NCA NCNICC Controls for Private Companies

What the NCNICC Is

The Non-CNI Private Sector Entities Cybersecurity Controls (NCNICC-1:2025) were adopted by the National Cybersecurity Authority on 28 December 2025. They set the minimum cybersecurity controls for private-sector organizations that do not own, operate or host critical national infrastructure, the group that the Essential Cybersecurity Controls did not directly cover.

The controls are organized around three components: cybersecurity governance, cybersecurity enhancement, and third-party and cloud computing cybersecurity. They come in two categories sized by Monsha'at definitions: large entities (more than 250 full-time employees or SAR 200 million in annual revenue) follow 65 core controls, while small and medium entities follow a lighter set of 26. In practice that means clear ownership and policy, sound protection of systems, accounts and data, and real control over the suppliers who touch your environment. For most small and medium companies this is the first national cybersecurity standard written with them in mind.

Our Methodology

Every engagement follows the Cyber Shields rhythm: Assess, Protect, Monitor. For this engagement, that translates into the following steps.

1. Scope and applicability. We confirm in writing that the NCNICC is the right baseline for your organization and agree the systems, sites and suppliers in scope, under a signed Non-Disclosure Agreement.
2. Gap assessment. Each applicable control is rated for implementation status, with interviews, document review and technical sampling, and the evidence recorded against the control.
3. Risk-ranked findings. Gaps are ranked by the risk they carry for your business, so the first fixes are the ones that matter most.
4. Remediation roadmap. A practical, sequenced plan with owners, timelines and acceptance criteria, sized for the team you actually have.
5. Policies and evidence. Where you lack them, we draft the core policies and procedures, and set up the evidence you will need to show compliance.
6. Re-assessment. Once fixes are in place, we confirm that gaps are genuinely closed.

Standards & References

Findings are anchored to recognized frameworks so they are defensible and cross-mappable.

• NCA NCNICC-1:2025
• NCA ECC
• PDPL
• ISO/IEC 27001

Frequently Asked Questions

Does the NCNICC apply to my company?

It is written for private-sector organizations that are not critical national infrastructure. If you own, operate or host critical infrastructure, the Essential Cybersecurity Controls apply instead. We confirm your position during scoping.

How is the NCNICC different from the ECC?

The ECC is the baseline for government entities and critical infrastructure. The NCNICC sets a minimum baseline for the rest of the private sector, organized around governance, enhancement, and third-party and cloud computing cybersecurity.

We are a small company. Is this realistic for us?

Yes. Small and medium entities (6 to 249 full-time employees, or SAR 3 million to 200 million in annual revenue) follow a lighter category of 26 core controls. We size the roadmap to your team and budget, starting with the measures that reduce the most risk.

Will the report be available in Arabic?

Yes. Reports, the executive summary, and the readout session are available in both Arabic and English at no additional cost.