Since the National Cybersecurity Authority adopted the Non-CNI Private Sector Entities Cybersecurity Controls (NCNICC-1:2025) in December 2025, many organizations are asking the same question: which controls apply to us, the ECC or the NCNICC? The answer decides the baseline you are measured against and how much effort to plan for.

Two baselines for two kinds of organization #

The Essential Cybersecurity Controls (ECC) are the national baseline for government entities, including ministries, authorities and their agencies, and for organizations that own, operate or host critical national infrastructure. The current version, ECC-2:2024, has four domains: governance, defence, resilience, and third-party and cloud cybersecurity.

The NCNICC sets the minimum cybersecurity controls for private-sector organizations that are not critical national infrastructure. It has three components (cybersecurity governance, cybersecurity enhancement, and third-party and cloud computing cybersecurity), with a lighter set of controls for small and medium companies. For a fuller picture, see our NCNICC guide for private companies.

In short, the ECC is for the public sector and for whoever runs the infrastructure the country depends on. The NCNICC is for the rest of the private sector.

Three questions to decide #

Answer them in order.

  1. Are you a government entity or one of its agencies? If yes, the ECC applies.
  2. Do you own, operate or host critical national infrastructure? This covers sectors and services whose disruption would seriously affect national security, the economy or essential services. If yes, the ECC applies, and specific systems may also fall under the stricter Critical Systems Cybersecurity Controls (CSCC).
  3. Are you a private company that is neither of the above? Then the NCNICC is your baseline.

If the answer to question 2 is unclear, for example because you provide services to an infrastructure operator, do not guess. Write down your reasoning and confirm it with your sector regulator or with an assessor who can review your contracts and your role.

What changes in practice #

Both baselines rest on the same ideas: clear ownership, sound protection, resilience and control over third parties. The differences are in depth and formality.

The ECC is written for government entities and critical infrastructure and is broader and more detailed, with four domains. The NCNICC is written for private companies outside critical infrastructure and is a minimum baseline: three components with 65 core controls for large companies, and a lighter set of 26 core controls for small and medium ones. Under the ECC, other control sets such as the CSCC, CCC, DCC or OTCC may also apply; under the NCNICC, other controls apply only where your activities call for them.

Work done for one is rarely wasted. A company that prepares well for the NCNICC builds habits, policies and evidence that make a later step up much easier.

Situations that need a closer look #

  • Being a supplier to critical infrastructure does not by itself make you critical infrastructure, but your client may require ECC-level controls for your services by contract.
  • If you host systems for others, the Cloud Cybersecurity Controls (CCC) may apply to your hosting services.
  • A group may include one entity that runs infrastructure and others that do not, so scope each entity separately.
  • If you are supervised by the Saudi Central Bank, the SAMA Cyber Security Framework also applies to you.

Getting it right early saves money #

The wrong choice costs in both directions. Preparing for the full ECC when the NCNICC applies can mean months of unnecessary work. Preparing only for the NCNICC when the ECC applies leaves gaps a regulator will find. A short applicability review at the start, written down and signed off, prevents both.

Three examples #

These simplified profiles show how the questions work. They are illustrations, not legal determinations.

  • A Riyadh software company builds HR software for private clients. It is not a government entity and does not run critical infrastructure, so its baseline is the NCNICC. If it hosts customer data on its own cloud platform, it should also review the Cloud Cybersecurity Controls for that hosting role.
  • A regional water services operator runs pumping stations and control systems. It operates critical infrastructure, so the ECC applies, and its industrial control systems point to the Operational Technology Cybersecurity Controls (OTCC).
  • A family-owned retail group has stores, an online shop and a small IT team. Its baseline is the NCNICC. Because it takes card payments, PCI DSS is relevant too, and because it holds customer data, so is the Personal Data Protection Law.

Questions to ask before you commit #

Before you settle on a baseline and a budget, put a few questions to your regulator, your major clients or your assessor:

  1. Does any of our contracts require a specific NCA control set?
  2. Does any of our activity fall within a sector the regulator treats as critical?
  3. Do we host systems or data for others, which could bring the cloud controls into play?
  4. Which other requirements apply to us anyway, such as the PDPL, SAMA or PCI DSS?
  5. Can our evidence serve more than one framework, so we collect it once?

Written answers make your decision easy to defend later.

A sensible way forward #

  1. Answer the three questions above and record the reasoning on one page.
  2. Run a gap assessment against the baseline that applies to you.
  3. Fix the highest-risk gaps first: multi-factor authentication, tested backups, patching, access clean-up and phishing awareness.
  4. Plan the rest in a roadmap with owners and dates.

If you are unsure where you stand, an applicability review is a small first step. Read more about the NCNICC controls and the ECC assessment, or ask us to review your position.

Frequently asked #

Can a private company be subject to the ECC?

Yes, if it owns, operates or hosts critical national infrastructure. Private companies outside critical infrastructure follow the NCNICC instead.

Is the NCNICC easier than the ECC?

It sets a minimum baseline sized for the private sector, so it is typically less extensive. It still requires real governance, protection and third-party control.

We supply a critical infrastructure operator. Which applies?

Being a supplier does not by itself make you critical infrastructure, but your client may require ECC-level controls for your services by contract. Document the reasoning and confirm it.

Official Sources and References #

The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.