Reference
Saudi cybersecurity and data protection frameworks
Who each framework applies to, which version is current, and where to read the official text. Start with the table, then open the page for the rules that apply to you.
Which framework applies to whom
| Framework | Issued by | Applies to | Current |
|---|---|---|---|
| Essential Cybersecurity Controls | NCA | Mandatory for government entities and their affiliated companies and entities, inside and outside the Kingdom, and for private-sector organizations that own, operate or host critical national infrastructure. Strongly encouraged for all other organizations. | ECC-2:2024 |
| Critical Systems Cybersecurity Controls | NCA | Organizations that own or operate critical systems, in addition to the ECC | CSCC-1:2019 |
| Cloud Cybersecurity Controls | NCA | Government entities and private-sector critical national infrastructure organizations that use cloud services, and the cloud service providers that serve them | CCC-2:2024 |
| Telework Cybersecurity Controls | NCA | Organizations in ECC scope that enable remote work | TCC-1:2021 |
| Operational Technology Cybersecurity Controls | NCA | Industrial control systems in facilities deemed critical and owned or operated by government organizations or by private-sector organizations that own, operate or host critical national infrastructure | OTCC-1:2022 |
| Personal Data Protection Law | SDAIA | Processing of personal data in the Kingdom, and processing from outside the Kingdom of personal data of people residing in it. Personal or family use by individuals is excluded if the data is not published or disclosed to others. | In force 14 September 2023; fully enforceable 14 September 2024 |
| SAMA Cyber Security Framework | SAMA | Financial institutions regulated by SAMA | Version 1.0 |
| Regulations for the Provision of Cloud Computing Services | CST | Cloud service providers serving the Kingdom and their subscribers, with added obligations for subscribers that hold government data | Fourth version, issued 8 October 2023 |
Reference pages
Essential Cybersecurity Controls
The national baseline, its four domains, who must comply and where to start.
Read moreThe NCA controls family
Critical systems, cloud, telework, operational technology and data controls, and how each builds on the ECC.
Read morePersonal Data Protection Law
The law in plain language: dates, obligations, transfers and first steps.
Read moreSAMA Cyber Security Framework
Four domains, the maturity level 3 target, and the card and SWIFT standards it expects.
Read moreLast verified against official sources: 26 September 2026
Sources
- NCA, Essential Cybersecurity Controls (ECC-2:2024) (opens in a new tab)
- NCA, Critical Systems Cybersecurity Controls (opens in a new tab)
- NCA, Cloud Cybersecurity Controls (CCC-2:2024) (opens in a new tab)
- NCA, Telework Cybersecurity Controls (opens in a new tab)
- NCA, Operational Technology Cybersecurity Controls (opens in a new tab)
- SDAIA, Implementing Regulation of the Personal Data Protection Law (English translation for guidance) (opens in a new tab)
- SAMA Rulebook, Cyber Security Framework (opens in a new tab)
- CST, Regulations for the Provision of Cloud Computing Services (opens in a new tab)
Ten minutes to know exactly where you stand
Tell us what you do and who regulates you. We will show you which Saudi rules apply, where the gaps usually are, and the shortest route to ready. No slides, no pitch.