{"id":27400784,"date":"2026-03-25T17:55:09","date_gmt":"2026-03-25T17:55:09","guid":{"rendered":"https:\/\/cybrt.sa\/?p=27400784"},"modified":"2026-03-25T17:55:09","modified_gmt":"2026-03-25T17:55:09","slug":"private-sector-alert-saudi-arabia-rolls-out-mandatory-non-cni-cyber-controls","status":"publish","type":"post","link":"https:\/\/cybrt.nukhtastudio.com\/ar\/private-sector-alert-saudi-arabia-rolls-out-mandatory-non-cni-cyber-controls\/","title":{"rendered":"Private Sector Alert: Saudi Arabia Rolls Out Mandatory Non-CNI Cyber Controls"},"content":{"rendered":"<h2>Private Sector Alert: Saudi Arabia Rolls Out Mandatory Non-CNI Cyber Controls<\/h2>\n<p>The Saudi National Cybersecurity Authority (\u201cNCA\u201d) issued Cybersecurity Controls for Non-CNI Private Sector Entities. (Titled \u2018NCNICC\u2019)<\/p>\n<p>NCA compliance in KSA is no longer an option for the private sector. Though historically, NCA regulations were targeting the critical infrastructure &amp; KSA\u2019s government entities, there is now a strategic shift to ensure private sector organizations get \u2018on board\u2019. Herein comes the recently published NCNICC (Non-CNI Private Sector Entities Cybersecurity Controls). And this makes for perfect sense \u2013 with the private sector expanding, it becomes a larger and probably easier target for attackers. Think \u2018Supply chain\u2019 risk!<\/p>\n<p>NCA has categorized private sector entities into 2 categories based on number of FTEs and revenue.<\/p>\n<ul>\n<li>Large Entities: Entities with 250 or more full-time employees or yearly revenue over 200,000,000 SAR; (65 controls to comply with) and<\/li>\n<li>Small and Medium Enterprises: Entities with 6 to 249 full-time employees or yearly revenue between 3,000,000 SAR to 200,000,000 SAR. (26 controls to comply with)<\/li>\n<\/ul>\n<p>The updated controls reflect the size of entities and are grouped into the following three areas: Governance; Cyber Defense; and Third-party\/Cloud Computing Cyber Defense.<\/p>\n<p>It is not clear, currently, as to when companies must commence their compliance efforts. Our recommendation is that relevant companies start assessing their existing controls versus this new baseline, (conduct a \u2018gap analysis\u2019) prioritizing major items by category and commencing a strategy that addresses governance, technical and third-party\/cloud needs, with a verification and reporting process.<\/p>\n<p>To comply with the new guidelines on data transfer, one needs to act promptly. As your organization works through these significant regulatory requirements CYBRT stands ready to offer the guidance and tools you need to safely, confidently and successfully achieve full compliance. Please contact us for more info.<\/p>\n<h4>Sources &amp; Further Reading:<\/h4>\n<p><a href=\"https:\/\/nca.gov.sa\/ar\/regulatory-documents\/controls-list\/ncnicc\/\">https:\/\/nca.gov.sa\/ar\/regulatory-documents\/controls-list\/ncnicc\/<\/a><\/p>","protected":false},"excerpt":{"rendered":"<p>Private Sector Alert: Saudi Arabia Rolls Out Mandatory Non-CNI Cyber Controls The Saudi National Cybersecurity Authority (\u201cNCA\u201d) issued Cybersecurity Controls for Non-CNI Private Sector Entities. (Titled \u2018NCNICC\u2019) NCA compliance in KSA is no longer an option for the private sector. Though historically, NCA regulations were targeting the critical infrastructure &amp; KSA\u2019s government entities, there is [&hellip;]<\/p>\n","protected":false},"author":6,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[27],"tags":[],"dipi_cpt_category":[],"class_list":["post-27400784","post","type-post","status-publish","format-standard","hentry","category-regulations-standards"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.8 (Yoast SEO v28.5) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Private Sector Alert: Saudi Arabia Rolls Out Mandatory Non-CNI Cyber Controls - CYBRT<\/title>\n<meta name=\"robots\" content=\"noindex, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"ar_AR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Private Sector Alert: Saudi Arabia Rolls Out Mandatory Non-CNI Cyber Controls\" \/>\n<meta property=\"og:description\" content=\"Private Sector Alert: Saudi Arabia Rolls Out Mandatory Non-CNI Cyber Controls The Saudi National Cybersecurity Authority (\u201cNCA\u201d) issued Cybersecurity Controls for Non-CNI Private Sector Entities. (Titled \u2018NCNICC\u2019) NCA compliance in KSA is no longer an option for the private sector. Though historically, NCA regulations were targeting the critical infrastructure &amp; KSA\u2019s government entities, there is [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cybrt.nukhtastudio.com\/ar\/private-sector-alert-saudi-arabia-rolls-out-mandatory-non-cni-cyber-controls\/\" \/>\n<meta property=\"og:site_name\" content=\"CYBRT\" \/>\n<meta property=\"article:published_time\" content=\"2026-03-25T17:55:09+00:00\" \/>\n<meta name=\"author\" content=\"Naveed Ahmed\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u0643\u064f\u062a\u0628 \u0628\u0648\u0627\u0633\u0637\u0629\" \/>\n\t<meta name=\"twitter:data1\" content=\"Naveed Ahmed\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u0648\u0642\u062a \u0627\u0644\u0642\u0631\u0627\u0621\u0629 \u0627\u0644\u0645\u064f\u0642\u062f\u0651\u0631\" \/>\n\t<meta name=\"twitter:data2\" content=\"\u062f\u0642\u064a\u0642\u062a\u0627\u0646\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/cybrt.nukhtastudio.com\\\/private-sector-alert-saudi-arabia-rolls-out-mandatory-non-cni-cyber-controls\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cybrt.nukhtastudio.com\\\/private-sector-alert-saudi-arabia-rolls-out-mandatory-non-cni-cyber-controls\\\/\"},\"author\":{\"name\":\"Naveed Ahmed\",\"@id\":\"https:\\\/\\\/cybrt.nukhtastudio.com\\\/#\\\/schema\\\/person\\\/075fc2c056263f2f60297c70ecc5d81a\"},\"headline\":\"Private Sector Alert: Saudi Arabia Rolls Out Mandatory Non-CNI Cyber Controls\",\"datePublished\":\"2026-03-25T17:55:09+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/cybrt.nukhtastudio.com\\\/private-sector-alert-saudi-arabia-rolls-out-mandatory-non-cni-cyber-controls\\\/\"},\"wordCount\":310,\"articleSection\":[\"Regulations &amp; Standards\"],\"inLanguage\":\"ar\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/cybrt.nukhtastudio.com\\\/private-sector-alert-saudi-arabia-rolls-out-mandatory-non-cni-cyber-controls\\\/\",\"url\":\"https:\\\/\\\/cybrt.nukhtastudio.com\\\/private-sector-alert-saudi-arabia-rolls-out-mandatory-non-cni-cyber-controls\\\/\",\"name\":\"Private Sector Alert: Saudi Arabia Rolls Out Mandatory Non-CNI Cyber Controls - CYBRT\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cybrt.nukhtastudio.com\\\/#website\"},\"datePublished\":\"2026-03-25T17:55:09+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/cybrt.nukhtastudio.com\\\/#\\\/schema\\\/person\\\/075fc2c056263f2f60297c70ecc5d81a\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/cybrt.nukhtastudio.com\\\/private-sector-alert-saudi-arabia-rolls-out-mandatory-non-cni-cyber-controls\\\/#breadcrumb\"},\"inLanguage\":\"ar\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/cybrt.nukhtastudio.com\\\/private-sector-alert-saudi-arabia-rolls-out-mandatory-non-cni-cyber-controls\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/cybrt.nukhtastudio.com\\\/private-sector-alert-saudi-arabia-rolls-out-mandatory-non-cni-cyber-controls\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/cybrt.nukhtastudio.