NCA Cybersecurity Penalties Explained: 2026 Violations and Fines

Imagine receiving a cybersecurity alert through Haseen on a Thursday evening. Your team sees it, but no one takes action until Sunday. By then, the deadline has passed, and your organization may have committed a regulatory violation.

This is no longer just a matter of operational oversight. Under Saudi Arabia’s new cybersecurity violations and penalties table, failing to meet NCA requirements can result in significant financial penalties, with some violations carrying fines of up to SAR 25 million.

On October 30, 2026, the National Cybersecurity Authority (NCA) published its Table of Classification of Cybersecurity Violations and Corresponding Penalties. The document outlines 26 violations, their severity classifications, and the penalties that may apply. It also explains how factors such as company size, repeated violations, and corrective action can affect the final penalty.

For businesses operating in Saudi Arabia, understanding these requirements is essential. Here is what the new table means and what organizations should do to stay compliant.

What Are the New NCA Cybersecurity Penalties?

The new table establishes a clearer framework for classifying cybersecurity violations and determining the corresponding penalties.

It was issued under the regulatory powers granted to the NCA by Royal Decree No. (M/117), dated 21/6/1446 AH. According to the document, penalties are determined based on several factors, including:

• The nature and severity of the violation.
• The size of the organization.
• Whether the same violation has occurred before.
• Any aggravating or mitigating circumstances surrounding the violation.

The table covers 26 cybersecurity violations, classified as either medium or high severity. It also distinguishes between penalties for individuals and those for legal entities, such as companies, institutions, and service providers.

Importantly, the financial penalties are not the only possible consequence. Depending on the violation, other measures may include warnings, suspension or cancellation of licences, and suspension of the relevant service or activity.

Who Is Affected by the New Penalties?

The NCA uses the size classifications adopted by the Small and Medium Enterprises General Authority (Monsha'at) to determine the applicable penalty range for organizations.

The four categories are:

• Category A: Micro enterprises.
• Category B: Small enterprises.
• Category C: Medium enterprises.
• Category D: Large enterprises.

This classification matters because the same violation can carry significantly different financial penalties depending on the organization's size.

For example, failing to comply with the Essential Cybersecurity Controls (ECC) is classified as a high-severity violation. The corresponding fines for legal entities are:

The difference is substantial. A violation that results in a fine of up to SAR 60,000 for a micro enterprise could reach SAR 5 million for a large organization.

4 Key NCA Cybersecurity Violations Businesses Should Know

The 26 violations cover several areas of cybersecurity compliance, from failing to implement required controls to not cooperating with regulatory inspections.

Here are some of the areas organizations should pay particular attention to.

1. Failure to Comply with NCA Cybersecurity Controls

Organizations are expected to implement the cybersecurity controls and requirements applicable to them. The table identifies non-compliance with different NCA frameworks and controls as a high-severity violation.

These include requirements relating to:

• Essential Cybersecurity Controls (ECC).
• Cloud Cybersecurity Controls (CCC).
• Data Cybersecurity Controls (DCC).
• Telework Cybersecurity Controls (TCC).
• Non-CNI Private Sector Entities Cybersecurity Controls (NCNICC)
• Other applicable NCA cybersecurity requirements.

For organizations subject to multiple frameworks, compliance must be managed across all applicable requirements. Having policies in place is not enough; businesses need to demonstrate that the required controls are implemented and maintained.

2. Failure to Act on NCA Alerts and Requirements

Receiving an alert from the NCA is only the first step. Organizations must also take the required action within the deadlines specified by the Authority.

The table covers failure to implement NCA decisions, procedures, and cybersecurity measures within the required timeframe. This includes actions related to cybersecurity alerts, vulnerabilities, detection rules, indicators of compromise (IOCs), and incident response activities.

This is classified as a high-severity violation. For large organizations, the fine can range from SAR 1 million to SAR 5 million.

The practical implication is clear: organizations need a defined process for receiving, assessing, assigning, and resolving NCA requirements. Delayed responses or missed deadlines can become regulatory issues, not simply internal operational gaps.

3. Failure to Report Cybersecurity Risks and Incidents

Organizations must notify the NCA immediately and directly of any actual or potential cybersecurity risk, threat, or incident through the Haseen portal or another channel specified by the Authority.

