orbit by reconn.Insights around Applied AI, AI Governance, AI Security and everything around it
ISO 27001 in Saudi Arabia: how it fits with the NCA, SAMA and PDPL
Which Saudi framework applies to you, what ISO 27001 does and does not do for compliance, a practical route to build one system, and who to train.
- By Shenoy
- Updated
- 12 min read
Every great mission starts with reconn.
In Saudi Arabia, ISO/IEC 27001 is the management system that most organizations build first, and the national frameworks sit on top of it. Which framework applies to you depends on who you are: the National Cybersecurity Authority (NCA) sets the Essential Cybersecurity Controls for government and critical national infrastructure, a separate set of controls for other private-sector entities, and the Saudi Central Bank (SAMA) sets its own framework for financial institutions.
ISO 27001 does not replace these frameworks, and certification does not prove compliance with them. What it gives you is one governed system, one risk process and one body of evidence to map them onto. If you want to talk through how that applies to your organization, talk to me directly. There is no commitment.
Key takeaways
- Saudi Arabia does not have one cybersecurity rule. ECC-2:2024 applies to government agencies and to private entities that own, operate or host critical national infrastructure. NCNICC-1:2025 applies to other private-sector entities that the NCA notifies. SAMA's framework applies to financial institutions it supervises.
- NCNICC-1:2025 splits in-scope private entities into Category A (more than 250 full-time employees or revenue above SAR 200 million) and Category B (6 to 249 employees or revenue between SAR 3 million and SAR 200 million).
- The NCA assesses compliance with its own controls, through methods such as self-assessment, compliance tool reports and field audits. An ISO 27001 certificate is not a substitute for that assessment.
- ISO 27001 helps because it organizes the work: scope, risk assessment, controls, internal audit, management review and improvement. You then map each Saudi control to that system once, instead of running separate projects.
- The Personal Data Protection Law (PDPL) came into force on 14 September 2023, with a one-year grace period to 14 September 2024, and SDAIA is the competent authority.
- With reconn, self-paced eLearning includes a 1-on-1 session with a PECB Certified Trainer and unlimited email and WhatsApp support until you clear the exam. Arabic courseware is available, and Saudi buyers receive ZATCA-compliant invoices.
Which PECB course fits your role?
Which Saudi cybersecurity framework applies to you
Start with who you are, because that decides which rulebook applies. If the standard itself is new to you, the ISO 27001 guide explains what it requires first.
| Framework | Issued by | Who it applies to |
|---|---|---|
| Essential Cybersecurity Controls, ECC-2:2024 | National Cybersecurity Authority (NCA) | Government agencies, including their affiliated companies, and private entities that own, operate or host critical national infrastructure. Other entities are encouraged to use it voluntarily |
| Cybersecurity Controls for Private Sector Entities Not Operating Critical National Infrastructure, NCNICC-1:2025 | National Cybersecurity Authority (NCA) | Private-sector entities in Saudi Arabia that are not critical national infrastructure and are notified by the NCA, in two size categories |
| Cyber Security Framework | Saudi Central Bank (SAMA) | Financial institutions regulated by SAMA |
| Personal Data Protection Law (PDPL) | SDAIA is the competent authority | Organizations that process the personal data of individuals, with a grace period that ended on 14 September 2024 |
ECC-2:2024
ECC-2:2024 updates the 2018 version of the Essential Cybersecurity Controls. Each entity must comply with the controls that apply to it. For example, the cloud computing and hosting subdomain binds entities that use or plan to use cloud or hosting services. The NCA says it evaluates compliance through methods such as self-assessment, periodic compliance tool reports and field audits.
NCNICC-1:2025
This is the set of controls for private-sector entities that are not critical national infrastructure. It applies to entities the NCA notifies, and micro-entities, government entities and critical infrastructure operators are outside its definition of entity. Category A covers large entities, with more than 250 full-time employees or annual revenue above SAR 200 million. Category B covers small and medium entities, with 6 to 249 full-time employees or revenue between SAR 3 million and SAR 200 million.
