Compliance
NCA Cybersecurity Controls for the Private Sector: Get Ready for NCNICC-1:2025
The NCA cybersecurity controls for the private sector (NCNICC-1:2025) are the first national control set for private companies that are not critical infrastructure. Waves Telecom helps mid-size and large Saudi businesses check their gaps and fix them before the NCA notifies them.
- 65 controls for large, 26 for SMEs
- 10 years in cybersecurity
- Sophos and Fortinet Gold Partner
10 yearsin cybersecurity
150+companies passed Aramco CCC
Gold PartnerSophos & Fortinet
Why NCA cybersecurity controls now reach the private sector
Until recently, NCA controls mainly applied to government bodies, government-owned companies and critical infrastructure operators. Most private companies only met them through a customer contract. That is changing. The NCA has adopted NCNICC-1:2025, the Cybersecurity Controls for Non-Critical National Infrastructure Private Sector Entities.
The new controls are tiered by company size. If your company has more than 250 full-time staff or revenue above SAR 200 million, you fall in the large tier. Many Eastern Province contractors, distributors, clinics and manufacturers sit in one of the two tiers.
There is no confirmed deadline or penalty schedule yet. This is the right time to prepare, while you can plan the work and budget instead of rushing it.
What NCNICC-1:2025 asks for
According to Baker McKenzie, large entities have 3 components, 22 sub-components and 65 essential controls. SMEs, with 6 to 249 full-time staff or SAR 3 million to SAR 200 million revenue, have 13 sub-components and 26 essential controls. Some SME controls are marked as recommended rather than mandatory.
The controls apply to entities "as notified by the Authority". As of late July 2026, no individual notifications had been publicly confirmed. Baker McKenzie advises that companies clearly meeting the thresholds should start scoping without waiting for a notice.
We read the official NCA document (Arabic edition) to build this page. For SMEs, the 26 controls come from 13 security areas. For each area, the company must write and approve its requirements, and then apply them. That makes 13 × 2 = 26 controls. Governance, third-party and cloud controls, penetration testing and web application firewalls are mandatory for large entities and only recommended for SMEs.
Large entities: 65 essential controls. SMEs: 26. No deadline or penalties confirmed yet, so now is the time to prepare.
The 13 areas SMEs must cover (26 mandatory controls)
This table lists the specific items the NCA marks as mandatory for SMEs (Category B), with the NCA control number. Large entities must meet all of these and more.
| Area | What SMEs must have | NCA ref | How Waves helps |
|---|---|---|---|
| Asset management | Documented, applied requirements for managing IT assets | 2-1 | Asset inventory and audit |
| Identity and access | Secure username and password login; MFA for remote access including email; least privilege and segregation of duties; periodic access review | 2-2 | MFA rollout and access cleanup |
| Systems and devices | Anti-malware on servers, PCs and mobiles; default passwords changed, unused services off, removable media restricted; central time sync | 2-3 | Sophos endpoint protection and hardening |
| Phishing and spam filtering; email domain documented on the Haseen platform with SPF, DKIM and DMARC | 2-4 | DMARC and email security | |
| Network | Network firewalls and secure access gateways; secure Wi-Fi with strong authentication and encryption | 2-5 | Sophos and FortiGate firewalls |
| Mobile and BYOD | Written, applied rules if personal devices connect to company systems | 2-6 | Mobile device management |
| Data protection | Secure printers, scanners and copiers; secure disposal and reuse of disks and paper; protection by data classification | 2-7 | Printer hardening and secure wipe |
| Encryption | Data encrypted at rest and in transit | 2-8 | Disk encryption and VPN |
| Backup | Regular backups of sensitive business systems; regular restore tests | 2-9 | Backup and restore testing |
| Vulnerabilities | Regular patching; regular scans of internet-facing applications; fixes by severity, tested before rollout | 2-10 | Patch management |
| Logs | Security event logs switched on for sensitive systems | 2-12 | Logging setup |
| Incidents | Report cybersecurity incidents to the NCA and share cybersecurity information with it | 2-13 | Incident reporting procedure |
| Physical security | Controlled access to IT rooms and sensitive equipment; protected CCTV recordings | 2-14 | Access control and CCTV |
Recommended but not mandatory for SMEs: privileged access management, network segmentation, IPS, DDoS protection, data leakage prevention, penetration testing, web application firewall, a licensed managed SOC, governance, third-party and cloud controls. Source: NCA, NCNICC-1:2025 (Arabic).