The table classifies failure to provide this notification as a medium-severity violation.

The corresponding fines for legal entities are:

This requirement makes incident reporting an important part of cybersecurity readiness. Organizations should know who is responsible for escalating incidents, what information must be collected, and how notifications are submitted without unnecessary delays.

4. Misleading Information and Obstructing NCA Inspections

The table also addresses violations related to an organization's cooperation with the NCA.

These include providing misleading information, failing to provide information requested by the Authority, obstructing inspectors, and failing to cooperate during regulatory inspections.

The table lists these as separate violations, with their own classifications and corresponding penalties.

This means compliance is not limited to technical security measures. Organizations must also maintain accurate records, respond to regulatory requests, and ensure that relevant teams can support inspections and provide the required information.

How One Mistake Becomes a Multi-Million Riyal Fine

A first offence starts at the bottom of the applicable fine range, unless the committee determines otherwise. A first-time, medium-severity violation with no material impact may even result in a warning. But repeat the same violation, and the penalty can climb quickly.

Here is how the NCA's aggravating factors work:

• Repeat the same violation within two years: The second offence adds 50% to the last fine. The third adds 75%, and the fourth adds 100%. For the fifth offence, the maximum fine applies; subsequent offences can be doubled.
• Own, operate, or host sensitive critical infrastructure: The fine can increase by up to 30%.
• Gain financially from the violation: The fine can be doubled after other applicable aggravating factors are calculated.
• Affect national security or critical services: The committee can raise a medium-severity violation to high severity or double the maximum fine for a high-severity violation, subject to the statutory maximum.

Consider this example: A large company operating sensitive critical infrastructure fails the same ECC requirement twice within 18 months.

If the organization also gained financially from the violation, and the committee applied the financial-gain aggravating factor, the fine could double to SAR 3.9 million.

These calculations illustrate how the aggravating factors can compound. The actual penalty depends on the committee's assessment and the applicable statutory limits.

Can Organizations Reduce Their Fines?

The table also recognizes circumstances that may reduce the final penalty:

• Voluntary self-reporting: Reporting the violation before the NCA discovers it, while providing the required information, can reduce the fine by 20% after aggravating factors are calculated.
• Corrective action: Taking the necessary corrective and remedial measures before appearing before the committee can reduce the fine by 30%, also after aggravating factors are calculated.

These reductions are subject to the conditions set out in the table and should not be treated as guaranteed outcomes. Still, they reinforce the importance of identifying issues early, reporting them appropriately, and taking corrective action without delay.

What Should Businesses Do to Avoid NCA Penalties?

Understanding the penalties is important, but preventing violations requires organizations to take a proactive approach to cybersecurity compliance.

Here are three practical steps to start with:

1. Assess Your Compliance Status

Identify which NCA frameworks and controls apply to your organization. Conduct a gap assessment to identify missing controls, outdated policies, and requirements that have not been fully implemented.

2. Establish Clear Incident and Alert Response Processes

Make sure your teams know how to handle NCA alerts, vulnerabilities, and cybersecurity incidents. Define responsibilities, escalation procedures, reporting channels, and deadlines. Every requirement should have a clear owner and a way to track its completion.

3. Maintain Continuous Visibility and Evidence

Compliance is not a one-time exercise. Organizations need ongoing visibility into their assets, vulnerabilities, security events, and incidents. They should also maintain records showing that required controls are operating and that alerts and remediation activities are being handled appropriately.

Make Cybersecurity Compliance an Ongoing Process with COGNNA

Meeting NCA requirements takes more than documented policies and periodic assessments. It requires continuous monitoring, timely threat detection, effective incident response, and the ability to demonstrate that cybersecurity measures are working.

COGNNA Smart MDR combines its Nexus Agentic AI SOC platform with 24/7 security expertise from human Guardians to help organizations monitor their environments, detect and investigate threats, and coordinate response activities.

As an NCA Tier 2 certified Managed Security Operations Center (MSOC), COGNNA supports organizations in strengthening their security operations and maintaining better visibility into their cybersecurity posture.

With the right processes, technology, and security expertise in place, organizations can move beyond reactive compliance and build a stronger foundation for managing cyber risk.

Ready to strengthen your cybersecurity posture and prepare for NCA requirements?