Does NCA cybersecurity apply to my company?
Start with your organization’s role and any NCA notification. Government and Critical National Infrastructure entities fall within the ECC scope. NCNICC-1:2025, published on 28 December 2025, covers non-CNI small, medium and large private entities notified by NCA. Your size alone does not establish that a notice or compliance deadline applies.[S1]
By Aziz Al Khunizan, Master's in Information Security. Last updated .
The 60-second answer
Which bucket are you in?
- Government or CNI → assess ECC-2:2024 and DCC-1:2022; add CCC-2:2024 when using cloud services within its scope.
- Large non-CNI private entity notified by NCA → NCNICC Category A. Confirm your category and implementation timetable with NCA.
- Small or medium non-CNI private entity notified by NCA → NCNICC Category B. Apply the requirements identified for that category.
- Micro entity or no NCA notice identified → verify your scope with NCA and your sector regulator; use the controls to strengthen security.
- Handle personal data? → assess PDPL separately. Company size and an NCA scope decision do not remove personal-data obligations.
Not sure which apply to you? → Take the 2-minute "Am I compliant?" check.
The two questions that decide it
1. Are you government, CNI, or a cloud provider serving them?
Check whether you are a government entity or own, operate or host CNI. CCC covers government and CNI cloud tenants and providers serving those tenants; other entities are encouraged to use it. A sector label alone does not establish CNI status.[S2]
2. For a non-CNI private company, has NCA notified you?
The current Arabic NCNICC text makes its mandatory scope conditional on NCA notification. It distinguishes large entities (Category A) from small and medium entities (Category B), with reference to Monsha’at definitions. Check the notice, size classification and applicable timetable before declaring a company in scope.[S1]
What the controls actually cover
NCNICC addresses governance, cybersecurity defense and third parties, with requirements varying by category. For cloud providers in CCC scope, NCA now publishes the GCCC-CSP-2:2026 implementation guide, which explains implementation and expected evidence for CCC-2:2024. The guide supports the existing controls; it does not replace them.[S3]
How this stacks with PDPL
NCA governs cybersecurity; PDPL governs personal data. Assess each regime separately for your organization and processing activities. CCC-2:2024 removed two provider localization controls and refers localization decisions to NDMO. This does not authorize offshore hosting: PDPL transfer requirements, data classification and sector rules still need assessment.