NCA and SAMA compliance: what Saudi enterprises actually need to do

Two regulators shape almost every security and cloud decision in Saudi Arabia: the National Cybersecurity Authority (NCA) and, for financial institutions, the Saudi Central Bank (SAMA). What each requires, how they fit together, and the practical steps to reach and prove compliance.

The NCA frameworks: ECC and CCC

Essential Cybersecurity Controls (ECC) are the NCA's baseline. They set the minimum cybersecurity requirements for in-scope national organisations across governance, defence, resilience, and third-party and cloud risk. If you operate critical or sensitive systems in the Kingdom, ECC is the floor — not the ceiling.

Cloud Cybersecurity Controls (CCC) extend the ECC specifically for the cloud. They define requirements for both cloud service providers and cloud tenants (your organisation, when you consume cloud), covering classification, data location, encryption, identity, monitoring, incident response, and exit. The CCC is why a lift-and-shift to the cloud in Saudi Arabia is never just a technical migration — the controls gate what can move, where it can be hosted, and how it must be protected. A compliant move usually pairs cloud migration with documented in-Kingdom hosting on Google Cloud.

Data residency is the control that catches teams out

Sensitive and government-classified data generally must be hosted inside the Kingdom, in accredited data centres, with no processing or transfer outside Saudi borders. Before you migrate a workload, you classify the data, confirm the hosting region and provider meet the controls, and document the decision. Getting this wrong is the most common reason a cloud project stalls in audit.

The SAMA Cybersecurity Framework (financial sector)

If you're a bank, insurer, fintech, or other SAMA-regulated entity, you also fall under the SAMA Cybersecurity Framework — a sector-specific, more prescriptive regime. Financial institutions typically must satisfy both NCA (ECC/CCC) and SAMA simultaneously, and SAMA adds stricter expectations in areas such as governance maturity, third-party risk, and prior approval for cloud hosting of financial data.

The practical takeaway: a fintech moving to the cloud in Saudi Arabia is solving for two overlapping frameworks at once. The fastest path is to map controls once, to a single evidence set, rather than running two parallel compliance programs.

How the frameworks fit together

Framework	Who it applies to	What it governs
NCA ECC	In-scope national organisations	Baseline cybersecurity controls (the minimum)
NCA CCC	Cloud providers and cloud tenants	Cloud-specific controls, data location, exit
SAMA CSF	SAMA-regulated financial entities	Sector framework — stricter, runs alongside NCA

A practical compliance path

1. Classify your data and systems — you can't apply controls until you know what's sensitive and where it lives.
2. Map controls once — to a single control set that satisfies ECC, CCC, and (if applicable) SAMA, so you collect evidence one time.
3. Fix the gaps — identity and privileged access, network segmentation and WAF, endpoint protection, logging and monitoring, backup and ransomware recovery, and a tested incident-response plan.
4. Choose compliant hosting — confirm region, residency, and provider controls before migrating anything.
5. Operate and prove it — continuous monitoring, documented runbooks, and audit-ready evidence on demand.

How Apex Aether helps

Apex Aether is a Saudi-based team that designs, secures, documents, and hands over technology built to these controls — Saudi-led, no black boxes. We align delivery to NCA and SAMA standards and bring the platforms the controls call for:

• Cloud & data residency — secure migration on Google Cloud with in-Kingdom hosting decisions documented.
• Identity & privileged access — CyberArk-based privileged access and identity controls.
• Network & perimeter — Fortinet next-gen firewall, Secure SD-WAN, and WAF.
• Endpoint — Kaspersky / EDR protection across servers, endpoints, and users.
• Backup & resilience — Veeam backup, ransomware recovery, and tested DR.
• Monitoring & operations — 24/7 monitoring and support, with everything documented and handed to your team.

Every engagement ends the way compliance auditors like: documented, validated, and owned by you. Scoping a migration or a compliance gap? Talk to an engineer →