NCNICC-1:2025: The 26 Controls Saudi SMBs Must Meet

Multi-factor authentication on remote access is explicitly required, and this is the single most common gap. It applies to staff reaching systems from outside the office, not only to administrators.

Evidence that satisfies a review: your identity provider's configuration showing enforcement, a report of accounts in scope, and confirmation there is no bypass path. An MFA policy document proves nothing on its own. Screenshots of enforcement do.

You cannot secure what you have not enumerated. Expect to show a maintained inventory of hardware, software and cloud services, with an owner for each.

Evidence: the inventory itself, and something that demonstrates it is maintained rather than written once. A dated review, or an automated feed from your endpoint tooling.

Baseline configurations, endpoint protection deployed across the estate, and network segmentation appropriate to your size.

Evidence: the baseline standard, and coverage reporting that shows what percentage of assets actually conform. Coverage gaps are what reviewers look for.

Both are named in the framework. Scanning on a defined cycle, penetration testing that produces a report, and remediation tracked to closure with dates.

Evidence: scan output over time showing the trend, the most recent test report, and a remediation log. A single clean scan is weaker evidence than a documented cycle with findings being closed.

Logs generated, retained, and reviewed. For most SMEs the practical question is who watches them outside working hours. Where monitoring is outsourced, the arrangement may need to involve an NCA-licensed provider, so check the licensing position of any partner before signing.

Evidence: log sources in scope, retention configuration, and evidence of review or escalation. If you use a managed service, the contract and the provider's licensing status.

Backups that exist, are protected from the thing that would destroy the originals, and have been restored at least once.

Evidence: backup configuration, and a restore test with a date and an outcome. Untested backups are treated as absent, and reasonably so.

Alignment with the NCA's Haseen platform. This is Saudi-specific and has no counterpart in ISO 27001 or NIST CSF, which is why organisations that adopted an international framework first almost always miss it.

Evidence: your email authentication records and your Haseen alignment status.

Alignment with the National Cryptographic Standards. Strong encryption is not automatically compliant encryption; the standards specify what is acceptable in the Kingdom.

Evidence: where encryption is applied, and the algorithms and key management in use.

A plan that names people, not roles in the abstract, and that has been exercised.

Evidence: the plan, and a record of a tabletop or a real incident with what was learned.

Controls over the environments holding your systems, including any comms room or on-premises equipment.

Evidence: access control records and a description of the arrangements.

Contracts that address security, and cloud services configured deliberately rather than by default.

Evidence: vendor contract clauses, and configuration evidence for your main cloud tenancy.

Even in the reduced SME set there is a governance floor: approved policy, assigned responsibility, and staff awareness.

Evidence: the approved policy with a date and an approver, a named owner for cybersecurity, and awareness completion records.