Compliance
NCA Cybersecurity Controls for the Private Sector: Get Ready for NCNICC-1:2025
The NCA cybersecurity controls for the private sector (NCNICC-1:2025) are the first national control set for private companies that are not critical infrastructure. Waves Telecom helps mid-size and large Saudi businesses check their gaps and fix them before the NCA notifies them.
- 65 controls for large, 26 for SMEs
- 10 years in cybersecurity
- Sophos and Fortinet Gold Partner
10 yearsin cybersecurity
150+companies passed Aramco CCC
Gold PartnerSophos & Fortinet
Why NCA cybersecurity controls now reach the private sector
Until recently, NCA controls mainly applied to government bodies, government-owned companies and critical infrastructure operators. Most private companies only met them through a customer contract. That is changing. The NCA has adopted NCNICC-1:2025, the Cybersecurity Controls for Non-Critical National Infrastructure Private Sector Entities.
The new controls are tiered by company size. If your company has more than 250 full-time staff or revenue above SAR 200 million, you fall in the large tier. Many Eastern Province contractors, distributors, clinics and manufacturers sit in one of the two tiers.
There is no confirmed deadline or penalty schedule yet. This is the right time to prepare, while you can plan the work and budget instead of rushing it.
What NCNICC-1:2025 asks for
According to Baker McKenzie, large entities have 3 components, 22 sub-components and 65 essential controls. SMEs, with 6 to 249 full-time staff or SAR 3 million to SAR 200 million revenue, have 13 sub-components and 26 essential controls. Some SME controls are marked as recommended rather than mandatory.
The controls apply to entities "as notified by the Authority". As of late July 2026, no individual notifications had been publicly confirmed. Baker McKenzie advises that companies clearly meeting the thresholds should start scoping without waiting for a notice.
A consultancy summary of the controls lists the practical items buyers ask us about. These include a cybersecurity unit separate from IT and MFA for remote access. They also include privileged access management, and an email domain documented on the NCA's Haseen platform with SPF, DKIM and DMARC. Backup restoration testing and reporting incidents to the NCA are also required. Large entities must use an NCA-licensed managed SOC, and it is recommended for SMEs.
Large entities: 65 essential controls. SMEs: 26. No deadline or penalties confirmed yet, so now is the time to prepare.
How Waves gets you ready
Size and scope
We confirm which tier you fall in from your staff count and revenue, and which systems are in scope.
Gap assessment
We check your current setup against the controls for your tier and give you a prioritised gap list.
Quick technical fixes
We close the common gaps first: MFA, privileged access, email authentication, backup testing and patching.
Policies and roles
We help you document policies, define the cybersecurity function and set up incident reporting steps.
Monitoring through partners
Waves does not run its own SOC. Where you need an NCA-licensed managed SOC, we help you choose and onboard one through our partners.
Keep evidence current
We keep your evidence and settings up to date, so you are ready when a notice or customer audit arrives.
Controls we help you meet
MFA and privileged access
Multi-factor login for remote access and admin accounts, using Microsoft, Fortinet or Sophos tools you may already own.
Email domain protection
SPF, DKIM and DMARC setup so your domain can be documented on the NCA's Haseen platform.
Backup and restore testing
Backups you can prove work, with scheduled restore tests and records for auditors.
Firewall and endpoint
Sophos and Fortinet firewalls and endpoint protection, configured and kept on current licences.
Incident readiness
A written incident response plan and clear steps for reporting incidents to the NCA.
Awareness training
KnowBe4 phishing tests and training so staff can spot the attacks the controls are built to stop.
Brands and partners
SophosFortinetMicrosoftKnowBe4CiscoDellHPE
Frequently asked questions
Does NCNICC-1:2025 apply to my company?
It is aimed at private companies that are not critical national infrastructure and that meet the size thresholds. It applies to entities as notified by the NCA. If you have 6 or more staff or SAR 3 million or more revenue, it is worth checking your tier now.
Is there a compliance deadline?
No effective date, deadline or penalty schedule has been published in the sources we track. We frame this as preparation. Companies that start early can spread the cost and avoid a rush later.
What is the difference between the large and SME tiers?
Large entities have more than 250 full-time staff or revenue above SAR 200 million, and 65 essential controls. SMEs have 6 to 249 staff or SAR 3 million to SAR 200 million revenue, and 26 essential controls.
Do we need a managed SOC?
A consultancy summary of the controls says an NCA-licensed managed SOC is mandatory for large entities and recommended for SMEs. Waves does not run a licensed SOC itself. We help you select and onboard a licensed provider through our partners.
How is this different from NCA ECC?
ECC-2:2024 binds government bodies, government-owned companies and critical infrastructure operators. NCNICC-1:2025 is the NCA's control set for other private companies. If you supply ECC-bound customers, you may already be meeting some of these controls.
We already hold an Aramco CCC. Does that help?
Yes. Many CCC controls, such as MFA, backup and firewall protection, overlap with NCNICC. We can map what you already have and show the remaining gaps.
Start your NCA readiness review
Tell us your company size and current setup. We will show you which tier you fall in and what to fix first.
- 📞 +966 58 236 5619
- 💬 +966 58 236 5619
- ✉️ info@wavestelecom.net
- 📍 3266 Adh Dhahran – Al Aqrabiyah Dist, Al Khobar 34446
