Issued by the NCA on 28 December 2025 (NCNICC-1:2025)
Last verified
2026-10-20
The Non-Critical National Infrastructure Cybersecurity Controls (NCNICC) are NCA controls for private-sector entities that are not Critical National Infrastructure (CNI). They appear to apply to non-CNI private entities identified by the NCA; other entities may use them as best practice.
Issued: 28 December 2025 (SPA N2477281). No effective date or grace period appears in the text.
Category A: over 250 full-time employees or revenue over SAR 200m; 65 controls.
Category B: 6 to 249 employees or revenue of SAR 3m to 200m; 26 controls. Micro entities fall outside both.
Key controls: notify the NCA of incidents (2-13-1-2); share information with the NCA (2-13-1-3); use an NCA-licensed managed SOC (mandatory for Category A, recommended for Category B).
Hosting: no in-Kingdom hosting rule; data is classified before cloud hosting and returned at exit.
Enforcement: penalties under the NCA's Statutory Enablers (Royal Decree M/117).
Text: the Arabic text controls; the English text hosted here is an unofficial translation.
Proposed PDPL change (as at 20 October 2026): SDAIA's draft amendments to the PDPL Implementing Regulation (IR), open for comment to 5 November 2026, would require controllers to apply applicable NCA controls (draft Art 23(1)(b)), to store personal data in the Kingdom (draft Art 23(2)) and to notify SDAIA within 72 hours of any breach, without prejudice to NCA reporting (draft Art 24). With ECC-2 and CCC-2 referring localisation to NDMO, draft Art 23(2) would become the main general localisation rule.
2025-12-28 · NCA issues cybersecurity controls for non-CNI private sector (NCNICC-1:2025): The NCA issued NCNICC-1:2025 on 28 December 2025. The controls appear to apply to non-CNI private-sector entities identified by the NCA; others may use them as best practice. Category A (over 250 staff or revenue over SA