National cybersecurity regulator: issues and enforces controls (ECC, CCC and related sets) for government entities and CNI, plus NCNICC for identified private entities; penalties under Royal Decree M/117.
The National Cybersecurity Authority (NCA) is the Kingdom's cybersecurity regulator. It issues and enforces cybersecurity controls for government entities and Critical National Infrastructure (CNI), and for private entities it identifies.
Legal basis
- Established by Royal Order 55775 (1/12/1438H, 23 August 2017).
- Statute approved by Royal Order 6801 (11/2/1439H, 31 October 2017), amended by Royal Order 7053 (2/2/1443H, 9 September 2021). The ECC, CCC and NCNICC are issued under Art 10(3).
- Royal Decree M/117 dated 21/6/1446H (22 December 2024) issued the NCA's Statutory Enablers (al-Mumakkinat al-Nizamiyya; NCA English title "The Legal Powers of the National Cybersecurity Authority"). It is a standalone enforcement instrument, not an amendment to the NCA Statute. In force on publication in Umm Al-Qura, 17 January 2025.
Enforcement
- Penalties under M/117: warning; licence suspension or cancellation; service or activity suspension; and/or a fine up to SAR 25m, graduated by severity and repetition.
- A Board-appointed committee decides. In urgent cases the Governor may suspend (referral within 3 working days, ruling within 10). Appeal to the Administrative Court within 60 days.
- Government entities are excluded; public employees face disciplinary action.
- Two Rules published in July 2026 cover detecting and investigating violations, and reporting them. The NCA ran inspection visits citing M/117 in September 2026.
Controls
- **ECC-2:2024:** 4 domains and 28 subdomains (108 main controls and 92 subcontrols in the ECC alone).
- **Other control sets:** CCC-2:2024 (cloud), CSCC, OTCC, DCC, TCC, OSMACC and the National Cryptographic Standards, each with its own controls.
- **NCNICC-1:2025:** for non-CNI private entities identified by the NCA.
Registration and Haseen
- Registration of cybersecurity providers has been mandatory since 1 August 2022 through Haseen (licensing.haseen.gov.sa), reaffirmed 2 October 2026. Haseen is also the incident-reporting channel.
Related
- **Financial sector:** cyber supervision sits with the Saudi Central Bank (SAMA) and the Capital Market Authority (CMA); NCA controls reach financial institutions where they are CNI.
- **Anti-Cyber Crime Law:** not an NCA instrument. The Public Prosecution investigates and prosecutes, with technical support from CST.
Regulates: Government Entities · CNI Operators · Cloud Providers · ICS/OT · Identified Non-CNI Private Entities · Cybersecurity Service Providers
Protects: National Security · Critical Infrastructure · Government Systems · Public Services