Saudi ArabiaEssential Cybersecurity Controls (ECC-2:2024), minimum cybersecurity controls
In force.
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds a private sector entity that owns, operates or hosts Critical National Infrastructure in Saudi Arabia, and a government agency and its affiliated companies and entities (reached by declaring that you operate an essential service); every other entity is only encouraged to adopt the Controls (ECC Scope of Work).
- Take all necessary measures to ensure ongoing and continuous compliance with the Essential Cybersecurity Controls (Implementation and Compliance).
- Identify, document, approve and implement cybersecurity requirements for technical vulnerabilities management that include, at a minimum, periodic vulnerabilities assessment and detection and patch management to remediate vulnerabilities (Control 2-10).
- Expect the National Cybersecurity Authority to evaluate your compliance through self-assessment, periodic reports of the compliance tool, or field auditing visits (Implementation and Compliance).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Clause Fifth of the Legal Powers lets the Authority's committee impose a fine not exceeding 25,000,000 riyals on a person other than a public entity, alongside a warning, temporary suspension or revocation of a license, and suspension of the service or activity.
- Rule
- Fixed only
- As of
- Currency
- SAR
- Fixed cap
- 25,000,000
Who enforces it
Enforcement body
The National Cybersecurity Authority, whose Board of Directors forms the committee that reviews violations and imposes the penalties.
What this law does
The Essential Cybersecurity Controls apply to government agencies in the Kingdom of Saudi Arabia and their affiliated companies and entities, as well as all private sector entities owning, operating, or hosting Critical National Infrastructures. The National Cybersecurity Authority strongly encourages all other entities in the Kingdom to leverage the Controls to implement best practices.
The Essential Cybersecurity Controls state that all entities within their scope shall take all necessary measures to ensure ongoing and continuous compliance with the Controls, as per Article 10(3) of the NCA's Statute and High Order No. 57231. Control 2-10-3 requires the cybersecurity requirements for technical vulnerabilities management to include, at a minimum, periodic vulnerabilities assessment and detection and patch management.
The Legal Powers of the National Cybersecurity Authority make failing to comply with cybersecurity controls set by the Authority a violation. A person other than a public entity who commits such a violation is subject to one or more of a warning, temporary suspension of the license, revocation of the license, suspension of the service or activity, and a fine not exceeding 25,000,000 riyals.
When LexLint raises it
When your app profile says your app runs an essential service.