NCA Compliance Guide: National Cybersecurity Authority Requirements
NCA enforces controls on every entity handling government data. We explain the essential controls and how to ensure your server is compliant.
What is NCA?
The National Cybersecurity Authority (NCA) is the entity responsible for protecting Saudi Arabia's cyberspace. Established in 2017, it reports directly to the King.
Its controls are mandatory for every government entity and every company handling government or sensitive data.
Essential Cybersecurity Controls (ECC)
The ECC consists of 114 controls across 5 domains:
| Domain | Controls | Examples |
|---|---|---|
| Cybersecurity Governance | 17 | Policies, roles, responsibilities |
| Cybersecurity Defense | 28 | Identity management, encryption |
| Cybersecurity Resilience | 27 | Backup, vulnerability management |
| Third-Party Security | 8 | Service providers, cloud computing |
| ICS Security | 34 | SCADA systems, IoT |
Cloud Cybersecurity Controls (CCC)
If you use cloud services — as provider or consumer — additional controls apply:
- Data classification before uploading to cloud
- Data encryption in transit and at rest
- Access management with least privilege
- Continuous monitoring for security incidents
- Disaster recovery planning
How to Ensure Server Compliance
1. Server Location
Server must be in an accredited Saudi data center. Foreign server = immediate non-compliance.
2. Encryption
- SSL/TLS on all connections
- Sensitive database encryption
- Encrypted backups
3. Access Management
- Two-factor authentication (2FA) mandatory
- Least privilege principle
- Periodic access reviews
4. Monitoring and Logging
- Security event logs for minimum 12 months
- Intrusion Detection System (IDS/IPS)
- 24/7 monitoring
5. Vulnerability Management
- Periodic vulnerability scanning
- Security updates within 30 days of release
- Annual penetration testing
Cost of Compliance
Compliance is not free — but non-compliance costs more. NCA fines reach 5 million SAR + activity suspension.
| Item | Approximate Annual Cost |
|---|---|
| Accredited Saudi server | 3,450 - competitive pricing — pricing and plans |
| SSL certificates | Free (Let's Encrypt) |
| Monitoring system | 1,200 - 5,000 SAR |
| Penetration testing | 5,000 - 20,000 SAR |
| Security consultant | 10,000 - 50,000 SAR |
First Step
Start with a Saudi server in an accredited data center. This covers the biggest portion of compliance requirements. CLOUD provides servers in Riyadh with Tier III standards — ready in 60 seconds.
Get Started
Need a secure environment? Choose a protected server with DDoS protection and advanced firewall. Review our SLA and Privacy Policy.
