Saudi cybersecurity regulations

The national cybersecurity baseline. Mandatory for government entities (including their companies inside and outside the Kingdom) and for private entities that own, operate or host Critical National Infrastructure.

Applies to: Government entities, their affiliated companies, and CNI operators.

Minimum cybersecurity requirements for private sector organizations that are not Critical National Infrastructure, derived from the ECC. Class A (large) entities apply all components; Class B (small and medium) entities apply the core defense controls.

Applies to: Private sector entities outside CNI that NCA circulates the controls to (Class A: large, Class B: SMEs).

An extension of the ECC that sets additional minimum cybersecurity requirements for national critical systems, i.e. systems whose failure or compromise could harm the organization's services or cause national economic, financial, security or social impact.

Applies to: Organizations that own or operate systems identified as critical under the CSCC criteria: government organizations inside or outside the Kingdom (ministries, authorities, establishments, embassies), their subsidiaries and companies, and private sector organizations. Continuous ECC compliance is a prerequisite.

Cloud-specific extension of the ECC that sets minimum cybersecurity requirements for Cloud Service Providers (CSPs) and Cloud Service Tenants (CSTs). Each control applies either to providers or to tenants, on top of the ECC.

Applies to: CSTs: government entities inside or outside the Kingdom and their companies, and private entities that own, operate or host CNI, that use or plan to use cloud services. CSPs: any provider serving those tenants. Both must also comply with the ECC.

An extension of the ECC that sets the minimum cybersecurity requirements for protecting data throughout its lifecycle (create, store, share, use, dispose). Requirements scale with the data classification level: Public, Restricted, Secret and Top Secret.

Applies to: Government organizations (ministries, authorities, establishments and others) and their companies and entities, plus private sector organizations that own, operate or host Critical National Infrastructure; covers all physical and digital data. Continuous ECC compliance is a prerequisite.

Extension of the ECC that sets minimum cybersecurity requirements for Industrial Control Systems (OT/ICS) in critical facilities. Controls apply according to the facility level (L1 high, L2 moderate, L3 low criticality) assigned with NCA's Facility Level Identification Tool.

Applies to: Government organizations and private entities owning, operating or hosting Critical National Infrastructure that own or operate ICS in critical facilities, inside or outside the Kingdom; ECC compliance is a prerequisite.

Minimum cybersecurity requirements that let national organizations run telework (remote work) securely, issued as an extension of the ECC. Every in-scope organization that allows telework must apply all controls relevant to it.

Applies to: Government organizations (ministries, authorities, establishments and their companies) and private entities that own, operate or host Critical National Infrastructure, whenever they allow telework.

Minimum cybersecurity requirements for the secure use of official organizational social media accounts, reducing the risk of account takeover, misuse and impersonation. Issued as an extension of the ECC.

Applies to: Government organizations (ministries, authorities, establishments and their companies) and private entities that own, operate or host Critical National Infrastructure, when they use social media accounts.

The national minimum requirements for using cryptography to protect data, systems and networks for civilian and commercial purposes. It lists the accepted algorithms, key lengths, modes, protocols, certificate rules and key lifecycle management practices at two strength levels (MODERATE and ADVANCED). Other NCA controls, such as the ECC cryptography subdomain, require compliance with it.

Applies to: National entities that use cryptography to protect data (in use, at rest and in transit), systems and networks for civilian or commercial purposes; each entity selects the MODERATE or ADVANCED level according to data sensitivity or as mandated by other NCA regulations.

Protects the personal data of individuals in the Kingdom. Requires a legal basis and consent rules, privacy notices, data subject rights within 30 days, minimization, retention limits, processor controls, records of processing, DPO appointment and impact assessments where required, security measures, breach notification to SDAIA within 72 hours, and controls on transfers outside the Kingdom. Violations can reach SAR 5 million.

Applies to: Any entity processing personal data of individuals in the Kingdom, including entities outside the Kingdom that process data of residents; personal or family use is excluded.

