CMA Scope

The Capital Market Authority (CMA) regulates listed issuers (disclosure, offers, governance) under the Capital Market Law. Its Cybersecurity Guidelines apply to Capital Market Institutions (CMIs), not to listed issuers. There were 215 licensed CMIs at end-2025 (CMA annual report).

The Guidelines are described as "guidelines" for all CMIs, but the document states its Main Controls are mandatory; the CMA may apply it to any entity it supervises.

Outsourcing of security monitoring only to providers within KSA.
Cloud services within KSA.
SOC in a dedicated restricted area, with qualified Saudi staff.
Cybersecurity head a full-time qualified Saudi.
Logs kept at least 12 months.
Incidents: report immediately on occurrence or detection; official report after recovery; coordinate with the CMA before any media statement. No hour-based deadline.

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21