NCNICC-1:2025 Explained: Saudi Arabia's New Cybersecurity Controls for Private Business

For twenty years, cybersecurity compliance in Saudi Arabia was a conversation that happened in control rooms and government IT departments — the Essential Cybersecurity Controls applied to government bodies and to operators of critical national infrastructure, and everyone else watched from a comfortable distance. That distance closed on 28 December 2025, when the National Cybersecurity Authority published NCNICC-1:2025 — the Cybersecurity Controls for Non-CNI Private Sector Entities. If your company employs more than a handful of people or turns over more than a few million riyals, this document is now about you.

This article is a working summary: who the controls apply to, what they actually ask for, and what a sensible first response looks like. It is an explainer, not legal advice — the controls document itself, published by the NCA, is the authority.

Who the controls apply to

NCNICC-1:2025 divides private sector entities in the Kingdom into two categories, using headcount or revenue — meeting either threshold puts you in the category:

• Category A (large entities): more than 250 staff, or revenue above SAR 200 million. All 65 controls apply, and they are mandatory.
• Category B (SMEs): 6 to 249 staff, or revenue between SAR 3 million and SAR 200 million. A core set of 26 controls is mandatory; the remaining 39 are recommended.
• Below both thresholds — fewer than 6 staff and under SAR 3 million in revenue — the controls do not apply as published. Growth changes that, and it changes it quietly.

Two things are easy to misread. First, the thresholds are alternatives: a company with 40 staff and SAR 250 million in revenue is Category A. Second, the categories follow the entity, not the mood — an SME that wins a major contract can cross into Category A mid-year, and the control set changes with it.

What the controls ask for

The 65 controls are organised in three domains: governance, defense, and third-party and cloud. The intent is not exotic — most of it is what a well-run IT environment should already be doing — but the controls turn intent into named obligations.

• Governance: clear accountability for cybersecurity at management level, an independent CISO function, approved policies, staff training, and Saudi nationals in key cybersecurity roles.
• Defense: multi-factor authentication for remote and privileged access, hardened system configurations, cryptography aligned with national cryptographic standards, and logging and monitoring worth reading.
• Third-party and cloud: cybersecurity clauses written into supplier and vendor contracts, risk assessment of cloud services, and control over what third parties can reach.

Category A carries the obligations that change how a company is organised: the independent CISO function is explicit, and Category A entities are expected to run their security monitoring through an NCA-licensed security operations centre rather than a server closet with a dashboard. Category B is lighter, but the mandatory 26 include the parts that matter most — MFA, governance, vendor clauses, incident handling — so 'SME scope' is not a soft option.

How it relates to ECC-2

It does not replace anything. ECC-2:2024 continues to govern government entities and critical national infrastructure; NCNICC-1:2025 extends the same philosophy to the private sector outside CNI. The vocabulary is shared — assets, risk, evidence — so a company that has worked toward ECC or ISO 27001 is not starting from zero. But shared vocabulary is not shared scope: NCNICC adds obligations that are specific to the Kingdom, such as the licensed-SOC requirement for large entities and the national cryptography alignment, and no foreign framework substitutes for those.

No deadline does not mean no hurry

As of this writing, the NCA has published no single compliance deadline, and commentators expect enforcement to be continuous rather than date-based. That is not a reason to wait. The controls are evidenced by documentation — there is no certificate to buy and no auditor to charm; an assessment asks to see the policy, the asset list, the access records and the incident log. Building that evidence takes quarters, not weeks. And the statutory framework behind NCA violations carries penalties of up to SAR 25 million, before counting the commercial cost of failing a customer's security review.

Where physical and OT systems fit

The controls speak about assets, access and monitoring in general terms, and an honest asset inventory reaches further than the IT rack. The camera controller on the gate network, the building-management system, the refrigeration plant controller — these are assets under any reading of the controls, and they are usually the least inventoried, least patched and least monitored devices on the estate. We have written before about what that looks like when it goes wrong; NCNICC makes the inventory and the access control around those devices a named responsibility rather than a good intention.

What to do first

• Confirm your category — headcount and revenue, either threshold, as published.
• Gap-assess the applicable control set (65 or 26) against what you actually have, not what the policies say you have.
• Collect the evidence as you go: the inventory, the approvals, the access reviews, the training records. Evidence is the compliance.
• Remediate what is cheap and high-risk first — MFA coverage and vendor contract clauses move faster than any platform project.
• Name an owner. The governance domain fails first in every assessment we run, and it fails because nobody is accountable.

Lantern's OT and cyber compliance practice runs exactly this as a programme: category confirmation, control-by-control gap assessment across IT and OT estates, an evidence register the assessment can test, and a remediation roadmap ordered by risk and effort. It is deliberately unglamorous work — the same kind that decides whether an incident is a bad night or a bad quarter. If NCNICC-1:2025 is new territory for your organisation, that assessment is the right first step, and we can scope it against a single site.