Owners of small and medium companies in the Kingdom now hear two names in the same conversation: ISO 27001, the international certificate that customers and partners ask about, and NCNICC, the National Cybersecurity Authority's controls for private companies outside critical infrastructure. Budgets and teams are limited, so the question is practical: which one first, and how do you avoid doing the work twice?

Two different kinds of requirement #

NCNICC is a national obligation. The Non-CNI Private Sector Entities Cybersecurity Controls (NCNICC-1:2025) set the minimum cybersecurity controls for private-sector organizations that do not own, operate or host critical national infrastructure. Entities in scope must comply continuously, and the NCA assesses compliance through the mechanism it considers appropriate.

ISO/IEC 27001 is a voluntary international standard. It specifies the requirements for an information security management system (ISMS): a way of running security through leadership commitment, risk assessment, controls, internal audit and continual improvement. Organizations choose it, usually because clients, tenders or partners abroad ask for an accredited certificate.

What NCNICC asks of a small or medium company #

NCNICC sorts entities into two categories, based on the size definitions of the General Authority for Small and Medium Enterprises (Monshaat):

  • Category A, large entities: 3 main components, 22 subcomponents and 65 mandatory core controls.
  • Category B, small and medium entities: 1 main component, 13 subcomponents and 26 mandatory core controls.

For Category B, every mandatory control sits in the Cybersecurity Defense component. In plain terms, the mandatory list covers:

  • Asset management, and identity and access management (including authentication and periodic access reviews).
  • Protection of systems and devices against malware, with secure configuration and synchronized clocks.
  • Email protection, including filtering, and authenticating your email domain through the Haseen platform using SPF, DKIM and DMARC.
  • Network security, including secure wireless networks.
  • Mobile device security, and the protection of data and information.
  • Encryption of data at rest and in transit.
  • Backups of critical systems, with periodic restore tests.
  • Vulnerability management and regular patching.
  • Event logging.
  • Incident and threat management, including notifying the NCA of incidents and sharing cybersecurity information with it.
  • Physical security.

The governance controls, such as a documented risk methodology, policies and periodic reviews, are recommended for Category B rather than mandatory. Penetration testing is likewise not in the mandatory list for Category B.

What ISO 27001 asks #

ISO/IEC 27001:2022 is not a checklist. It requires you to define the scope of your ISMS, assess your information security risks, choose controls to treat them, and record your choices in a Statement of Applicability against the 93 reference controls in Annex A, organized in four themes: organizational, people, physical and technological. You then run internal audits and management reviews and improve continually.

Certification is issued by an accredited certification body, normally on a three-year cycle with surveillance audits in between. The transition from the 2013 edition ended in October 2025, so any certificate today should be to the 2022 edition.

Where they overlap #

Most of the NCNICC Category B controls have a natural home in ISO 27001 Annex A. A starting map, which you should refine for your own environment:

  • Asset management (NCNICC 2-1) and Annex A 5.9, inventory of information and other associated assets.
  • Identity and access (2-2) and Annex A 5.15 to 5.18 and 8.5, access control, identity, authentication and access rights.
  • Malware and secure configuration (2-3) and Annex A 8.7 and 8.9.
  • Network security (2-5) and Annex A 8.20 to 8.22.
  • Mobile devices (2-6) and Annex A 8.1, user endpoint devices.
  • Cryptography (2-8) and Annex A 8.24.
  • Backups (2-9) and Annex A 8.13.
  • Vulnerability management (2-10) and Annex A 8.8.
  • Logging (2-12) and Annex A 8.15 and 8.16.
  • Incident management (2-13) and Annex A 5.24 to 5.28.
  • Physical security (2-14) and Annex A theme 7.

Some NCNICC requirements are specific to the Kingdom and have no direct Annex A equivalent, such as authenticating your email domain through Haseen, and notifying and sharing information with the NCA. An ISO certificate on its own does not show you meet them.

Which to do first #

For a company in NCNICC scope, the sequence that wastes the least effort is usually:

  1. Meet the NCNICC floor. It is the obligation, and its Category B controls are the practical protections that stop the most common attacks on small companies.
  2. Do it the ISO way. Document each control as a short policy and procedure, assign owners, keep evidence, and record your asset list and risks. This is what turns a set of controls into the beginnings of an ISMS.
  3. Add the management system if the market asks. When clients or tenders require a certificate, add the ISO pieces NCNICC does not demand of you: the formal risk assessment and treatment, the Statement of Applicability, internal audit and management review. Then invite a certification body.

There are exceptions. If a contract already requires an ISO certificate by a set date, start the ISMS now and fold the NCNICC controls into it from day one. And if your company grows into Category A, the governance controls become mandatory, which ISO 27001 prepares you for well.

A word on evidence #

Both paths fail for the same reason: controls that exist on paper but not in practice. Keep simple, dated evidence as you go, such as access review records, backup restore test results, patching reports and incident drill notes. It serves an NCA assessment and an ISO audit equally.

Our NCNICC readiness service and our ISO/IEC 27001 service are designed to be run in this order, so the work you do for the first is reused for the second. For the full picture of the controls, see our NCNICC guide for the private sector.

Frequently asked #

Is ISO 27001 mandatory in Saudi Arabia?

No. ISO/IEC 27001 is a voluntary international standard. NCNICC, by contrast, is a national set of controls that private entities in its scope must comply with.

How many NCNICC controls apply to a small or medium company?

Category B, small and medium entities as defined by Monshaat, has 26 mandatory core controls in 13 subcomponents, all in the Cybersecurity Defense component. Large entities in Category A have 65 controls across 3 components.

Does an ISO 27001 certificate prove NCNICC compliance?

No. The two overlap a great deal, but NCNICC includes Kingdom-specific requirements, such as email domain authentication through Haseen and notifying the NCA of incidents, that a certificate does not demonstrate.

Can we do both at once?

Yes. Build the NCNICC controls with ISO-style documentation, owners and evidence, then add the management system pieces when you need a certificate. Nothing has to be redone.

Official Sources and References #

The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.