NCA NCNICC-1:2025: Cybersecurity Controls for Saudi Arabia's Private Sector

If your company operates in Saudi Arabia and you're not a bank, telecom operator, or critical infrastructure provider, you've likely never had a binding NCA cybersecurity requirement to satisfy — until now. NCNICC-1:2025 changes that for the vast majority of the Saudi private sector. Here is what it covers, who's in scope, and how to build toward it without over-engineering your response.

What Is NCNICC-1:2025?

NCNICC-1:2025 stands for Non-Critical National Information Infrastructure Cybersecurity Controls. It's a framework issued by Saudi Arabia's National Cybersecurity Authority (NCA), with an effective timeline around January 2026. You'll sometimes see it written informally as NCICC — the same requirement, just an abbreviation that drops a letter. Whichever way you've heard it referenced, the substance is the same: it's NCA's mandatory baseline for organizations that don't operate Critical National Infrastructure.

Why Did NCA Create NCNICC-1:2025?

NCA's original framework, the Essential Cybersecurity Controls (ECC), was deliberately scoped to government entities and CNI operators — energy, telecom, finance, healthcare, and similar critical sectors. That left a large gap: the ordinary Saudi private sector — retailers, professional services firms, manufacturers, logistics companies, technology startups, and thousands of SMEs — had no NCA-mandated baseline to work toward at all. NCNICC-1:2025 closes that gap. It is effectively the first binding, NCA-mandated cybersecurity standard to reach the general Saudi private sector, rather than only government and critical-infrastructure entities.

This gap mattered more every year. As Saudi Arabia's private sector digitized under Vision 2030 — e-commerce, fintech-adjacent services, cloud adoption, and remote work all expanding rapidly — non-CNI companies became an increasingly attractive target precisely because they were, on average, less mature than regulated CNI operators. Attackers do not particularly care whether a company is formally designated Critical National Infrastructure; a breach at a mid-sized logistics firm or professional services company can still cause significant operational and reputational damage, and can also become a supply-chain entry point into larger, regulated organizations that depend on it. NCNICC-1:2025 is NCA's answer to that exposure.

What Does "Non-Critical National Information Infrastructure" Actually Mean?

The name is easy to misread as "not important." It actually just means "not formally designated as Critical National Infrastructure" — i.e., not an energy operator, not a major telecom carrier, not a systemically important financial institution, and so on. Nearly every other private company in the Kingdom — regardless of how much sensitive customer data it holds or how central it is to its own industry — falls into this "non-CNI" category and is therefore squarely inside NCNICC-1:2025's scope.

Who Is In Scope of NCNICC-1:2025?

NCNICC-1:2025 applies to non-CNI private-sector entities operating in Saudi Arabia — small, medium, and large organizations alike. NCA applies the framework using a tiered approach based on organizational size and revenue, generally referred to as Category A and Category B. Some controls are mandatory for both categories; others apply only to Category A (typically larger organizations), while a subset of the more resource-intensive governance controls are listed as "recommended" rather than mandatory for smaller Category B entities. In practical terms: this covers the vast majority of ordinary Saudi businesses, not just large corporates.

If you are unsure which category your organization falls into, the safest planning assumption is to review both the mandatory and recommended control sets — recommended controls for Category B today are a reasonable signal of where mandatory requirements may expand as the framework matures through subsequent versions.

How Does NCNICC-1:2025 Differ From ECC?

ECC and NCNICC-1:2025 share a common lineage — both come from NCA, both use a governance / defense / resilience structure — but they differ meaningfully in reach and depth.

What Are the Components, Subcomponents, and Controls Under NCNICC-1:2025?

NCNICC-1:2025 mirrors ECC's logic at a lighter scale: 3 main components — Governance, Defense, and Resilience — broken into 22 subcomponents covering practical focus areas such as access management, risk management, monitoring, incident response, and third-party security, totaling roughly 65 essential controls. This is intentionally a smaller, more achievable set than ECC's 110 controls — the goal is a baseline every private company can realistically implement, not a critical-infrastructure-grade program.

