National Cybersecurity Authority requirements

The National Cybersecurity Authority (NCA) in the Kingdom of Saudi Arabia enforces strict, specific, and mandatory rules and regulations on all government and private institutions operating in vital and strategic sectors to ensure the protection of the national digital and information infrastructure.

The core mandatory requirements encompass several key areas:

Implementing the Essential Cybersecurity Controls (ECC) or Cloud Cybersecurity Controls (CCC) in accordance with the nature and scope of your business activity

Registering all systems, networks, and critical infrastructure with the Authority regularly and accurately to ensure their ongoing safety and protection

Reporting all detected cybersecurity incidents promptly and immediately within only one hour of discovery to enable swift action

Taking necessary and urgent measures, and conducting comprehensive periodic risk assessments to ensure the security of sensitive and confidential data and information

Non-compliance with these regulatory requirements may result in severe and serious consequences, including substantial financial penalties reaching millions of Saudi Riyals, in addition to various other significant administrative and regulatory sanctions.