Wadira: Find your way through Saudi data & privacy law.

Home › Frameworks › Cybersecurity › Regulatory Framework for Licensing Managed Security Operations Centre Services (RFMSOC-1:2024)

Regulatory Framework for Licensing Managed Security Operations Centre Services (RFMSOC-1:2024)

Type	Instrument
Issuing authority	National Cybersecurity Authority (NCA)
Framework	Cybersecurity
Tier	Rules, controls & standards
Legal status	In force
Instrument number	National Cybersecurity Authority
Version	RFMSOC-1:2024
Last verified	2026-10-20

The Regulatory Framework for Licensing Managed Security Operations Centre (MSOC) Services (RFMSOC-1:2024) is the NCA's licensing regime for providers of managed SOC services in the Kingdom. It binds providers; the Arabic text controls.

• Licensing: obtaining, maintaining, renewing and transferring a licence; provider obligations; rules on subcontracting.
• Tier 1: may serve all entities, including government and CNI (6 licensees reported).
• Tier 2: may serve non-government, non-CNI entities (20 licensees reported), licensed through Haseen.
• Individuals: MSOC analysts need a qualification certificate.
• Pairs with: NPMSOC-1:2024 (how beneficiaries use MSOC services) and NCNICC, which requires Category A entities to use an NCA-licensed managed SOC.
• RFCS: the draft RFCS-1:2026 licensing framework for other cybersecurity services excludes managed SOCs.

Documents

• Hosted official text (PDF, English)
• Official source (nca.gov.sa)

In this framework

• Anti-Cyber Crime Law
• Statute of the National Cybersecurity Authority
• Statutory Enablers of the National Cybersecurity Authority (Royal Decree M/117)
• Rules for the Detection and Investigation of Cybersecurity Violations
• Rules for Regulating the Reporting of Cybersecurity Violations
• Cybersecurity Violations Classification and Corresponding Penalties (draft)
• NCA Cybersecurity Toolkits
• Essential Cybersecurity Controls (ECC-2:2024)
• Cloud Cybersecurity Controls (CCC-2:2024)
• Critical Systems Cybersecurity Controls (CSCC-1:2019)
• Operational Technology Cybersecurity Controls (OTCC-1:2022)
• Data Cybersecurity Controls (DCC-1:2022)
• National Cryptographic Standards (NCS)
• Non-Critical National Infrastructure Cybersecurity Controls (NCNICC-1:2025)
• Cybersecurity Organizational Structure Template
• Saudi Cybersecurity Higher Education Framework (SCyber-Edu-1:2020)
• Operational Technology Cybersecurity Controls: Methodology & Mapping Annex
• National Policy for Managed Security Operations Centres (NPMSOC-1:2024)
• Organizations’ Social Media Accounts Cybersecurity Controls (OSMACC-1:2021)
• Saudi Cybersecurity Workforce Framework (SCyWF-1.5:2026)
• Telework Cybersecurity Controls (TCC-1:2021)
• National Framework for Cybersecurity Information Sharing and Incident Response (draft)
• Regulatory Framework for Licensing Cybersecurity Services, Products and Solutions (RFCS-1:2026, draft)
• Cybersecurity Controls for National Events and Occasions (draft)

---

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21