Most small and medium companies discover their incident response plan during the incident: who has the admin password, which provider to call, whether to switch the server off, whether anyone must be told. Those first decisions, made under pressure, often decide how much data is lost, how long the business stops and whether obligations are missed.

Below is a plan a small or medium company can realistically maintain, together with the national requirements it has to cover.

What the national requirements ask #

NCNICC #

For private companies outside critical infrastructure, the NCA's NCNICC controls include incident and threat management (control 2-13) for both size categories. For small and medium entities (Category B):

  • Defining, documenting and approving incident and threat management requirements is mandatory, as is implementing them.
  • Notifying the NCA when a cybersecurity incident occurs is mandatory.
  • Sharing cybersecurity information with the NCA is mandatory.
  • Detailed response plans for incidents such as data breaches and ransomware, with escalation procedures, and the periodic review of the requirements, are recommended for Category B and mandatory for large entities.

Government entities and critical infrastructure operators follow the equivalent control in the Essential Cybersecurity Controls (2-13), which also covers incident classification and handling threat intelligence.

The Personal Data Protection Law #

If an incident involves personal data, it is also a data protection event. The Implementing Regulations of the PDPL require the controller to notify the Saudi Data and AI Authority (SDAIA) within 72 hours of becoming aware of a personal data breach that may harm the data subjects or conflict with their rights, and to notify affected individuals without undue delay where the breach may harm them. In 2026 SDAIA published proposed amendments that would broaden the duty to notify; check the current text when you finalize your plan.

International references #

NIST SP 800-61 Rev. 3, published in April 2025, replaces the 2012 edition and places incident response inside overall cybersecurity risk management, aligned with the NIST Cybersecurity Framework 2.0. ISO/IEC 27035-1:2023 sets out the principles of incident management. Both are good references; neither needs to be copied in full by a small company.

The plan on a few pages #

1. Roles, with real names #

  • Incident lead: coordinates, decides priorities and keeps the timeline.
  • Technical lead: your IT person or managed service provider.
  • Management decision maker: authorizes shutting systems down, spending and external notifications.
  • Communications: customers, staff and, if needed, media.
  • Legal and privacy: decides on regulatory notifications, including SDAIA for personal data.

In a small company one person may hold two roles. What matters is that everyone knows who decides, and that each role has a named deputy.

2. A contact sheet that works offline #

Keep a printed and offline copy with: internal phone numbers, your IT or hosting provider's emergency line, your cloud and email providers' support routes, your bank's fraud line, your incident response retainer if you have one, and the NCA and SDAIA reporting channels. During a ransomware attack, the shared drive where the plan lives may be the first thing you lose.

3. Severity levels #

Keep three or four levels with simple triggers, for example:

  • Low: a single device or account affected, no sensitive data, no business stop.
  • Medium: several devices or a business system affected, or suspected access to internal data.
  • High: operations stopped, ransomware, confirmed data theft or any personal data breach.

The level decides who is woken up, and which notifications must be considered.

4. The first hour #

  1. Confirm and record: what was seen, by whom, when. Start a timeline and keep it.
  2. Contain without destroying evidence: disconnect affected devices from the network rather than wiping them; where practical, leave them powered on so volatile evidence is not lost.
  3. Protect accounts: reset passwords and revoke sessions for affected and privileged accounts, from a clean device.
  4. Protect the backups: confirm that offline or immutable backups are intact and isolated before anyone restores.
  5. Escalate by severity: call the people your severity table names.
  6. Start the notification clock: note the time you became aware, because the PDPL deadline counts from awareness.

5. Short playbooks for the likely incidents #

Write one page each for the incidents small companies actually face:

  • Ransomware: isolate, preserve evidence, check backups, involve specialists before restoring, and take any payment decision only with management, legal advice and the authorities in the loop.
  • Business email compromise: secure the mailbox, check forwarding rules, warn finance, contact the bank immediately if a payment was redirected.
  • Lost or stolen device: remote lock and wipe, revoke sessions, assess what data it held.
  • Website or online store compromise: take a snapshot, restore from a clean source, rotate credentials and API keys, review connected apps.
  • Suspected personal data leak: scope what data and whose, preserve evidence, and run the SDAIA assessment immediately.

6. Recovery and lessons learned #

Restore from known-good backups, monitor closely for reinfection, and hold a short review within two weeks: what happened, what worked, what to change. Update the plan, the playbooks and the risk register.

Rehearse it #

A plan that has never been rehearsed rarely works on the day. Run a tabletop exercise at least twice a year: one hour, a realistic scenario such as "the accountant's mailbox is sending payment requests", and the real people in the room. Each exercise usually finds a missing phone number, an unclear decision or an untested backup.

A one-week starting point #

  • Day 1: name the roles and deputies.
  • Day 2: build the offline contact sheet.
  • Day 3: agree the severity levels.
  • Day 4: write the first-hour checklist.
  • Day 5: write the ransomware and email compromise playbooks.
  • Day 6: test a backup restore.
  • Day 7: run a 30-minute tabletop with the team.

If an incident is under way now, our digital forensics and incident response team can help you contain it and preserve evidence. For the obligations behind the plan, see our NCNICC readiness service and our PDPL compliance service.

Frequently asked #

Must a small company report cybersecurity incidents to the NCA?

For private companies in NCNICC scope, notifying the NCA when a cybersecurity incident occurs, and sharing cybersecurity information with it, are mandatory for both large and small and medium entities.

How fast must a personal data breach be reported to SDAIA?

The PDPL Implementing Regulations require notification within 72 hours of becoming aware of a breach that may harm data subjects or conflict with their rights. SDAIA proposed broader amendments in 2026, so check the current text.

Should we switch off an infected computer?

Disconnect it from the network to stop the spread, but where practical leave it powered on and do not wipe it, so the evidence needed for investigation is preserved.

How often should we test the plan?

Run a tabletop exercise at least twice a year and test a backup restore regularly. Each exercise usually reveals a gap you can fix before a real incident.

Official Sources and References #

The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.