Until 2026, most private companies in Saudi Arabia could assume NCA’s controls were "for critical infrastructure, not us." That’s no longer true. With NCNICC-1:2025 (in force from January 2026), the National Cybersecurity Authority extended a mandatory baseline to every private-sector entity in the Kingdom — not just Critical National Infrastructure.[S1]
Which bucket are you in?
Not sure which apply to you? → Take the 2-minute "Am I compliant?" check.
If a regulator has designated your systems as CNI (energy, finance, health, telecom, government-adjacent), you sit under the full NCA stack — ECC-2:2024 (4 domains, ~110 controls), CCC-2:2024 for cloud, and DCC-1:2022 for data.[S2]
NCNICC-1:2025 sorts non-CNI private entities into Category A (large: 250+ FTE or revenue over SAR 200M) and Category B (SME: 6–249 FTE or revenue SAR 3M–200M). Category A implements the full 65-control set; Category B a lighter profile. Both are mandatory.[S1]
NCNICC is organized into three components — Governance, Cybersecurity Defense, and Third-party & Cloud Computing Cybersecurity — with practical requirements like periodic risk assessments, endpoint protection, data classification, backup management, incident response procedures, and employee awareness training.[S3]
NCA controls and PDPL are separate, parallel obligations. NCA governs cybersecurity; PDPL (SDAIA) governs personal data. A typical SaaS company processing Saudi personal data now answers to both at once — NCNICC for security posture, PDPL for data handling and cross-border transfer. Neither exempts the other.