must meet the Personal Data Protection Law (PDPL). These frameworks overlap heavily, so one well-structured policy set can serve all three.

How to comply: step by step

1. Confirm your category. Use your full-time headcount and annual revenue, and document the basis.
2. Run a gap assessment. Check every applicable control and rate each one as met, partial or missing.
3. Write the policy set. This means an information security policy, acceptable use, access control, incident response, backup, third-party and cloud policies.
4. Build a remediation roadmap. Put technical fixes (MFA, logging, backups, email security) in priority order with owners and dates.
5. Train staff and keep evidence. Keep attendance, logs, reviews and sign-offs, because evidence is what an assessment checks.
6. Review periodically. Compliance is continuous: re-assess when your size, systems or suppliers change.

NCNICC-1:2025 compliance checklist

• Category (A or B) determined and documented
• Cybersecurity function and head of cybersecurity defined, independent of IT
• Board- or CEO-approved information security policy
• Risk assessment completed and risk register maintained
• Asset inventory (hardware, software, cloud, data)
• MFA enforced for remote and privileged access
• Email protection and anti-phishing controls in place
• Backups tested and documented
• Vulnerability scanning and penetration testing schedule
• Logging and monitoring (managed SOC for Category A)
• Incident response plan with roles and contacts
• Cybersecurity clauses in supplier and cloud contracts
• Staff awareness training delivered and recorded
• Periodic review and internal audit scheduled

Related guides

This guide is general information, not legal advice. Always check the official text from the relevant authority before making decisions.