Cyber security compliance in Saudi Arabia

Which cybersecurity frameworks apply in Saudi Arabia?

Start with the NCA. The Essential Cybersecurity Controls are the baseline for government, government-owned companies and critical infrastructure operators. ECC-2:2024 replaced the 2018 edition and has 4 domains, 28 subdomains, 108 main controls and 92 subcontrols. The old industrial control systems domain moved out into OTCC, so pages still describing five ECC domains are describing the retired version.

On top of ECC, NCA adds specialised control sets for cloud (CCC), data (DCC), critical systems (CSCC) and operational technology (OTCC). Sector regulators then add their own: SAMA for banking and payments, CST for ICT service providers and the CMA for capital market institutions.

Does NCA compliance now apply to private companies?

Increasingly, yes. NCNICC-1:2025 extends mandatory NCA controls to private entities that are not critical infrastructure, once NCA notifies them. Category A entities, with more than 250 staff or more than SAR 200 million in revenue, have 65 mandatory controls. Category B entities, with 6 to 249 staff or SAR 3 million to 200 million in revenue, have 26. Micro entities, government bodies and critical infrastructure operators are excluded because they are covered elsewhere.

NCNICC is currently published in Arabic only. GRCLens carries it in English and Arabic side by side, which matters when the binding text is Arabic and the security team works in English.

How does the PDPL connect to NCA controls?

Directly. Article 23 of the PDPL Implementing Regulation requires controllers to comply with NCA controls when protecting personal data, and Article 24 sets a 72-hour breach notification window. A data protection programme in Saudi Arabia is therefore partly a cybersecurity programme, and evidence collected for ECC or NCNICC can support PDPL obligations at the same time.

How does NCA check compliance?

NCA assesses through self-assessment, reports from its tools and field audits. Entities complete self-assessments on Haseen, NCA's national cybersecurity services portal. SDAIA runs a separate data governance portal for PDPL self-assessment, impact assessments and breach reporting.

Those portals are where results are submitted. GRCLens is where the work behind them happens: control ownership, evidence, remediation tracking and the audit trail, so that what you submit is backed by records you can produce on request.

Is the Arabic or English version binding?

Arabic. NCA publishes ECC in both languages and the English edition states that the Arabic text prevails. Some newer instruments, NCNICC among them, are Arabic only. GRCLens runs its interface, control library, registers and reports in English and Arabic, including right-to-left layout.

How GRCLens runs Saudi frameworks together

All of the frameworks above sit on one shared control model, so a single control, such as privileged access management, carries evidence for ECC, NCNICC, SAMA CSF and PDPL at once rather than being tested four times. GRCLens can run in your own private cloud or fully on-premises inside the Kingdom, including air-gapped, with its AI features running on a model hosted inside your own infrastructure.

Official portals and publications

• Haseen, NCA national cybersecurity services portal
• SDAIA data governance platform