National Cybersecurity Authority (NCA): Saudi Arabia’s Cybersecurity Regulator Explained

Who decides to protect Saudi Arabia’s most critical digital systems? And who makes the cybersecurity rules companies are supposed to follow? That is the responsibility of the National Cybersecurity Authority (NCA). The NCA plays a central role in the Kingdom’s management of cyber risks, from the establishment of national cybersecurity controls to the supervision of regulatory compliance. Understanding its authority is the starting point for understanding Saudi Arabia's cybersecurity regulations.

Top Takeaways

• Saudi Arabia’s primary cybersecurity regulator, the National Cybersecurity Authority, was founded in 2017 and is responsible for setting national security standards, enforcing compliance, and protecting critical infrastructure.
• The NCA has five major families of cybersecurity controls: ECC, CCC, DCC, OTCC & CSCC. Their applicability is dependent on the regulatory scope, systems, and operations of an organization.
• The NCA ECC standard requires organizations to implement cybersecurity governance, threat monitoring, incident response, resilience, and third-party security controls, supported by documented evidence and regular assessments.
• Under the NCA MSOC Policy, covered government entities and critical infrastructure operators are required to use licensed Tier 1 managed SOC providers and satisfy the applicable approval and reporting requirements.
• Organizations must continuously assess risk, monitor security, document incidents, and improve controls to remain NCA compliant. Managed SOC services can help with these activities, but organizations are still responsible for regulatory compliance.

What is the National Cybersecurity Authority? 

The National Cybersecurity Authority is a government agency responsible for developing and implementing the national cybersecurity strategy. It is the main government authority for cybersecurity in Saudi Arabia. It is responsible for the development of national cybersecurity policies, regulations, and security controls to protect government systems, sensitive information, and critical infrastructure.

The NCA also leads the Kingdom’s cybersecurity efforts, monitors compliance with relevant requirements, and assists in the development of national cybersecurity capabilities. It also plays a role beyond regulation in building the nation’s capacity to prevent, detect, and respond to cyber attacks.

Formation, Royal Charter and Leadership

The NCA was established by a Royal Order in 2017 and is financially and administratively independent and reports directly to the King of Saudi Arabia.

The NCA is the national reference point on cybersecurity matters, thanks to its royal mandate, which entrusts it with the development of cybersecurity regulations, monitoring compliance, and coordination between the relevant governmental organizations and private sector organizations. The authority is governed by a Board of Directors and a Governor, who is responsible for the executive functions of the authority and for implementing its strategic objectives.

Consistency and Mission toward Saudi Vision 2030

The NCA is seeking to enhance Saudi Arabia’s cybersecurity position, protect national interests, and improve the security of critical infrastructure and essential services. It is in line with Saudi Vision 2030, especially the Kingdom’s efforts to expand digital government services, diversify its economy, and develop technology-driven industries.

The NCA’s efforts to ensure consistent cybersecurity requirements, develop local expertise, and provide support for secure digital transformation help to create a more resilient cybersecurity environment for organizations operating across Saudi Arabia.

What Are the National Cybersecurity Authority's Main Responsibilities and Objectives?

The National Cybersecurity Authority is a regulatory and operational authority, tasked with improving the cybersecurity posture for the Kingdom of Saudi Arabia. It collaborates closely with public and private entities to protect national security, critical infrastructure, and government services from evolving cyber assaults.

1. Regulatory Roles

The NCA develops cybersecurity policies, standards, and frameworks such as the Essential Cybersecurity Controls (ECC). It oversees compliance, sets standards for risk management, and governs cybersecurity activities for relevant sectors. These measures help organizations enhance security practices and protect the vital interests of the Kingdom.

2. Operational Functions:

The NCA’s operational responsibilities are national cyber threat monitoring, incident response coordination, and information sharing via:

• Saudi CERT: Offers security alerts, vulnerability details, and cybersecurity awareness information.
• National SOC: Facilitates national-level threat monitoring, security analysis, and cyber incident coordination.
• Haseen Portal: Provides organizations with the ability to access cybersecurity services, share threat information, report incidents, and assess regulatory compliance.

3. Capacity Building & International Cooperation

The NCA develops cybersecurity talent through training programs, professional frameworks, and national initiatives. It also collaborates with international cybersecurity organizations to exchange expertise, enhance cooperation, and promote its vision of a secure and trusted Saudi cyberspace.

What Cyber Security Controls And Frameworks Has NCA Issued?