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Private Sector Alert: Saudi Arabia Rolls Out Mandatory Non-CNI Cyber Controls\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cybrt.nukhtastudio.com\\\/#website\",\"url\":\"https:\\\/\\\/cybrt.nukhtastudio.com\\\/\",\"name\":\"CYBRT\",\"description\":\"Cybersecurity Excellence\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/cybrt.nukhtastudio.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"ar\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/cybrt.nukhtastudio.com\\\/#\\\/schema\\\/person\\\/075fc2c056263f2f60297c70ecc5d81a\",\"name\":\"Naveed Ahmed\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"ar\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8501ea7e4d08028ad72f3c727103396604ec864d076638821519d5f6610a713d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8501ea7e4d08028ad72f3c727103396604ec864d076638821519d5f6610a713d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8501ea7e4d08028ad72f3c727103396604ec864d076638821519d5f6610a713d?s=96&d=mm&r=g\",\"caption\":\"Naveed Ahmed\"},\"url\":\"https:\\\/\\\/cybrt.nukhtastudio.com\\\/ar\\\/author\\\/naveed\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Private Sector Alert: Saudi Arabia Rolls Out Mandatory Non-CNI Cyber Controls - CYBRT","robots":{"index":"noindex","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"ar_AR","og_type":"article","og_title":"Private Sector Alert: Saudi Arabia Rolls Out Mandatory Non-CNI Cyber Controls","og_description":"Private Sector Alert: Saudi Arabia Rolls Out Mandatory Non-CNI Cyber Controls The Saudi National Cybersecurity Authority (\u201cNCA\u201d) issued Cybersecurity Controls for Non-CNI Private Sector Entities. (Titled \u2018NCNICC\u2019) NCA compliance in KSA is no longer an option for the private sector. Though historically, NCA regulations were targeting the critical infrastructure &amp; KSA\u2019s government entities, there is [&hellip;]","og_url":"https:\/\/cybrt.nukhtastudio.com\/ar\/private-sector-alert-saudi-arabia-rolls-out-mandatory-non-cni-cyber-controls\/","og_site_name":"CYBRT","article_published_time":"2026-03-25T17:55:09+00:00","author":"Naveed Ahmed","twitter_card":"summary_large_image","twitter_misc":{"\u0643\u064f\u062a\u0628 \u0628\u0648\u0627\u0633\u0637\u0629":"Naveed Ahmed","\u0648\u0642\u062a \u0627\u0644\u0642\u0631\u0627\u0621\u0629 \u0627\u0644\u0645\u064f\u0642\u062f\u0651\u0631":"\u062f\u0642\u064a\u0642\u062a\u0627\u0646"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cybrt.nukhtastudio.com\/private-sector-alert-saudi-arabia-rolls-out-mandatory-non-cni-cyber-controls\/#article","isPartOf":{"@id":"https:\/\/cybrt.nukhtastudio.com\/private-sector-alert-saudi-arabia-rolls-out-mandatory-non-cni-cyber-controls\/"},"author":{"name":"Naveed Ahmed","@id":"https:\/\/cybrt.nukhtastudio.com\/#\/schema\/person\/075fc2c056263f2f60297c70ecc5d81a"},"headline":"Private Sector Alert: Saudi Arabia Rolls Out Mandatory Non-CNI Cyber Controls","datePublished":"2026-03-25T17:55:09+00:00","mainEntityOfPage":{"@id":"https:\/\/cybrt.nukhtastudio.com\/private-sector-alert-saudi-arabia-rolls-out-mandatory-non-cni-cyber-controls\/"},"wordCount":310,"articleSection":["Regulations &amp; Standards"],"inLanguage":"ar"},{"@type":"WebPage","@id":"https:\/\/cybrt.nukhtastudio.com\/private-sector-alert-saudi-arabia-rolls-out-mandatory-non-cni-cyber-controls\/","url":"https:\/\/cybrt.nukhtastudio.com\/private-sector-alert-saudi-arabia-rolls-out-mandatory-non-cni-cyber-controls\/","name":"Private Sector Alert: Saudi Arabia Rolls Out Mandatory Non-CNI Cyber Controls - CYBRT","isPartOf":{"@id":"https:\/\/cybrt.nukhtastudio.com\/#website"},"datePublished":"2026-03-25T17:55:09+00:00","author":{"@id":"https:\/\/cybrt.nukhtastudio.com\/#\/schema\/person\/075fc2c056263f2f60297c70ecc5d81a"},"breadcrumb":{"@id":"https:\/\/cybrt.nukhtastudio.com\/private-sector-alert-saudi-arabia-rolls-out-mandatory-non-cni-cyber-controls\/#breadcrumb"},"inLanguage":"ar","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cybrt.nukhtastudio.com\/private-sector-alert-saudi-arabia-rolls-out-mandatory-non-cni-cyber-controls\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/cybrt.nukhtastudio.com\/private-sector-alert-saudi-arabia-rolls-out-mandatory-non-cni-cyber-controls\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cybrt.nukhtastudio.com\/"},{"@type":"ListItem","position":2,"name":"Private Sector Alert: Saudi Arabia Rolls Out Mandatory Non-CNI Cyber Controls"}]},{"@type":"WebSite","@id":"https:\/\/cybrt.nukhtastudio.com\/#website","url":"https:\/\/cybrt.nukhtastudio.com\/","name":"CYBRT","description":"\u0627\u0644\u062a\u0645\u064a\u0632 \u0641\u064a \u0627\u0644\u0623\u0645\u0646 \u0627\u0644\u0633\u064a\u0628\u0631\u0627\u0646\u064a","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cybrt.nukhtastudio.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ar"},{"@type":"Person","@id":"https:\/\/cybrt.nukhtastudio.com\/#\/schema\/person\/075fc2c056263f2f60297c70ecc5d81a","name":"Naveed Ahmed","image":{"@type":"ImageObject","inLanguage":"ar","@id":"https:\/\/secure.gravatar.com\/avatar\/8501ea7e4d08028ad72f3c727103396604ec864d076638821519d5f6610a713d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/8501ea7e4d08028ad72f3c727103396604ec864d076638821519d5f6610a713d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8501ea7e4d08028ad72f3c727103396604ec864d076638821519d5f6610a713d?s=96&d=mm&r=g","caption":"Naveed Ahmed"},"url":"https:\/\/cybrt.nukhtastudio.com\/ar\/author\/naveed\/"}]}},"_links":{"self":[{"href":"https:\/\/cybrt.nukhtastudio.com\/ar\/wp-json\/wp\/v2\/posts\/27400784","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybrt.nukhtastudio.com\/ar\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybrt.nukhtastudio.com\/ar\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybrt.nukhtastudio.com\/ar\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/cybrt.nukhtastudio.com\/ar\/wp-json\/wp\/v2\/comments?post=27400784"}],"version-history":[{"count":1,"href":"https:\/\/cybrt.nukhtastudio.com\/ar\/wp-json\/wp\/v2\/posts\/27400784\/revisions"}],"predecessor-version":[{"id":27400786,"href":"https:\/\/cybrt.nukhtastudio.com\/ar\/wp-json\/wp\/v2\/posts\/27400784\/revisions\/27400786"}],"wp:attachment":[{"href":"https:\/\/cybrt.nukhtastudio.com\/ar\/wp-json\/wp\/v2\/media?parent=27400784"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybrt.nukhtastudio.com\/ar\/wp-json\/wp\/v2\/categories?post=27400784"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybrt.nukhtastudio.com\/ar\/wp-json\/wp\/v2\/tags?post=27400784"},{"taxonomy":"dipi_cpt_category","embeddable":true,"href":"https:\/\/cybrt.nukhtastudio.com\/ar\/wp-json\/wp\/v2\/dipi_cpt_category?post=27400784"}],"curies":[{"name":"\u062f\u0628\u0644\u064a\u0648 \u0628\u064a","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}