Cybersecurity regulation in Saudi Arabia (2026)

NCA published the Non-Critical National Information and Communications Infrastructure Cybersecurity Controls (NCNICC-1:2025), imposing mandatory minimum controls — covering governance, access management, incident response, and third-party security — on every private-sector organisation in Saudi Arabia regardless of critical infrastructure status, closing the gap that previously limited mandatory NCA rules to CNI operators.

NCA issued ECC-2:2024 replacing the 2018 version, streamlining controls from 114 to 108 across four domains, aligning with NIST CSF and ISO/IEC 27001, and introducing a Saudization mandate requiring all cybersecurity positions (not just senior roles) to be filled by qualified Saudi nationals.

Saudi Arabia's PDPL (originally enacted September 2021, amended by Royal Decree No. M/148 in March 2023) became fully enforceable, imposing cybersecurity obligations including encryption, access controls, 72-hour breach notification to SDAIA, and data protection impact assessments — creating GDPR-comparable data-security duties on all controllers.

NCA published the Operational Technology Cybersecurity Controls (OTCC-1:2022), establishing minimum security requirements for Industrial Control Systems (ICS) and OT environments in energy, utilities, and other CNI sectors — directly addressing attack vectors exposed by the Shamoon incidents.

NCA published the Cloud Cybersecurity Controls setting mandatory security requirements for cloud service providers and cloud tenants operating in Saudi Arabia, including data residency obligations and shared-responsibility security standards, later updated as CCC-2:2024.

NCA issued the first Essential Cybersecurity Controls — 114 mandatory controls across five domains (governance, risk management, operations, resilience, third parties) applicable to all government entities and CNI operators — establishing Saudi Arabia's first binding national cybersecurity framework.

Royal Order No. 6801 formally constituted the NCA reporting directly to the King, consolidating previously fragmented cybersecurity functions from the Ministry of Interior and MCIT under a single supreme cybersecurity regulator — the institutional cornerstone of Saudi Arabia's current cybersecurity framework.

Saudi Arabian Monetary Authority issued its mandatory Cyber Security Framework requiring all banks, insurers, and finance companies to establish a Saudi-national CISO, cybersecurity governance committees, and controls spanning risk management, access control, and incident response — with full compliance required by end of 2018.

A retooled Shamoon variant struck multiple Saudi government agencies and organisations from November 2016 through early 2017, demonstrating the persistent state-sponsored threat and directly accelerating the establishment of the NCA (October 2017) and the subsequent wave of mandatory sector controls.

The Shamoon malware (attributed to state-sponsored Iranian actors) destroyed approximately 35,000 Aramco workstations in hours, threatening 10% of global oil supply — the most consequential cyber incident in Saudi history and the primary catalyst for subsequent national cybersecurity legislation and institution-building.

Saudi Arabia enacted its first national cybersecurity law, criminalising unauthorised computer access, data theft, malware distribution, and online fraud, with penalties up to SAR 5 million and 4 years imprisonment for serious offences — the principal criminal statute still underpinning cybersecurity enforcement today.