Non-CNI Private Sector Entities Cybersecurity Controls (NCNICC – 1 : 2025) Cybersecurity Management

Secure senior management's support for managing and implementing the entity's cybersecurity programs.

1-1-1

[A: M | B: R] An administrative unit responsible for cybersecurity must be established within the entity, reporting to the head of the entity or their delegate, and independent of the IT unit.
1-1-2

[A: M | B: R] The head of the cybersecurity function and its supervisory and critical positions must be filled by full-time Saudi nationals who are highly qualified in cybersecurity.
1-1-3

[A: M | B: R] The authorizing official must define, document and approve the entity's cybersecurity governance organizational structure, roles and responsibilities, assign the relevant personnel, and provide the support needed to enforce this, taking conflict of interest into account.

Need help putting this into practice? See our NCA NCNICC compliance services.

See LakeRidge in action.

Talk with our team about your framework, your gaps, and the right plan.