On 28 December 2025, the National Cybersecurity Authority adopted the Non-CNI Private Sector Entities Cybersecurity Controls, known as NCNICC-1:2025. It is the first national cybersecurity baseline written for private companies that do not run critical national infrastructure: trading companies, clinic groups, logistics firms, software houses, and family businesses with a growing online presence.

If your company is one of them, this article covers what the NCNICC asks of you and how to get ready without disrupting the business.

What the NCNICC is #

The NCNICC sets the minimum cybersecurity controls for private-sector organizations in the Kingdom that do not own, operate or host critical national infrastructure. Until now, the main national baseline, the Essential Cybersecurity Controls (ECC), was written for government entities and for organizations that run critical infrastructure, and most private companies sat outside it.

The controls are organized in three components. Cybersecurity governance covers who owns cybersecurity in your company, which policies you follow and how leadership stays informed. Cybersecurity enhancement covers the practical protection of your systems, accounts, devices and data, from access control to backups. Third-party and cloud computing cybersecurity covers the suppliers, contractors, and cloud and hosting providers that touch your systems or data.

These are minimum controls. They describe what a reasonably run company should already be doing, and they give you a national reference to measure yourself against.

Two categories, sized to your company #

The official document sorts companies into two categories, using the size definitions of the Small and Medium Enterprises General Authority (Monsha'at):

  • Category A, large entities: more than 250 full-time employees, or annual revenue above SAR 200 million. They follow all three components, with 22 subcomponents and 65 core controls.
  • Category B, small and medium entities: 6 to 249 full-time employees, or annual revenue between SAR 3 million and SAR 200 million. They follow a lighter set: one main component, 13 subcomponents and 26 core controls.

Each category's controls are binding on the companies the Authority notifies, and the Authority may require additional controls where needed. Other entities are expected to use the controls as best practice, and many clients already ask for them. Knowing your category early tells you how much work is really ahead.

Who should pay attention #

The controls are written for private-sector entities outside critical infrastructure. In practice, treat them as relevant if any of these apply to you:

  1. You are a private company operating in the Kingdom and you are not classed as critical national infrastructure.
  2. You supply government entities or large companies, and they ask about your security.
  3. You hold customer data, payment flows or business-critical systems that would hurt if they leaked or stopped.
  4. You are preparing for investment, a tender or a customer audit where security will come up.

If you do own, operate or host critical infrastructure, the ECC is your baseline instead.

Why it matters for a small company too #

Attackers do not check a company's size before phishing its staff or encrypting its files, and small and medium companies are often easier targets because they have less structure. A national baseline helps in practical ways. It replaces guesswork about what "good security" means with a recognized reference. It gives you a common language with customers, since "we are aligned with the NCA NCNICC" means something to a procurement team. And it points you to the measures that reduce the most risk first.

A practical path to readiness #

You do not need a stack of new tools to start. Most of the early work is organizing and operating what you already have.

1. Confirm applicability and scope #

On one page, write why the NCNICC is your baseline and which parts of the business are in scope: offices, systems, cloud services, and the suppliers connected to them. That page settles a lot of later debates.

2. Name an owner #

Cybersecurity needs a named owner with enough authority to get things done. In a small company that may be the IT manager or an operations lead, with backing from leadership.

3. Run an honest gap assessment #

Go through the controls one by one and record, with evidence, what is in place, what is partial and what is missing. Be strict: a policy that exists on paper but is not followed counts as a gap. An independent assessor helps here, because internal teams tend to score generously.

4. Fix the high-risk gaps first #

Some measures carry far more weight than others, and in most companies the first wins are the same: multi-factor authentication on email, remote access and admin accounts; backups that are tested and kept where ransomware cannot reach them; scheduled patching of internet-facing systems and staff devices; removing the accounts of people who left and trimming excess privileges; and phishing awareness for staff in Arabic and English.

5. Bring suppliers under control #

List the suppliers with access to your systems or data, from your accounting software provider to the agency that runs your social media accounts. Agree minimum security expectations with them, and make sure you can remove their access quickly.

6. Write the policies you actually need #

Keep policies short and real: acceptable use, access control, backup, incident response and supplier security. A ten-page policy that people read is worth more than a hundred pages nobody opens.

7. Keep evidence and review progress #

An assessor will want to see records, not statements: access reviews, backup tests, training attendance and supplier assessments. Review progress with leadership on a fixed schedule.

Common mistakes #

The usual ones are buying tools before knowing the gaps, copying generic policies from the internet that do not match how the company works, treating the programme as an IT-only project when governance and supplier controls need leadership and procurement, and doing the work once instead of maintaining it as threats and staff change.

How the NCNICC fits with other requirements #

If you handle personal data, the Personal Data Protection Law also applies, and much of the NCNICC work supports it. If you later pursue ISO/IEC 27001 certification, the same governance, risk and evidence habits carry over. One programme that serves all three saves time and money.

What an assessor will ask to see #

Whether the review comes from a customer, an investor or a regulator, the requests are usually similar:

  • A scope statement naming the entities, sites, systems and suppliers covered.
  • The cybersecurity owner's mandate, approved by leadership.
  • Approved policies, each with a date, a version and an owner.
  • An asset list of the systems, cloud services and devices that matter.
  • Access reviews showing who has access to what, and that leavers were removed.
  • Backup test records showing that data can actually be restored.
  • Patch and vulnerability records for internet-facing systems.
  • Training records for staff awareness sessions.
  • Supplier assessments and the security terms in key contracts.
  • An incident response plan and, ideally, a record of a tabletop exercise.

None of this needs to be elaborate. It needs to be real, current and easy to find.

A realistic 90-day plan #

Every company starts from a different place, but a first 90 days often looks like this:

  • Days 1 to 30: confirm scope and owner, run the gap assessment, switch on multi-factor authentication, and test one backup restore.
  • Days 31 to 60: clean up access, put patching on a schedule, list suppliers and agree minimum expectations, and run the first awareness session.
  • Days 61 to 90: approve the core policies, rehearse an incident with leadership, and start the evidence folder that proves all of the above.

By then most companies have closed their highest-risk gaps and have a roadmap for the rest, with dates and owners agreed by leadership.

Where to start this week #

Pick one owner, write the one-page scope, and turn on multi-factor authentication for email and remote access. All three cost little and lower your risk right away. Then book a gap assessment against the NCNICC controls to plan the rest.

Frequently asked #

When were the NCNICC controls adopted?

The National Cybersecurity Authority adopted the Non-CNI Private Sector Entities Cybersecurity Controls (NCNICC-1:2025) on 28 December 2025.

Do the NCNICC controls apply to small companies?

Yes. The controls define two categories using Monsha'at size definitions: large entities (more than 250 full-time employees or SAR 200 million in annual revenue) and small and medium entities (6 to 249 employees or SAR 3 million to 200 million). Small and medium entities follow a lighter set of 26 core controls. Each set is binding on the companies the NCA notifies.

What are the three components of the NCNICC?

Cybersecurity governance, cybersecurity enhancement, and third-party and cloud computing cybersecurity. Large entities follow all three; small and medium entities follow a lighter set of one main component and 26 core controls.

Do we need new security tools to comply?

Not necessarily. Much of the early work is organizing and operating what you already have: ownership, policies, access control, backups and supplier control. Tools help with specific gaps once you know them.

Official Sources and References #

The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.