The controls are organized around cybersecurity governance, cybersecurity defense, and third-party and cloud computing cybersecurity. Reporting cyber incidents to the NCA is mandatory for both categories, and some controls require an independent party, separate from the cybersecurity unit, to review and audit compliance. Category A entities have 65 mandatory main controls.
SAMA and the PDPL
Banks, insurers and other institutions supervised by SAMA follow SAMA's Cyber Security Framework, and the details sit with SAMA, so read it from the source. The PDPL covers personal data. It requires adequate technical and organizational measures to protect the confidentiality, integrity and availability of personal data, which is a natural fit with an ISMS but is not the same thing.
What ISO 27001 does and does not do for Saudi compliance
Two things are true at once. ISO/IEC 27001 is a strong base for meeting national requirements, and it is not a shortcut around them.
What it does not do
ECC-2:2024 does not reference ISO/IEC 27001. It sets its own controls, and the NCA assesses compliance with them itself. A certificate from a certification body does not replace that assessment, and no one should tell you otherwise. If a regulator or customer in your sector asks for ISO 27001 certification as well, that is a separate requirement you should confirm with them. Is ISO 27001 certification mandatory? explains how to think about that question.
What it does
The standard gives you the machinery that every one of these frameworks assumes you have. Clause 4 makes you define context and scope. Clause 6.1 requires a risk assessment and treatment process. Clause 7 covers competence, awareness and documented information. Clause 8 covers operation. Clause 9.2 requires internal audit and 9.3 requires management review. Clause 10 requires you to correct nonconformities and improve. Annex A then gives you organizational, people, physical and technological controls to select from.
| NCNICC-1:2025 component | Where it lands in ISO/IEC 27001:2022 |
|---|---|
| Cybersecurity governance | Clauses 4 and 5 (context, scope, leadership and policy), clause 6 (risk), clause 9.3 (management review), and the organizational controls in Annex A.5 |
| Cybersecurity defense | Operation under clause 8, and the people, physical and technological controls in Annex A.6, A.7 and A.8 |
| Third-party and cloud computing cybersecurity | Annex A.5.19 to A.5.23: supplier relationships, supplier agreements, the ICT supply chain, monitoring supplier services and the use of cloud services |
| Incident reporting to the NCA | Annex A.5.24 to A.5.28: incident management planning, assessment, response, learning and evidence. You add the NCA reporting step on top |
| Independent review and audit of compliance | Clause 9.2 internal audit, with auditors chosen for objectivity and impartiality |
This table shows themes, not an official mapping. The NCA documents do not publish a mapping to ISO 27001, so you build it for your own scope. That is a few days of careful work with the control texts in front of you, and it is the most valuable thing you can do before you write a single policy.
A practical route for a Saudi organization
- Work out which rules apply. Government, critical national infrastructure, a notified private entity, a SAMA-supervised institution, a processor of personal data, or several of these.
- Set the scope of the ISMS. Match it to the entity, systems and locations the regulator will assess, so one scope serves both.
- Run the risk assessment once. Record the Saudi requirements as inputs to treatment, not as a separate list.
- Build the Statement of Applicability and a control mapping. For each Saudi control, record which Annex A control or clause provides the evidence.
- Add the Saudi-specific obligations. Incident reporting to the NCA, personal data duties under the PDPL, and any sector rules.
- Audit internally and review. Use an independent, impartial auditor, then take the results to management review.
- Decide on certification. Choose an accredited certification body if customers or your own goals call for an ISO 27001 certificate. How to get ISO 27001 certification covers the path, and what it costs explains the cost drivers.
If you would rather have the system built for you, reconn's ISO 27001 implementation services cover gap assessment, documentation, control mapping and audit support.
Who in the organization needs training
An ISMS needs two kinds of skill, and the two PECB courses match them. The Lead Implementer course teaches you to plan, build and run the system, including the risk assessment, the Statement of Applicability and the controls. The Lead Auditor course teaches you to audit it, which matters in Saudi Arabia where several controls expect independent review. Lead Implementer vs Lead Auditor helps you choose, and what the Lead Implementer certification is and what the Lead Auditor certification is explain each credential.
