Information Security Policy for Saudi Companies: What the NCA Expects Under ECC-2:2024 and NCNICC-1:2025

WaqiSec Compliance Team · Last reviewed: 2026-10-14

Which NCA framework applies to your company?

The size thresholds come from Okaz and Baker McKenzie summaries of NCNICC. Even where a written policy is only recommended, banks, enterprise clients and government buyers usually ask for one in their security questionnaires. Our NCNICC guide and ECC guide explain each framework in full.

What ECC-2:2024 requires for cybersecurity policies

ECC-2:2024 has 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols. Subdomain 1-3, Cybersecurity Policies and Procedures, holds four controls:

Related controls shape who owns the policy. Control 1-2-1 requires a cybersecurity department independent of the IT and communications department, preferably reporting to the head of the entity. Control 1-2-3 requires a cybersecurity supervisory committee. Controls 1-8-1 to 1-8-3 require periodic review by the cybersecurity department and independent audit by others. Controls 1-10-1 to 1-10-5 require an approved awareness programme.

What NCNICC-1:2025 requires

The NCA issued the Cybersecurity Controls for Non-CNI Private Sector Entities (NCNICC-1:2025) on 28 December 2025. They have three components: cybersecurity governance, cybersecurity enhancement and third-party cybersecurity. The governance component covers cybersecurity management, policies and procedures, risk management, periodic review and audit by a party independent of the cybersecurity unit, and awareness and training.

For large entities, press and law-firm summaries describe 65 essential controls and a cybersecurity unit that reports to the head of the entity and is independent of IT, led by a qualified full-time Saudi. For SMEs they describe 26 controls. The official document is published only in Arabic, so confirm which controls apply to your category from the NCA's own text.

What a cybersecurity policy should contain

Following the structure of the NCA's Corporate Cybersecurity Policy template, a general policy usually covers:

1. Purpose and scope: which assets, people and third parties it covers.
2. Policy statements: the organization's commitments across strategy, roles, risk management, compliance, audit, human resources, awareness, asset management, access, network, data protection, incidents, third parties and continuity.
3. Roles and responsibilities: the Authorized Official, the cybersecurity function, the supervisory committee and all staff.
4. The set of topic policies and standards that sit under it.
5. Compliance and consequences of violations.
6. Review and update cycle, and the document owner.

A general policy is the top of a document set. Assessors will also look for topic policies (for example access control, acceptable use, data classification and incident management), technical standards and procedures, and records that show they are used. An incident response plan is usually the next document buyers ask for.

Using the free NCA Cybersecurity Toolkit

The NCA's Cybersecurity Toolkit offers free Word, PDF and Excel templates in Arabic and English. It includes governance documents (organizational structure, roles and responsibilities, the supervisory committee charter, strategy), more than 30 policies, more than 30 standards, procedures, a Cybersecurity Policies Undertaking Form and an awareness programme. The English page was last updated in November 2025.

The templates are a sound starting point, but the NCA's own disclaimer calls them an illustrative example to be used as a guide and reference, not a finished policy. Before approval you need to replace placeholders, remove the guidance boxes, fit the content to your systems, size and sector, and make sure the people and committees named actually exist. An unadapted template is one of the quickest findings an assessor can raise.

Approval, communication and staff acknowledgement

• Approval: the NCA template states the policy must be approved by the head of the organization (the Authorizing Official) or a delegate. Keep the signed approval or board minute.
• Communication: circulate it to concerned staff and relevant parties through official channels, such as the intranet or email, and keep proof.
• Acknowledgement: the toolkit's Cybersecurity Policies Undertaking Form lets staff confirm they have read the policies. We found no control text that requires a signature, but it is the simplest evidence of communication.
• Review: ECC sets planned intervals; the NCA template sets at least once a year or after significant changes. Log each review, even when nothing changes.

What an assessor asks to see

The NCA's ECC implementation guide points to the following evidence for the policy controls:

Common mistakes

• Publishing the NCA template with placeholders or guidance boxes still in place.
• Approval by the IT manager instead of the head of the entity or a formal delegate.
• A policy that names a cybersecurity department or committee the company does not have.
• No evidence that staff received or read the policy.
• No review record since the policy was first written.
• Writing only in English when assessors or staff work in Arabic.

Cybersecurity policy checklist

• We know whether ECC-2:2024 or NCNICC-1:2025 applies, and in which category.
• Our general cybersecurity policy is adapted to our company, not a raw template.
• It was approved by the head of the entity or a formal delegate.
• Topic policies and technical standards sit under it.
• Staff received it, and we hold acknowledgements.
• Responsibility for cybersecurity sits with a function independent of IT where required.
• We review the policy at least once a year and log each review.
• We hold the evidence an assessor will ask for.

Related guides

This guide is general information, not legal advice. Always check the official text from the relevant authority before making decisions.