Saudi ArabiaEssential Cybersecurity Controls (ECC-2:2024), cybersecurity incident and threat management
Essential Cybersecurity Controls (ECC-2:2024), Control 2-13
In force.
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a private sector entity that owns, operates or hosts Critical National Infrastructure in Saudi Arabia, and a government agency and its affiliated companies and entities (reached by declaring that you operate an essential service); every other entity is only encouraged to adopt the Controls (ECC Scope of Work).
- Identify, document, approve and implement requirements for cybersecurity incident and threat management that include cybersecurity incident response plans and escalation procedures and cybersecurity incident classification (Control 2-13).
- Include in those requirements reporting cybersecurity incidents to the National Cybersecurity Authority (Control 2-13-3, item 2.13.3.3).
- Include in those requirements sharing cybersecurity incident notifications, threat intelligence, penetration indicators, and incident reports with the National Cybersecurity Authority (Control 2-13-3, item 2.13.3.4).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Clause Fifth of the Legal Powers lets the Authority's committee impose a fine not exceeding 25,000,000 riyals on a person other than a public entity, alongside a warning, temporary suspension or revocation of a license, and suspension of the service or activity.
- Rule
- Fixed only
- As of
- Currency
- SAR
- Fixed cap
- 25,000,000
Who enforces it
Enforcement body
The National Cybersecurity Authority, whose Board of Directors forms the committee that reviews violations and imposes the penalties.
What this law does
The Essential Cybersecurity Controls apply to government agencies in the Kingdom of Saudi Arabia and their affiliated companies and entities, as well as all private sector entities owning, operating, or hosting Critical National Infrastructures. Control 2-13 states its objective as timely identification, detection, and effective management of cybersecurity incidents and proactive response to cybersecurity threats.
Control 2-13-3 requires an entity's cybersecurity incident and threat management requirements to include, at a minimum, reporting cybersecurity incidents to the NCA. Control 2-13-3 also requires those requirements to include sharing cybersecurity incident notifications, threat intelligence, penetration indicators, and incident reports with the NCA. The Legal Powers of the National Cybersecurity Authority make failing to comply with cybersecurity controls set by the Authority a violation.
A person other than a public entity who commits such a violation is subject to one or more of a warning, temporary suspension of the license, revocation of the license, suspension of the service or activity, and a fine not exceeding 25,000,000 riyals.
When LexLint raises it
When your app profile says your app runs an essential service.