Many Saudi teams train one person on each side, or one person on both with the Lead Implementer and Lead Auditor bundle. For people, not organizations, the credential matters too. ISO 27001 certification for individuals covers the levels.
Learning ISO 27001 with reconn in Saudi Arabia
The PECB courseware and exam are the same through any authorized partner. The difference is who supports you. With reconn, I answer your questions myself. I am a PECB Certified Trainer with more than 20 years in cybersecurity, and I work with organizations across the Gulf.
- A 1-on-1 session with a PECB Certified Trainer, included with self-paced eLearning.
- Unlimited email and WhatsApp support, directly with the trainer, until you clear the exam, within your 12-month enrollment window.
- A chance to ask how the standard applies to the NCA, SAMA or PDPL document you work under, so there is no guesswork. The PECB courseware teaches ISO/IEC 27001, and I help you connect it to your regulator.
- Arabic courseware is available. The eLearning videos and the trainer support are in English.
- ZATCA-compliant VAT invoices for individual and business buyers, corporate invoicing on request, and installments through Tabby or Tamara for qualified buyers.
- Dedicated team batches live online or in a classroom, including on site in Riyadh, Dammam, Khobar and Jeddah.
If you work across the region, ISO 27001 Lead Auditor and Lead Implementer courses in the Middle East compares the local frameworks in the other Gulf countries. Packages and prices are on the Lead Implementer and Lead Auditor course pages.
Frequently asked questions
Is ISO 27001 certification mandatory in Saudi Arabia?
The Saudi frameworks require you to implement their own controls rather than to hold an ISO 27001 certificate. ECC-2:2024 does not reference ISO/IEC 27001, and the NCA assesses compliance with its controls itself. A customer or sector regulator may still ask for ISO 27001 certification, so confirm with them.
Which NCA controls apply to a private company in Saudi Arabia?
Private entities that own, operate or host critical national infrastructure follow ECC-2:2024. Other private-sector entities that the NCA notifies follow NCNICC-1:2025, in Category A for large entities and Category B for small and medium entities.
What are the NCNICC-1:2025 categories?
Category A covers entities with more than 250 full-time employees or annual revenue above SAR 200 million. Category B covers entities with 6 to 249 full-time employees or revenue between SAR 3 million and SAR 200 million.
Does ISO 27001 certification prove compliance with the NCA controls?
No. The NCA assesses compliance with its own controls through methods such as self-assessment, compliance tool reports and field audits. ISO 27001 gives you a management system and evidence you can map to those controls, but it does not replace the NCA assessment.
Which framework applies to banks and insurers in Saudi Arabia?
Financial institutions regulated by the Saudi Central Bank follow SAMA's Cyber Security Framework. Read it from SAMA directly, and map its requirements to your ISMS.
When did the Saudi Personal Data Protection Law take effect?
The PDPL came into force on 14 September 2023, and organizations had a one-year grace period, with compliance expected by 14 September 2024, which the competent authority could extend. SDAIA is the competent authority.
Can I take the ISO 27001 Lead Implementer or Lead Auditor course in Saudi Arabia online?
Yes. Both PECB courses are available as self-paced eLearning anywhere in Saudi Arabia, and PECB proctors the exam online. With reconn, eLearning includes a 1-on-1 session with a PECB Certified Trainer and unlimited email and WhatsApp support until you clear the exam.
Does reconn issue ZATCA-compliant invoices?
Yes. reconn issues ZATCA-compliant VAT invoices for individual and business buyers in Saudi Arabia. For corporate invoicing, contact reconn by email or WhatsApp before placing the order.
Sources
- Essential Cybersecurity Controls (ECC-2:2024), National Cybersecurity Authority, Saudi Arabia
- Essential Cybersecurity Controls (ECC-2:2024), National Cybersecurity Authority
- Cybersecurity Controls for Private Sector Entities Not Operating Critical National Infrastructure (NCNICC-1:2025), National Cybersecurity Authority
- Cyber Security Framework, Saudi Central Bank
- Guide to the Saudi Personal Data Protection Law for controllers and processors, SDAIA
- ISO/IEC 27001:2022 Information security management systems, ISO
- ISO/IEC 27001 Lead Implementer course and exam, PECB