National standards for managing and governing government data and protecting personal data, organised in 15 domains from data governance to personal data protection. Entities audit their compliance at specification level every year and submit the report to NDMO in the third quarter; specifications are phased in by priority (P1 year 1, P2 year 2, P3 year 3).

Applies to: All public entities (government entities and their affiliates, and companies that run public utilities or national infrastructure or render related public services) and business partners handling government data.

Sector framework for service providers licensed or registered by CST. Non-CNI providers implement the CRF controls at the compliance level CST assigns (CL1–CL3); CNI providers follow NCA ECC and share compliance reports and incidents with CST.

Applies to: Telecom, internet, postal and ICT service providers licensed or registered by CST.

CST rules for cloud computing services in the Kingdom: CSP registration with CST, subscriber data classification and location, breach notification, subscriber data protection, unlawful content, minimum contract terms, liability, quality and continuity. It replaced the Cloud Computing Regulatory Framework v3 and applies together with the Guide for Cloud Computing Service Providers v5.

Applies to: Cloud service providers serving subscribers resident or addressed in the Kingdom, and any CSP processing or storing subscriber content in Saudi data centers; CSPs controlling a data center or core cloud infrastructure in the Kingdom must register with CST. Cloud subscribers must classify their data, keep government data in the Kingdom with registered CSPs, and comply with NCA, NDMO and SAIP rules.

Principle-based cyber security framework of the Saudi Central Bank that sets the cyber security controls and maturity model for financial institutions regulated by SAMA. Member Organizations must operate at maturity level 3 or higher (level 4 for banks).

Applies to: All Member Organizations regulated by SAMA: banks, insurance and/or reinsurance companies, financing companies and credit bureaus operating in Saudi Arabia, and the financial market infrastructure; the Rulebook also applies it to payment systems and payment service providers and regulatory sandbox participants. All subdomains apply to banks; non-bank institutions are exempt from 3.2.3, 3.3.12 and 3.3.13 (with conditions).

Saudi Central Bank requirements for initiating, implementing, maintaining, monitoring and improving business continuity and IT disaster recovery, based on ISO 22301, ISO 27001, BCI and DRII practices. Member Organizations must integrate the requirements formally into their BCM program.

Applies to: All organizations affiliated with SAMA (Member Organizations), all banks operating in Saudi Arabia, banking subsidiaries of Saudi banks and subsidiaries of foreign banks in Saudi Arabia; the SAMA Rulebook lists its scope as the banking sector, finance sector, payment systems and payment service providers, and credit bureaus. It covers the full scope of the organization, including subsidiaries, staff, subcontractors, third parties and customers.

CMA cybersecurity controls for capital market institutions supervised by the Capital Market Authority, built on NCA controls, the SAMA framework, NIST and ISO. Implementation is subject to periodic self-assessment, review and audit under a mechanism set by CMA.

Applies to: All capital market institutions licensed and supervised by CMA (e.g. Authorised Persons); CMA may apply the guidelines to any entity under its supervision. NCA ECC also applies and is mandatory for institutions that fall within the ECC scope.

Mandatory DGA controls for IT governance and for risk management and business continuity in digital government, plus the security-, hosting- and resilience-related Digital Transformation Basic Standards measured in the annual Qiyas assessment. DGA measures compliance; cybersecurity controls are left to NCA and data and privacy to SDAIA/NDMO.

Applies to: All government entities and operating entities that provide digital government services and products, regardless of type, size or nature (applied in proportion to their environment, complexity and locations).

Privacy and security policies of the Saudi Health Information Exchange (SeHE): nine policies on purpose of use, information security, patient rights, identity management, authentication, consent and access control, audit, breach notification and secondary use of personal health information. Some technical values are dated (e.g. 3DES, TLS 1.0, ISO 27799:2008) and should be read together with current NCA controls.

Applies to: Participating Healthcare Subscribers (healthcare organizations connected to the SeHE), their business associates and subcontractors, and SeHE system service providers, for all personal health information provided to or retrieved from the exchange.