The NCA issues cybersecurity controls, regulations, and implementation guidelines that set common security requirements across Saudi Arabia. Some controls establish a baseline for cybersecurity protection, while others address specialized risks involving cloud services, sensitive data, industrial systems, and critical infrastructure.

Cybersecurity Protections

Different industries carry different risks concerning cybersecurity, and no single set of security requirements can cover them all. To help address these risks, the NCA has produced five major sets of cybersecurity controls, which encompass everything from basic security practices to cloud environments, sensitive data, industrial systems, and critical infrastructure.

The ECC is the baseline. The other control sets add other requirements for certain systems and environments. Organizations may need to adhere to multiple frameworks depending on the operations and the regulatory scope.

National Policies, Frameworks and Guidelines

The NCA also produces supporting documents such as the National Framework for Cybersecurity Risk Management, National Cryptographic Standards, and implementation guides.

These resources help organizations understand cybersecurity requirements, develop internal security procedures, and put in place appropriate safeguards. The NCA also provides assessment tools and guidance for the implementation of particular controls.

What NCA Framework Fits Your Organization?

The first step in choosing the right NCA controls is to understand your organization’s regulatory status, not just its industry. A business running critical infrastructure may have different obligations than a commercial company using cloud services. The trick is to decide what systems, data, and activities fall under each framework.

A practical starting point is the following matrix:

One important thing: These categories can overlap. An organization that owns critical infrastructure and utilizes cloud services might need to consider ECC, CCC, and other applicable controls at the same time. The final applicability should be decided according to the official framework documents, system classifications, and relevant regulatory requirements.

What You Need for NCA ECC Compliance?

NCA Essential Cybersecurity Controls (ECC 2-2024) require organizations within scope to develop, implement, and uphold cybersecurity safeguards. Compliance isn’t just about having security policies. Organizations must show that their controls are working, are reviewed periodically, and have supporting documentation.

Core Objectives and Control Domains of the ECC

The five core domains of the ECC framework are:

• Cybersecurity Governance: Policies, accountability, risk management, and regulatory compliance.
• Cyber Defence: Protect assets, control access, manage vulnerabilities, monitor security, and respond to incidents.
• Cybersecurity Resilience: Cybersecurity requirements that support business continuity.
• Third-Party and Cloud Computing Cybersecurity: Navigating security risks with third-party providers and cloud services.
• Cybersecurity of Industrial Control Systems: Protection of industrial systems and operational environments.

Common Challenges to ECC Compliance

ECC may be difficult to meet for organizations with limited resources, disparate security systems, or gaps in compliance processes. The main challenges are:

• Limited Cybersecurity Expertise: Lack of skilled professionals to manage compliance, investigate threats, and maintain security operations.
• Disconnected Security Visibility: Separate cloud, network, and endpoint tools create monitoring gaps and limit threat visibility.
• Continuous Monitoring Demands: Typical Continuous surveillance needs dedicated analysts, reliable logging, and consistent threat investigation.
• Compliance Documentation Gaps: Missing incident records, incomplete logs, and out-of-date policies make compliance assessments difficult.
• Evolving Cyber Risks: Cyber risks are in flux. Changes in infrastructure and new threats mean you have to be reviewing security and updating controls on a regular basis.

These challenges make it more difficult to maintain effective security controls and prove ongoing ECC compliance.

How SOC Services Make ECC Compliance Easy

A Security Operations Center (SOC) centralizes security monitoring, threat detection, and incident management to support ECC requirements. SOC teams can help organizations to:

• Collect and monitor security logs in line with ECC control 2-12.
• Investigate threats and coordinate incident response under control 2-13.
• Maintain incident records and monitoring evidence for compliance assessments.

Managed SOC Benefits for ECC Compliance

A managed Security Operations Center allows organizations to fulfill the operational requirements of ECC compliance without having to build and maintain a full security team in-house. It provides value by delivering consistent monitoring, specialized expertise, and documented security operations.

Key benefits are:

• 24/7 Security Monitoring: Continuous surveillance is used to detect suspicious activity when the business is not open, and it provides constant security oversight.
• Access to Security Experts: Organizations can tap into the expertise of seasoned analysts who can evaluate alerts, assess threats, and offer guidance on incident response, without the need to hire every expert in-house.
• Improved Incident Response: Defined investigation procedures and response playbooks help teams to consistently assess, escalate and contain security incidents.
• Improved Audit Readiness: Centralized logs, incident reports, and investigation records provide evidence that can be used to support ECC compliance assessments.
• Predictable Operating Costs: Outsourcing selected security operations can remove the need for large upfront investments in monitoring infrastructure, tools, and internal staff, though actual savings will depend on the service agreement.
• Scalable Security Operations: Monitoring coverage can increase as organizations add new systems, cloud workloads, and business services, depending on provider capabilities and contract scope.