Free NCA readiness checklist: 27 Yes/No questions mapped to these controls, in English and Arabic. Takes 10 minutes. Ask for it on WhatsApp.
How Waves gets you ready
Size and scope
We confirm which tier you fall in from your staff count and revenue, and which systems are in scope.
Gap assessment
We check your current setup against the controls for your tier and give you a prioritised gap list.
Quick technical fixes
We close the common gaps first: MFA, privileged access, email authentication, backup testing and patching.
Policies and roles
We help you document policies, define the cybersecurity function and set up incident reporting steps.
Monitoring through partners
Waves does not run its own SOC. Where you need an NCA-licensed managed SOC, we help you choose and onboard one through our partners.
Keep evidence current
We keep your evidence and settings up to date, so you are ready when a notice or customer audit arrives.
Controls we help you meet
MFA and privileged access
Multi-factor login for remote access and admin accounts, using Microsoft, Fortinet or Sophos tools you may already own.
Email domain protection
SPF, DKIM and DMARC setup so your domain can be documented on the NCA's Haseen platform.
Backup and restore testing
Backups you can prove work, with scheduled restore tests and records for auditors.
Firewall and endpoint
Sophos and Fortinet firewalls and endpoint protection, configured and kept on current licences.
Incident readiness
A written incident response plan and clear steps for reporting incidents to the NCA.
Awareness training
KnowBe4 phishing tests and training so staff can spot the attacks the controls are built to stop.
Brands and partners
SophosFortinetMicrosoftKnowBe4CiscoDellHPE
Frequently asked questions
Does NCNICC-1:2025 apply to my company?
It is aimed at private companies that are not critical national infrastructure and that meet the size thresholds. It applies to entities as notified by the NCA. If you have 6 or more staff or SAR 3 million or more revenue, it is worth checking your tier now.
Is there a compliance deadline?
No effective date, deadline or penalty schedule has been published in the sources we track. We frame this as preparation. Companies that start early can spread the cost and avoid a rush later.
What is the difference between the large and SME tiers?
Large entities have more than 250 full-time staff or revenue above SAR 200 million, and 65 essential controls. SMEs have 6 to 249 staff or SAR 3 million to SAR 200 million revenue, and 26 essential controls.
Do we need a managed SOC?
Under the official controls, subscribing to an NCA-licensed managed SOC is mandatory for large entities and recommended for SMEs. Waves does not run a licensed SOC itself. We help you select and onboard a licensed provider through our partners.
What exactly are the 26 SME controls?
They cover 13 areas: asset management, identity and access, systems and devices, email, network, mobile devices, data protection, encryption, backup, vulnerabilities, logs, incidents and physical security. For each area, the company needs written, approved requirements, and must apply them. The table above lists the specific items under each area.
How is this different from NCA ECC?
ECC-2:2024 binds government bodies, government-owned companies and critical infrastructure operators. NCNICC-1:2025 is the NCA's control set for other private companies. If you supply ECC-bound customers, you may already be meeting some of these controls.
We already hold an Aramco CCC. Does that help?
Yes. Many CCC controls, such as MFA, backup and firewall protection, overlap with NCNICC. We can map what you already have and show the remaining gaps.
Start your NCA readiness review
Tell us your company size and current setup. We will show you which tier you fall in and what to fix first.
- 📞 +966 58 236 5619
- 💬 +966 58 236 5619
- ✉️ info@wavestelecom.net
- 📍 3266 Adh Dhahran – Al Aqrabiyah Dist, Al Khobar 34446
