Most organizations already "do risk management" in some form: a spreadsheet, a list of concerns from the last audit, a few lines in a board report. The difficulty is that every team scores risk differently, so nobody can compare one risk with another or say with confidence which ones need action first.

The National Cybersecurity Authority addressed this with the National Framework for Cybersecurity Risk Management, published as NFCRM-1:2025. It gives entities a single methodology, a single 5x5 risk matrix and clear obligations, including which risks must be reported to the Authority.

Who the framework applies to #

The framework applies to government entities in the Kingdom (ministries, authorities, institutions and others), to the entities and companies affiliated with them inside and outside the Kingdom, and to private-sector organizations that own, operate or host critical national infrastructure.

The Authority also strongly encourages every other entity in the Kingdom to use it as best practice. That matters for private companies too: the NCNICC controls ask large private entities to define and apply a cybersecurity risk management methodology, and recommend it for small and medium ones. NFCRM is the natural reference for that methodology.

What in-scope entities must do at the national level #

The framework lists obligations toward the Authority itself. Every entity in scope must:

  • Name a liaison officer with the NCA for cybersecurity risk management.
  • Inventory and classify its assets, such as critical systems, facilities and operational systems, and social media accounts, and review the classification periodically.
  • Inventory its internet-facing assets, meaning assets with public IP addresses that can be reached across the internet.
  • Report those assets to the NCA periodically and whenever they change, through the Haseen platform or another channel the Authority specifies.
  • Report Critical and High risks to the NCA as soon as they are identified, using the framework's matrix, and share the related treatment plans periodically and whenever they change.
  • Address the risks, vulnerabilities and observations the NCA sends, and report back on what was done.

The immediate reporting of Critical and High risks is the obligation that changes behaviour most. Your scoring has to be consistent and defensible, because the score decides which risks you must report to the Authority.

The methodology: four phases #

At the entity level, the framework requires a continuous programme with the resources to run it, and the involvement of stakeholders such as the cybersecurity steering committee and the IT department. The methodology itself has four phases.

1. Identification #

  • Inventory and classify the entity's assets.
  • Identify cybersecurity vulnerabilities and the potential threats.
  • Develop the expected risk scenarios that combine those threats and vulnerabilities.
  • Identify the controls already in place for each scenario.
  • Define the entity's acceptable level of risk.

2. Assessment #

  • Analyse the inherent risk of every scenario, taking the current controls into account, and score its likelihood and impact on the framework's matrix.
  • Record the analysis and the results in the cybersecurity risk register.

3. Treatment #

For each risk, decide whether to accept it, share it, mitigate it or avoid it. Then:

  • Develop the treatment plans and estimate the expected residual risk, to confirm it reaches the acceptable level.
  • Prioritize the plans, implement them, and update the register with the plans and the residual risk.

4. Follow-up #

  • Produce risk management reports and define the data you collect to track progress.
  • Monitor the treatment plans regularly.
  • Run the whole methodology again periodically, when the NCA requires it, or when the treatment plans, threats, risk scenarios, control status or the digital infrastructure change.

The 5x5 matrix #

The framework scores every risk as Risk Level = Impact x Likelihood, each on a scale of 1 to 5. The product falls into one of five levels:

  • Very Low: 1 to 2
  • Low: 3 to 7
  • Medium: 8 to 14
  • High: 15 to 19
  • Critical: 20 to 25

Impact is judged on confidentiality, integrity and availability. At the lowest level the effect on the entity is negligible; at the highest it is severe enough that the entity cannot bear it, or it has an effect at the national level.

Likelihood can be judged by how often the event is expected, or by how easily a vulnerability can be exploited:

  • 5, Almost certain: expected several times a year, or exploitable by an unskilled attacker with ready-made exploit code.
  • 4, Probable: about once a year, or exploitable by an advanced attacker with custom tools.
  • 3, Improbable: once every two to three years, or exploitable by an advanced attacker only under specific conditions.
  • 2, Rare: once every three to ten years, or not directly exploitable today but possibly in the future.
  • 1, Very rare: less than once every ten to twenty years, or not exploitable at present.

A worked example #

Consider a file server that holds contracts and finance records, with an internet-facing remote access service that is two versions behind on patches. A ransomware scenario against it could stop operations for days: an impact of 4. Public exploit code exists for the remote access flaw, but it still needs some skill to chain: a likelihood of 4. The score is 16, High.

For an entity in scope, that score is not just an internal note: it must be reported to the NCA when identified, with a treatment plan. Patching the service and putting it behind multi-factor VPN access might bring the likelihood to 2, for a residual score of 8, Medium, which leadership can then decide to accept or reduce further.

How it fits with the controls you already follow #

  • ECC: the Essential Cybersecurity Controls (control 1-5) already require a documented risk management methodology, and risk assessments at the early stage of technology projects, before major infrastructure changes, when planning to use third parties, and before launching new services. NFCRM now standardizes how that assessment is scored and reported.
  • NCNICC: for large private entities, a documented and applied risk methodology is mandatory; for small and medium entities it is recommended.
  • ISO 31000 and ISO/IEC 27005: if you already follow these international standards, keep your process and align its scales and definitions with the NFCRM matrix, so the same register serves both.

Getting started in eight steps #

  1. Confirm whether your entity is in scope, and name the NCA liaison officer if it is.
  2. Build or refresh the asset inventory, including internet-facing assets and social media accounts.
  3. Adopt the NFCRM impact and likelihood definitions word for word in your methodology.
  4. Write risk scenarios, not single issues: threat, vulnerability, asset and consequence together.
  5. Score the inherent risk, record it in one register, and set the acceptable risk level with leadership.
  6. Agree treatment plans with owners and deadlines, and score the expected residual risk.
  7. Set up the reporting path for Critical and High risks so it happens as soon as they are identified.
  8. Schedule the next full cycle, and the triggers that will force an earlier one.

Our NCA risk management service helps entities build the methodology, the register and the reporting routine, and connect them to their ECC programme.

Frequently asked #

Who must apply the NCA risk management framework?

Government entities, the entities and companies affiliated with them inside and outside the Kingdom, and private organizations that own, operate or host critical national infrastructure. The NCA strongly encourages all other entities to use it as best practice.

Which risks have to be reported to the NCA?

Risks scored High (15 to 19) or Critical (20 to 25) on the framework matrix must be reported as soon as they are identified, together with their treatment plans, which are shared periodically and whenever they change.

How is a risk scored under NFCRM?

Risk Level equals Impact multiplied by Likelihood, each from 1 to 5. Scores of 1 to 2 are Very Low, 3 to 7 Low, 8 to 14 Medium, 15 to 19 High and 20 to 25 Critical.

We already follow ISO 31000. Do we need a new process?

Usually not. Keep your process and align its scales, definitions and register with the NFCRM matrix, so one register meets both the standard and the national framework.

Official Sources and References #

The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.