NCNICC-1:2025: The 26 Controls Saudi SMBs Must Meet

NCNICC-1:2025 has three main components: Cybersecurity Governance, Cybersecurity Defence, and Third-Party and Cloud Computing Cybersecurity. Twenty-two sub-components in total.

Class A entities (more than 250 staff, or revenue above SAR 200 million) implement all three components, all 22 sub-components, all 65 controls.

Class B implements one main component. In the NCA's own table: one main component, 13 sub-components, 26 essential controls. That component is Cybersecurity Defence.

Governance and Third-Party and Cloud are marked recommended for Class B, not mandatory. So is penetration testing, and so is web application protection. Those are the two Defence sub-components that fall outside the mandatory 13, which is how 15 becomes 13.

This matters because it inverts the usual compliance instinct. There is no mandatory policy set, no mandatory risk methodology, no mandatory internal audit, no mandatory awareness programme for a Class B entity. The NCA has not asked a 40-person company to build a governance function. It has asked it to have working technical controls.

Identity and access (2-2). Multi-factor authentication is explicitly required for remote access, and the control names email and external applications specifically. Also mandatory: secure username and password management, authorisation built on need-to-know, least privilege and segregation of duties, and periodic review of access rights. Privileged access management is recommended rather than mandatory at Class B.

Systems protection (2-3). Anti-malware across servers, user devices and mobile. Changing default settings, which the control spells out as disabling unnecessary services, changing default passwords, and restricting removable media. And central clock synchronisation from an accurate trusted source, with the NCA pointing at SASO as an example. That last one surprises people, but without synchronised time your logs cannot be correlated.

Email (2-4). Filtering for phishing and spam, and documenting your email domain through the Haseen platform using SPF, DKIM and DMARC. This is named in the control text. It has no equivalent in ISO 27001 or NIST CSF, so an organisation that adopted an international framework first will not have it. Advanced persistent threat protection is recommended, not mandatory, at Class B.

Network (2-5). Firewalls and secure access gateways, and wireless network security using secure authentication and encryption. Segmentation, browsing restrictions, port and protocol control, intrusion prevention and DDoS protection are all recommended at Class B.

Mobile and BYOD (2-6). If you allow personal devices onto the network, the requirements have to be defined, documented, approved and applied.

Data (2-7). Printer, scanner and copier security, and secure disposal and reuse of assets including paper and storage media. Data leakage prevention and brand protection are recommended, not mandatory.

Cryptography (2-8). Encryption of data at rest and in transit is mandatory. Alignment with the National Cryptographic Standards at basic level is recommended for Class B and mandatory for Class A. Worth knowing which side of that line you sit on before you spend money.

Backup (2-9). Periodic backup of sensitive business systems, and periodic testing that restoration actually works. Both mandatory. An untested backup does not satisfy this.

Vulnerabilities (2-10). Patch management, vulnerability scanning of external-facing applications, and remediation prioritised by classification including testing fixes before deployment. Periodic scanning of all assets is recommended rather than mandatory at Class B.

Logging and monitoring (2-12). Enabling cybersecurity event logs on sensitive information assets is mandatory. Subscribing to an NCA-licensed managed SOC provider is mandatory for Class A and recommended for Class B. If you are Class A, that is not a build-or-buy decision, the licence sits with the provider.

Incidents (2-13). Two obligations that apply to both classes and that many organisations miss: reporting cybersecurity incidents to the NCA, and sharing cybersecurity information with the NCA. Detailed response plans and escalation are recommended at Class B, but the reporting duty is not.

Physical (2-14). Protecting physical access to IT rooms and sensitive electronic equipment, and protecting CCTV records.

Two points are worth taking directly from the document, because summaries tend to compress them.

The controls apply to entities the NCA notifies. The document says they apply to non-CNI private entities in the Kingdom that are circulated to by the Authority, and that Class A and Class B controls are binding on entities that are notified by the Authority. The NCA can also impose additional controls where it decides they are needed. Organisations outside scope are told they are responsible for benefiting from the controls as appropriate. So the trigger is notification by the Authority rather than publication date. Establishing whether you have been notified is the first question to settle.

Micro entities are out. The document's definition of "entity" excludes micro enterprises, non-governmental organisations, the government sector and critical national infrastructure. That is why the Class B band starts at 6 employees.

No deadline is published in the document, and the document itself sets out no penalty schedule. It states that compliance will be assessed by the Authority through whatever mechanism it deems appropriate, under Article 10(3) of the NCA's statute. Separately, the NCA holds general enforcement powers under Royal Decree M/117 of 22 December 2024, including fines of up to SAR 25 million, but those are the Authority's general powers rather than something NCNICC itself specifies.

Score yourself against the Class B set before committing budget. Our free assessment tools do this and email you the breakdown. If you are unsure whether NCNICC or ECC applies to you at all, start with the framework map.

National Cybersecurity Authority. Non-CNI Private Sector Entities Cybersecurity Controls (NCNICC-1:2025), Arabic edition, document classification: public. Tables 1, 2, 3 and 5, and the control tables for components 1, 2 and 3. National Cybersecurity Authority. Essential Cybersecurity Controls (ECC-2:2024). Royal Decree M/117, 22 December 2024, legal powers of the National Cybersecurity Authority.