NCNICC-1:2025: The First NCA Cybersecurity Controls That Now Bind Private Companies

Wed, 19 Aug 2026 09:00:00 +0530

For years, if you ran a private company in Saudi Arabia, the National Cybersecurity Authority’s (NCA) controls were something you admired from a distance. They applied to government entities and critical national infrastructure operators. If you weren’t in those categories, you could read the frameworks, nod along, and carry on.

That era just ended.

In December 2025, the NCA published NCNICC-1:2025, the Non-Critical National Information Infrastructure Cybersecurity Controls. It took effect in January 2026. And for the first time, a binding NCA framework now applies directly to the general private sector. If you run a private company in the Kingdom, this is now your problem to solve, not someone else’s.

Saudi Arabia on Mohammed Fayasuddin

NCNICC-1:2025: The First NCA Cybersecurity Controls That Now Bind Private Companies