Saudi Arabia’s National Cybersecurity Authority (NCA) has issued cybersecurity controls for private sector entities that are not critical national infrastructure (non-CNI). Until now, NCA requirements such as the Essential Cybersecurity Controls mainly applied to government entities and critical infrastructure operators. These controls take a mandatory cybersecurity baseline into the wider private sector.
Who is in scope
The controls apply to non-CNI private sector entities in Saudi Arabia, as notified by the Authority, in two categories:
| Category | Full-time employees | Or annual revenue |
|---|---|---|
| Large entities | More than 250 | Above SAR 200 million |
| Small and medium entities | 6 to 249 | SAR 3 million to SAR 200 million |
Entities outside the formal scope are encouraged to use the controls as good practice, and the NCA may impose additional controls where it considers the cyber risk higher.
What the controls cover
The framework is organised into three main components:
- Cybersecurity governance: strategy, roles, policies, risk management and compliance
- Cybersecurity defence: the operational controls, such as asset and identity management, protection of systems and data, monitoring and incident response
- Third-party and cloud computing cybersecurity: suppliers, outsourcing and cloud services
Large entities implement all three components in full. Small and medium entities have a narrower mandatory set, and some controls that are mandatory for large entities are recommended for them. Commentary also notes that the NCA may assess compliance at any time and without advance notice.
How to prepare
- Confirm your category. Check headcount and revenue against the thresholds, and whether you have been notified.
- Run a gap assessment against the controls that apply to your category. Record the evidence for each control, not just a yes or no.
- Start with governance. A named cybersecurity function, an approved strategy and policies, and a risk assessment drive everything else.
- Fix the defence gaps by risk. Identity and access, vulnerability and patch management, logging and monitoring, and backups usually come first.
- Bring suppliers and cloud services into scope. Contracts, assessments and the cloud services you rely on.
- Keep evidence ready. If an assessment can come without notice, the evidence has to be current all the time, not assembled for an audit.
If you already run ISO/IEC 27001 or SAMA CSF
Much of the work may already be done. Map your existing ISO/IEC 27001 or SAMA CSF controls to the NCA controls, mark what is covered, and close what is not. One control set can serve all of them, with one body of evidence. If you process personal data, align the work with your PDPL programme as well.
We run NCA gap assessments, remediation roadmaps and evidence preparation for organisations in the Kingdom. Talk to us about your category and timeline.
Sources: Baker McKenzie, Saudi Arabia: cybersecurity controls for private entities (July 2026); Al Tamimi & Company, Raising the baseline: what the NCA’s new non-CNI cybersecurity controls mean for private sector entities in Saudi Arabia (October 2026). Always confirm current requirements with the NCA.