Cyber Governance for Saudi Boards: A Director's Guide

A vulnerability is a weakness in your systems or processes. A threat is an actor or event that could exploit that weakness. Risk is the probability of that happening multiplied by the business impact if it does. Risk is expressed in riyals and business outcomes, not technical scores. When your CISO reports "500 critical vulnerabilities," the board's response should be: what is our financial risk exposure, and what is the remediation plan?

Ransomware attackers encrypt your data and demand payment for the decryption key. Saudi Arabia recorded 88 ransomware incidents in 2024 alone. The average cost of a ransomware breach is $4.91 million. Only 12% of victims achieve full recovery. Modern attacks use "double extortion" -- stealing data before encrypting it and threatening public release. Attackers can move laterally through a network in under 48 hours once they have initial access.

The 2021 Saudi Aramco data leak did not come from a direct attack on Aramco. It came from a third-party contractor. The $1.5 billion Bybit cryptocurrency heist in February 2025 exploited a vulnerability in a free third-party tool. Approximately 40% of breaches involve data stored or processed by third parties. Your security posture is only as strong as your weakest vendor.

Three types exist: malicious insiders who intentionally steal or sabotage, negligent insiders who accidentally cause breaches, and compromised insiders whose credentials have been stolen and are being used by external attackers. Human error is the cause of 74% of all breaches. Malicious insider incidents cost an average of $4.99 million -- the most expensive attack vector -- and bypass perimeter defenses entirely.

AI has fundamentally changed the threat landscape. Phishing attacks linked to generative AI surged 1,265% in 2024. Deepfake fraud incidents rose 3,000%. Criminals used a deepfake video call impersonating a CFO to steal $25 million from a multinational in one incident. Meanwhile, "shadow AI" -- employees using unapproved AI tools in their work -- creates data leakage risks that most IT teams cannot see or control.

Cybersecurity is about preventing attacks. Cyber resilience is about ensuring your organisation continues to operate when an attack succeeds. The question the board should be asking is not "Are we protected?" It is: "If our primary systems were encrypted tomorrow morning, how long until critical operations resume, and who makes the decisions?"

The NCA framework covers all Saudi government entities, their subsidiaries, and all private sector organisations that own, operate, or host Critical National Infrastructure. The updated 2024 framework specifies 108 main controls and 92 subcontrols across four domains: Governance, Cybersecurity Defence, Resilience, and Third-Party/Cloud Security. You will see "110 controls" quoted in several places online; the NCA's own document says 108, and a board paper citing the wrong figure is an easy thing for an assessor to notice.

Board-level requirements include establishing an independent cybersecurity department (separate from IT), creating a supervisory cybersecurity committee with a board-approved charter, and filling cybersecurity roles with qualified Saudi nationals. This expanded under ECC-2:2024: where ECC-1 required only senior cybersecurity positions to be held by Saudi nationals, ECC-2 extends it across the cybersecurity function. Evidence of nationality alone is not enough, the organisation must also show the person performs the role and holds the qualification or experience for it. That is a workforce planning decision with a board-level budget consequence.

Penalties under Royal Decree M/117 (22 December 2024): warnings, temporary or permanent licence suspension, suspension of activity, and fines of up to SAR 25 million (roughly $6.7 million). A committee determines the penalty based on the nature, recurrence and severity of the violation, and decisions can be appealed to the Administrative Court within 60 days.

For a private company that has not been designated critical national infrastructure, this is usually the applicable framework.

Published in January 2026, NCNICC-1:2025 covers private sector organisations that are not critical national infrastructure. If nobody has designated your company as CNI, ECC is probably not your obligation and this is.

It scales by size. Large entities, meaning more than 250 staff or revenue above SAR 200 million, implement 65 controls. Entities of 6 to 249 staff, or SAR 3 million to 200 million, have 26 mandatory controls concentrated in Cybersecurity Defence. The NCA does not expect a 40-person company to run an internal audit function; it does expect multi-factor authentication, patching and tested backups.

The controls bind entities the NCA notifies, and no compliance deadline has been published. The document sets no penalty schedule of its own; the SAR 25 million ceiling above sits in the NCA’s general powers under Royal Decree M/117. The practical risk is not a missed date, it is discovering the obligation when someone asks for evidence.

The board question: has management confirmed in writing which framework applies to us, and on what basis? Assessing against the wrong control set is an expensive way to discover the answer. Our complete NCA framework map sets out the scope trigger for each.

Mandatory for all SAMA-regulated financial institutions. The framework is explicit: "The ultimate responsibility for cybersecurity rests with the board." The board must approve the cybersecurity strategy, establish a cyber committee, ensure CISO independence, and receive regular reporting. A minimum maturity of Level 3 is required across all domains, with Level 4 targeted in areas including threat intelligence, access control, and incident response.

Fully enforceable since September 2024. Key board obligations include appointing a Data Protection Officer, completing data mapping, establishing consent mechanisms, and maintaining a 72-hour breach notification capability to SDAIA. Fines reach SAR 5 million, doubled for repeat violations. Intentional disclosure of sensitive data carries criminal penalties including up to two years' imprisonment.