Who's Covered by Which NCA / Sector Framework?

Saudi Arabia's cybersecurity regulatory map is layered by entity type and sector. Use this table to identify which framework(s) apply to your organization:

Many organizations sit at an intersection — for example, a licensed ICT hosting provider that is also a private company would need to consider both CST CRF and NCNICC-1:2025 depending on its CNI status. A platform like ComplyOS is designed to help map a single control library across multiple applicable frameworks rather than running separate compliance tracks in parallel.

How Should an SME Approach NCNICC-1:2025 Implementation?

For a typical SME or mid-market company with no prior formal cybersecurity program, a phased approach works better than attempting all 65 controls simultaneously:

• →Phase 1 — Governance basics. Assign clear cybersecurity ownership (even if it's a single accountable manager rather than a full team), write a baseline policy set covering acceptable use, access, and incident handling, and establish a simple risk register that names your top five to ten risks in plain language.
• →Phase 2 — Asset inventory. You cannot protect what you don't know you have. Build a working list of devices, servers, cloud accounts, SaaS applications, and where your most sensitive data actually lives — customer records, financial data, intellectual property.
• →Phase 3 — Access control and MFA. Multi-factor authentication on email, cloud applications, and administrative accounts is the single highest-impact control most SMEs are missing, and it directly addresses several NCNICC-1:2025 access management subcomponents at once.
• →Phase 4 — Backup and recovery. Tested, offline-capable backups for critical systems and data — tested meaning you've actually restored from them at least once, not just confirmed the backup job ran.
• →Phase 5 — Incident response basics. A simple, named incident response plan covering who does what in the first 24 hours of a security event — who gets notified, who makes the call to isolate systems, who communicates with customers if needed.
• →Phase 6 — Awareness training. Recurring, practical security awareness training for all staff — phishing recognition and password hygiene in particular — delivered more than once a year and reinforced with periodic simulated phishing tests.

Once these fundamentals are in place, formal alignment to the remaining NCNICC-1:2025 subcomponents — the more detailed monitoring, third-party security, and resilience requirements — becomes a documentation and evidence exercise rather than a ground-up build. Most SMEs that follow this sequence reach a defensible NCNICC-1:2025 baseline within two to three quarters, at a fraction of the cost of building critical-infrastructure-grade controls they don't actually need. GHS's GRC advisory services are built around exactly this phased approach for non-CNI Saudi companies.

How Is NCNICC-1:2025 Compliance Assessed?

NCA is the regulatory authority responsible for monitoring and enforcing NCNICC-1:2025 compliance, and assessment is expected to combine self-assessment, independent audits by NCA-approved third parties, and direct NCA inspections — similar in structure to how ECC compliance is assessed. Practically, the risk of falling behind shows up as adverse audit findings and reduced standing in regulated business relationships, not as a punitive event — which is exactly why building the fundamentals early, rather than scrambling before an assessment, is the lower-cost path.

When Does NCNICC-1:2025 Take Effect, and What Should Organizations Do Now?

NCNICC-1:2025 was released with an effective timeline around January 2026, which means most non-CNI Saudi private-sector organizations are now inside or approaching their initial compliance window. Waiting for a formal notice from NCA before starting is not a sound strategy — the framework applies based on your organization's status and category, not on receiving an individual invitation to comply. A sensible near-term sequence looks like this:

• →Confirm your category. Determine whether your organization falls into Category A or Category B based on size and revenue, since this determines which controls are mandatory versus recommended.
• →Run a baseline gap assessment against the published NCNICC-1:2025 control set rather than assuming your existing IT practices already satisfy it.
• →Sequence remediation using the phased approach described above, prioritizing the controls most likely to be checked first — governance, access management, and backup/recovery.

Organizations that start early treat this as a manageable, incremental improvement to their existing security practices. Organizations that wait tend to face a much larger remediation backlog compressed into a shorter window before their first assessment.

Frequently Asked Questions: NCNICC-1:2025