A managed SOC enhances operational controls to support ECC compliance, but does not remove the organization’s responsibility for cybersecurity governance, risk management, or regulatory compliance.

Eventus Security supports organizations through 24/7 managed SOC services, threat intelligence, and incident response capabilities. Our AI-powered security operations platform brings together security data from networks, endpoints, cloud environments, and identity systems to support continuous threat detection and investigation. These capabilities can help organizations address the security monitoring and incident response requirements of NCA ECC while maintaining visibility into emerging cyber threats.

What is the NCA MSOC Policy?

The National Policy for Managed Security Operations Centers (NPMSOC-1:2024) establishes requirements for managed cybersecurity operations in Saudi Arabia. The aim is to bolster the country’s cybersecurity posture with better threat monitoring, incident analysis, and access to trusted security services. It also supports the NCA’s duty to protect national security, vital interests, and government services and activities.

Policy vs Licensing Framework: One Regime, Two Documents

The NCA has two complementary documents to govern managed SOC services:

• National MSOC Policy (NPMSOC-1:2024): Sets requirements for organizations that require acquisition of managed SOC services.
• RFMSOC-1:2024 - MSOC Licensing Framework: Establishes licensing tiers, technical standards, and operational requirements for managed SOC service providers.

The duties of both the service providers and the organizations receiving the services are set out in those documents together.

Who the MSOC Policy Applies To

This policy applies to organizations responsible for the protection of high-priority sectors and critical national infrastructure, including:

• Government organizations, their affiliates, and entities.
• Private sector organizations that own, operate, or host critical national infrastructure.
• Other organizations the NCA specifically requires to implement the policy.

Other public and private organizations are encouraged to procure managed SOC services based on their cybersecurity needs.

Core Obligations: Tier 1 Providers, Prior Approval and 90-Day Report

The policy applies to organizations that have three key obligations to meet:

• Tier 1 Licensed Providers: Perform SOC operations through a Tier 1 MSOC provider licensed by an NCA.
• Pre-Approval by the NCA: Get approval before starting any SOC-related project, service, or initiative.
• 90-Day Compliance Report: Provide an assessment of current SOC operations and a compliance plan within 90 days of the effective date of the policy.

That 90-day deadline was a transition requirement, not a continuing reporting requirement. Organizations must also notify the NCA when they have completed their SOC transfer.

The 3 Minimum Services of MSOC

The policy outlines three minimum managed SOC services to improve cybersecurity in the Kingdom:

• Threat Monitoring and Detection: Monitor IT systems on an ongoing basis, detect suspicious activities, categorize alerts, and report identified threats.
• Threat Analysis and Investigation: Analyze security alerts, identify actual incidents, analyze their causes, and conduct threat-hunting activities.
• Threat Containment Recommendations: Provide the beneficiary organization with actionable recommendations to contain and neutralize identified cyber risks.

These services support more consistent security operations and help to safeguard the Kingdom’s critical digital infrastructure.

How Does the NCA License MSOC Providers?

The NCA regulates and licenses Managed Security Operations Center (MSOC) providers in compliance with the Regulatory Framework for Licensing MSOC Services (RFMSOC-1:2024). The framework sets out the criteria for eligibility, staffing, and operational requirements for providing regulated cybersecurity services to organizations in Saudi Arabia.

Tier 1 vs. Tier 2 MSOC License

The framework sets two licensing levels based on the organizations a provider can serve.

Both tiers require approval from the NCA, but Tier 1 has higher capital and staffing requirements.

Saudi Analyst Staffing and Tier 1 Requirements

Tier 1 applicants must be legally established in the Kingdom of Saudi Arabia, meet NCA ownership requirements, have a minimum capital of SAR 50 million, and pass technical assessments.

They must also employ qualified Saudi cybersecurity analysts full-time. Appendix E specifies a minimum of 32 analysts for providers serving 1–30 beneficiaries, increasing with client numbers. The NCA may approve staffing adjustments based on automation capabilities.

