National Cybersecurity Authority (NCA)

National cybersecurity regulator; ECC/CCC and related controls across government, CNI and cloud.

The NCA issues Saudi Arabia's cybersecurity controls — 114 controls across 5 domains. Key frameworks include ECC-2:2024 (Essential Cybersecurity Controls) and CCC-2:2024 (Cloud Cybersecurity Controls), plus CSCC, OTCC, DCC, NCS and NCNICC.

Regulates: Government Entities · CNI Operators · Cloud Providers · ICS/OT · Financial

Protects: National Security · Critical Infrastructure · Government Systems · Public Services

Official website

Instruments issued or administered (29)

Anti-Cyber Crime Law — Law
Essential Cybersecurity Controls (ECC-2:2024) — Framework
NCA Cybersecurity Toolkits — Instrument
NCA Regulatory Documents (index) — Instrument
Cloud Cybersecurity Controls (CCC-2:2024) — Framework
Critical Systems Cybersecurity Controls — Framework
Operational Technology Cybersecurity Controls — Framework
Data Cybersecurity Controls — Framework
National Cryptographic Standards — Standard
Non-Critical National Infrastructure Cybersecurity Controls (NCNICC-1:2025) — Framework
Guide to Cloud Cybersecurity Controls (CCC) Implementation — Framework
Cybersecurity Organizational Structure Template — Instrument
Regulatory Framework for Licensing Managed Security Operations Centre Services (RFMSOC-1:2024) — Instrument
Saudi Cybersecurity Higher Education Framework (SCyber-Edu-1:2020) — Instrument
Guide to Critical Systems Cybersecurity Controls (CSCC) Implementation — Framework
Guide to Data Cybersecurity Controls (DCC) Implementation — Framework
Operational Technology Cybersecurity Controls — Methodology & Mapping Annex — Framework
National Policy for Managed Security Operations Centres (NPMSOC-1:2024) — Instrument
Organizations’ Social Media Accounts Cybersecurity Controls (OSMACC-1:2021) — Framework
Alignment Guide for the Saudi Cybersecurity Higher Education Framework (SCyber-Edu) — Instrument
Saudi Cybersecurity Workforce Framework (SCyWF-1:2020) — Instrument
Telework Cybersecurity Controls (TCC) — Framework
Cybersecurity Guidelines for Internet of Things (CGIoT-1:2024) — Guideline
Guide to Organizations’ Social Media Accounts Cybersecurity Controls (OSMACC) Implementation — Guideline
Guide to Telework Cybersecurity Controls (TCC) Implementation — Guideline
Cybersecurity Guidelines for E-commerce Service Providers (CGESP-1:2019) — Guideline
Alignment Guide for the Saudi Cybersecurity Workforce Framework (SCyWF) — Guideline
Guide to Operational Technology Cybersecurity Controls (OTCC) Implementation — Guideline
Cybersecurity Guidelines for E-commerce Consumers (CGEC-1:2019) — Guideline

Content and register data licensed CC BY 4.0 — cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-07-27