The Saudi National Cybersecurity Authority
(“NCA”) has issued the Non-CNI Private
Sector Entities Cybersecurity Controls (the
“Controls”), establishing a mandatory
baseline and detailed requirements for private‑sector
entities that are not part of sensitive national critical
infrastructure, to strengthen national security and enable a safe
digital economy.
The Controls apply to two categories: (A) Large entities (250+
full‑time employees or annual revenue over SAR 200,000,000)
and (B) Small and Medium Enterprises (6–249 full‑time
employees or annual revenue between SAR 3,000,000 and SAR
200,000,000).
The new controls are tailored by entity size across three
components: Governance, Cybersecurity Defense, and Third-party and
Cloud Computing Cybersecurity.