Provider Requirements: National SOC Connection, Data Locality, License Risk

Licensed providers shall:

• National SOC Connection: Connect to the NCA’s National Security Operations Center, as required.
• Data Localization: To ensure MSOC facilities, operations, data processing and storage are within the Kingdom of Saudi Arabia.
• Regulatory Reporting: Submit required cybersecurity reports and implement security directives published by the NCA.
• License Compliance: Adhere to licensing terms and cease offering licensed services if the license expires, is suspended, or cancelled.

These duties help the NCA to oversee managed cyber security services and to protect sensitive information and national infrastructure.

How do Organizations Achieve and Maintain NCA Compliance?

Compliance with the NCA is not just a matter of putting in place security controls once. Organizations need to understand what regulations apply, how to develop good cybersecurity practices, and keep evidence that shows they are continuously complying. This also requires compliance with certain requirements for managed security operations for those entities covered by the MSOC Policy.

The key steps are as follows:

• Assess Compliance Requirements: Identify applicable NCA frameworks, assess existing security controls, and document gaps to be addressed.
• Enhance Security Governance: Develop cybersecurity policies, assign responsibilities, and conduct regular risk assessments.
• Implement ECC Controls: Implement the controls required for access management, vulnerability management, security monitoring, incident response, and business continuity.
• Meet MSOC Policy Obligations: If applicable, engage a Tier 1 provider licensed by the NCA, obtain necessary approvals, and comply with applicable reporting obligations.
• Compliance Evidence Maintenance: Keep security logs, incident logs, assessment findings, and remediation documentation available for regulatory audits.
• Continuously Review and Improve: Re-assess controls as systems, cyber risks, and regulatory requirements evolve.

Continuous compliance matters. Cybersecurity risks aren’t static. Regular assessment, monitoring and corrective action can help organizations to ensure security effectiveness and demonstrate compliance with applicable NCA requirements.

How Can Eventus Security Support NCA ECC Compliance?

Meeting NCA ECC requirements involves continuous security monitoring, effective incident management, and maintaining evidence of security operations. Eventus Security, through its SOC as a Service offering, provides 24/7 security monitoring, threat detection, incident investigation, threat intelligence, and response support. These capabilities can help organizations implement operational security measures relevant to NCA ECC requirements.

How Eventus Security Supports ECC Security Operations:

• 24/7 Security Monitoring: Eventus monitors security events across networks, endpoints, cloud environments, and identity systems to help organizations detect suspicious activity and potential threats.
• Threat Detection and Investigation: Our managed SOC combines security analytics, threat intelligence, and experienced analysts to identify, prioritize, and investigate security alerts.
• Incident Response and Containment: Eventus supports incident triage, investigation, response coordination, and containment activities to help organizations manage security incidents.
• Security Log Management and Reporting: Eventus collects and analyzes security logs from multiple sources and provides incident reports and operational records that can support ECC compliance assessments.
• Proactive Threat Hunting: Eventus uses threat intelligence and threat hunting to identify indicators of compromise, investigate suspicious behavior, and improve threat visibility.

Frequently Asked Questions

1. Is NCA compliance mandatory for private companies?

NCA compliance is mandatory for private companies that own, operate, or host critical national infrastructure, as well as entities specifically directed by the authority. Other businesses are encouraged to adopt NCA controls unless additional regulatory obligations apply.

2. Can an organization have an in-house SOC? 

Yes, under the MSOC Policy. MSOC Policy-covered organizations must use a Tier 1 provider licensed by the NCA to perform required SOC operations. The policy stipulates that existing in-house SOC work will need to be transferred, subject to approval by the NCA and any other requirements the authority puts in place.

3. Is MSOC data required to stay within the borders of Saudi Arabia?

Yeah. Under the MSOC Licensing Framework, licensed providers are required to store their facilities and data in Saudi Arabia. MSOC services, including data processing and storage, will be operated in the Kingdom and will be subject to applicable NCA requirements. 

4. What is the punishment for cybercrime in Saudi Arabia?

Under Saudi Arabia's Anti-Cyber Crime Law, penalties depend on the offense and can reach 10 years in prison, a SAR 5 million fine, or both. Offenses include unauthorized access, online fraud, data theft, and attacks on information systems, with penalties varying by severity.

5. What is the top cybersecurity company in Saudi Arabia?

Saudi Arabia has several established cybersecurity companies. Eventus Security is one such provider serving organizations in the Kingdom, offering 24/7 managed SOC services, AI-driven threat detection, threat intelligence, and incident response capabilities. The best provider depends on an organization's security requirements, industry, and applicable NCA licensing obligations.