NCA controls for private companies outside critical infrastructure (NCNICC-1:2025)
A control set issued in 2025 for private-sector companies that are not critical national infrastructure. Confirm scope with the NCA.
Saudi Arabia · National Cybersecurity AuthorityWho it applies to
Private companies in Saudi Arabia outside the critical infrastructure scope.
Key areas
- Applies in place of the ECC for in-scope private companies
- Risk-based baseline controls
- Check the current NCA text for scope and timelines
How Nigehban helps
- Gap assessment against the requirements
- Remediation roadmap and implementation support
- Independent audit and evidence review
- Monitoring that proves controls keep working
Related standards
NCA Essential Cybersecurity Controls (ECC-2:2024)
Saudi Arabia’s baseline cybersecurity controls, issued by the National Cybersecurity Authority and revised in 2024.
Saudi ArabiaNCA Cloud Cybersecurity Controls (CCC-2:2024)
Controls for cloud services that extend the ECC, for both cloud service providers and their customers.
Saudi ArabiaNCA Critical Systems Cybersecurity Controls (CSCC)
Additional controls for systems whose failure would seriously affect national interests.
Saudi Arabia