On 1 October 2026, Saudi Arabia's National Cybersecurity Authority (NCA) launched the sixth edition of its National Cybersecurity Awareness Campaign, timed to Cybersecurity Awareness Month. According to the NCA's news listing, it includes a toolkit for more than 2,500 national entities, public and mobile exhibitions, and a "Guard your Cyberspace" initiative. The fifth edition, in 2025, reached about 1,500 entities. One caveat applies throughout: the NCA's website was unreachable when we tried to fetch it, and we found no independent coverage of the launch. Everything below about the campaign rests on the NCA's own listing.
The case for the NCA's approach
The strongest argument for state-led cybersecurity policy is that security failures are an externality. A small supplier with weak passwords or no backups can become the entry point into a larger network, and the cost lands on others. Individual firms underinvest because they do not bear the full loss. A national regulator that sets a floor, and a public campaign that explains it, addresses a real market failure. Saudi Arabia is also digitising quickly, so the cost of low baseline hygiene grows every year.
On that view, the campaign is the cheap, low-friction part of the strategy. Teaching staff about phishing, two-factor authentication and backups imposes no compliance burden and restricts no speech. It is the kind of intervention a pro-innovation analyst should welcome.
Awareness is the easy half
The campaign matters mainly because of what runs alongside it. On 28 December 2025 the NCA adopted the Non-CNI Private Sector Entities Cybersecurity Controls (NCNICC-1:2025), according to the Digital Policy Alert tracker. These controls apply to private-sector entities that do not operate critical national infrastructure. The NCA's older frameworks, such as its Essential Cybersecurity Controls, were aimed at government bodies and critical infrastructure operators.
According to CMS, the framework is tiered by size:
- Category A (large entities): more than 250 full-time employees or annual revenue above SAR 200 million. These face 3 components, 22 sub-components and 65 essential controls.
- Category B (SMEs): 6 to 249 employees or revenue between SAR 3 million and SAR 200 million. These face 13 sub-components and 26 essential controls, with some marked "recommended" rather than mandatory.
Tiering is a sensible design choice. A six-person firm and a listed conglomerate should not carry the same governance burden, and the lighter SME track focuses on technical basics. The move from persuasion to mandatory controls for ordinary businesses is nonetheless a significant change in the compliance perimeter.
Where the open questions are
Several details that determine whether this helps or burdens businesses are not public in the sources we could reach.
First, timing and scope. Baker McKenzie reports that the controls apply to entities "as notified by the Authority" and that the NCA had not publicly confirmed any individual notifications when the firm wrote. Neither it nor CMS states a compliance deadline or a penalty regime. A mandatory regime with no published deadline and no stated penalties gives firms little to plan against. A small business cannot tell whether it is in scope, when it must comply, or what non-compliance costs.
Second, discretion. Both law-firm summaries say the NCA may impose additional or more advanced controls at its discretion, including on higher-risk sectors. Flexibility helps when threats change quickly. But open-ended authority with no published criteria creates regulatory uncertainty, which falls hardest on smaller firms without in-house compliance staff.
Third, the link to data protection. CMS notes that under the Personal Data Protection Law, overseen by SDAIA, regulators consider whether appropriate safeguards, including those in the controls, were in place after a breach. That turns a technical baseline into a liability benchmark. It raises the stakes of the standard, which is a further reason its application should be predictable.
What would make this work
The evidence we have is thin, and we should say so. The campaign's reach figures come from the NCA itself. The change from about 1,500 to more than 2,500 entities measures distribution of a toolkit, not behaviour change. We found no published data on whether past campaigns reduced phishing success, incidents or breach costs. Awareness spending is only worth defending if it is measured against outcomes.
A proportionate path is available:
- Publish the notification criteria and compliance timelines for NCNICC-1:2025, so firms can plan.
- Keep the SME track light and make guidance practical, including templates and free self-assessment tools.
- Publish outcome metrics for the awareness campaign, such as incident-reporting trends and survey-measured behaviour.
- Favour supervisory engagement and remediation over penalties in the first years, so firms report incidents and do not hide them.
Saudi Arabia is right to treat cybersecurity as national economic infrastructure, and a baseline for non-critical firms fills a real gap. But a baseline is only a pro-innovation policy if businesses can know their obligations in advance. The awareness campaign is the visible part of the policy. How and when the controls are enforced will decide whether it builds trust or adds uncertainty.