# NCA cybersecurity controls for the private sector: who is in scope and how to prepare

> Saudi Arabia's NCA has issued cybersecurity controls for private sector entities outside critical national infrastructure. Who is in scope, what the controls cover, and a practical way to prepare.

URL: https://securei3.com/insights/nca-cybersecurity-controls-private-sector/
Author: Secure iQube
Published: 2026-11-12

Saudi Arabia's National Cybersecurity Authority (NCA) has issued cybersecurity controls for **private sector entities that are not critical national infrastructure (non-CNI)**. Until now, NCA requirements such as the [Essential Cybersecurity Controls](/standards/nca-ecc/) mainly applied to government entities and critical infrastructure operators. These controls take a mandatory cybersecurity baseline into the wider private sector.

## Who is in scope

The controls apply to non-CNI private sector entities in Saudi Arabia, as notified by the Authority, in two categories:

| Category | Full-time employees | Or annual revenue |
| --- | --- | --- |
| Large entities | More than 250 | Above SAR 200 million |
| Small and medium entities | 6 to 249 | SAR 3 million to SAR 200 million |

Entities outside the formal scope are encouraged to use the controls as good practice, and the NCA may impose additional controls where it considers the cyber risk higher.

## What the controls cover

The framework is organised into three main components:

1. **Cybersecurity governance**: strategy, roles, policies, risk management and compliance
2. **Cybersecurity defence**: the operational controls, such as asset and identity management, protection of systems and data, monitoring and incident response
3. **Third-party and cloud computing cybersecurity**: suppliers, outsourcing and cloud services

Large entities implement all three components in full. Small and medium entities have a narrower mandatory set, and some controls that are mandatory for large entities are recommended for them. Commentary also notes that the NCA may assess compliance at any time and without advance notice.

## How to prepare

1. **Confirm your category.** Check headcount and revenue against the thresholds, and whether you have been notified.
2. **Run a gap assessment** against the controls that apply to your category. Record the evidence for each control, not just a yes or no.
3. **Start with governance.** A named cybersecurity function, an approved strategy and policies, and a risk assessment drive everything else.
4. **Fix the defence gaps by risk.** Identity and access, vulnerability and patch management, logging and monitoring, and backups usually come first.
5. **Bring suppliers and cloud services into scope.** Contracts, assessments and the cloud services you rely on.
6. **Keep evidence ready.** If an assessment can come without notice, the evidence has to be current all the time, not assembled for an audit.

## If you already run ISO/IEC 27001 or SAMA CSF

Much of the work may already be done. Map your existing [ISO/IEC 27001](/standards/iso-27001/) or [SAMA CSF](/standards/sama-csf/) controls to the NCA controls, mark what is covered, and close what is not. One control set can serve all of them, with one body of evidence. If you process personal data, align the work with your [PDPL](/standards/ksa-pdpl/) programme as well.

We run NCA gap assessments, remediation roadmaps and evidence preparation for organisations in the Kingdom. [Talk to us](/contact/?interest=NCA%20private%20sector%20controls) about your category and timeline.

**Sources:** [Baker McKenzie, Saudi Arabia: cybersecurity controls for private entities](https://www.bakermckenzie.com/en/insight/publications/2026/07/saudi-arabia-cybersecurity-controls-for-private-entities) (July 2026); [Al Tamimi & Company, Raising the baseline: what the NCA's new non-CNI cybersecurity controls mean for private sector entities in Saudi Arabia](https://www.tamimi.com/law-update/the-technology-issue-2026/articles/raising-the-baseline-what-the-ncas-new-non-cni-cybersecurity-controls-mean-for-private-sector-entities-in-saudi-arabia/) (October 2026). Always confirm current requirements with the NCA.

## Frequently asked questions

### Does this replace the NCA Essential Cybersecurity Controls?

No. The Essential Cybersecurity Controls remain the baseline for government entities and critical national infrastructure operators. The new controls extend NCA requirements to private sector entities that are not critical national infrastructure.

### Is there a compliance deadline?

The published commentary we have reviewed does not give a deadline or a phase-in period, and notes that the NCA may assess compliance at any time without advance notice. Entities that clearly meet the thresholds should start now rather than wait for a formal notification.

### We already hold ISO/IEC 27001. Are we covered?

Not automatically, but you are well placed. Map your existing ISO/IEC 27001 controls against the NCA controls, then close the gaps. Governance, defence and third-party security will largely build on what you already run.

### Do small companies need to comply?

Small and medium entities, as defined by the thresholds, have a narrower set of mandatory controls. Some controls that are mandatory for large entities are recommended for SMEs.