Private Sector Alert: Saudi Arabia Rolls Out Mandatory Non-CNI Cyber Controls
The Saudi National Cybersecurity Authority (“NCA”) issued Cybersecurity Controls for Non-CNI Private Sector Entities. (Titled ‘NCNICC’)
NCA compliance in KSA is no longer an option for the private sector. Though historically, NCA regulations were targeting the critical infrastructure & KSA’s government entities, there is now a strategic shift to ensure private sector organizations get ‘on board’. Herein comes the recently published NCNICC (Non-CNI Private Sector Entities Cybersecurity Controls). And this makes for perfect sense – with the private sector expanding, it becomes a larger and probably easier target for attackers. Think ‘Supply chain’ risk!
NCA has categorized private sector entities into 2 categories based on number of FTEs and revenue.
- Large Entities: Entities with 250 or more full-time employees or yearly revenue over 200,000,000 SAR; (65 controls to comply with) and
- Small and Medium Enterprises: Entities with 6 to 249 full-time employees or yearly revenue between 3,000,000 SAR to 200,000,000 SAR. (26 controls to comply with)
The updated controls reflect the size of entities and are grouped into the following three areas: Governance; Cyber Defense; and Third-party/Cloud Computing Cyber Defense.
It is not clear, currently, as to when companies must commence their compliance efforts. Our recommendation is that relevant companies start assessing their existing controls versus this new baseline, (conduct a ‘gap analysis’) prioritizing major items by category and commencing a strategy that addresses governance, technical and third-party/cloud needs, with a verification and reporting process.
To comply with the new guidelines on data transfer, one needs to act promptly. As your organization works through these significant regulatory requirements CYBRT stands ready to offer the guidance and tools you need to safely, confidently and successfully achieve full compliance. Please contact us for more info.
Sources & Further Reading:
https://nca.gov.sa/ar/regulatory-documents/controls-list/ncnicc/