What Is the NCA, and Why Should SaaS Companies Care?
The National Cybersecurity Authority (NCA) is Saudi Arabia’s national cybersecurity regulator, established by Royal Order and reporting directly to national leadership. For years, its mandatory frameworks applied mainly to government bodies and Critical National Infrastructure (CNI) operators — banks, telecoms, energy, and similar sectors. That changed in January 2026.
The Rule That Changed Everything: NCNICC-1:2025
The NCA released NCNICC-1:2025 — Cybersecurity Controls for Non-CNI Private Sector Entities — extending mandatory baseline cybersecurity requirements to private companies across the Kingdom for the first time, regardless of whether they’re classified as critical infrastructure. Technology companies, SaaS providers, and e-commerce platforms are explicitly named as being in scope.
This closes a gap that previously left most private-sector software businesses with no binding cybersecurity obligations at all.
Who’s Covered, and at What Level
NCNICC-1:2025 uses a tiered structure so smaller businesses aren’t held to the same bar as large enterprises:
• Class A (large entities): 250+ employees or SAR 200 million+ in annual revenue. Subject to a much broader set of requirements — governance, audit, third-party risk, cloud controls, and in some cases a dedicated internal cybersecurity unit.
• Class B (SMEs): roughly 6–249 employees or SAR 3 million–SAR 200 million in revenue. A narrower but still mandatory set of technical and operational controls, concentrated mainly in the “Cybersecurity Defense” component.
The framework is organized around three components — Cybersecurity Governance, Cybersecurity Defense, and Third-Party & Cloud Computing Cybersecurity — built on dozens of underlying controls. Even businesses below the mandatory thresholds are encouraged to adopt the baseline voluntarily.
What This Looks Like in Practice for a SaaS Business
Across the various NCA frameworks (ECC, CCC, NCNICC), a few requirements come up consistently and are the ones most relevant to a SaaS product:
• Multi-factor authentication (MFA) on administrative and privileged access
• Data encryption at rest and in transit
• Regular, tested backups with a defined recovery process
• Centralized incident logging — so a breach or anomaly can be reconstructed and investigated
• Role-based access control, limiting who can see or modify sensitive data
• Third-party and vendor risk management — knowing which vendors touch your systems or data and assessing their security posture
• Secure software development practices, particularly relevant for SaaS platforms that ship frequent code changes
• Cloud-specific controls if you’re hosted on shared infrastructure — closing unused ports, encrypting storage, and never leaving resources open to the public internet by default.
• Secure-by-design development — role-based access control, encrypted data storage, and MFA built into the core of the systems we ship, not added later as a patch.
• Cloud architecture aligned with NCA expectations — proper network segmentation, encrypted storage, and no publicly exposed resources by default.
• Audit-ready logging — centralized activity and access logs structured so they can support an NCA inspection or an internal incident investigation.
• Vendor and integration review — when we connect your platform to third-party services or APIs, we assess what access they require and scope it down to the minimum necessary.
If you’re building or already running a SaaS product in KSA and haven’t yet run a gap assessment against NCNICC-1:2025, that’s the logical starting point — before a client’s procurement team or an NCA inspector asks for it first.