Cybersecurity is the set of policies, procedures and technologies that protect a business’s systems, networks, devices and data from intrusion, disruption and tampering. In Saudi Arabia, the National Cybersecurity Authority (NCA) is the competent body in this field: it issues the controls and regulatory frameworks and follows up on compliance with them. For a business owner, the practical question is not only what cybersecurity means, but which requirements apply to the business and how to start applying them in a way that fits its size.
Why cybersecurity matters to small and medium-sized businesses
Some business owners believe cyberattacks only target large companies. In reality, smaller businesses can be an easier target because they are less prepared. A single incident can cause:
- Downtime in operating systems, sales and point-of-sale terminals.
- A leak of customer or employee data, and the legal liability that follows.
- Direct financial losses through fraud or forged money transfers.
- Reputational damage with customers and partners that is hard to repair.
- Setbacks in tenders and contracts where the client requires a certain level of protection.
With e-invoicing expanding through the FATOORA platform, growing reliance on digital government services and the spread of remote work, a business’s data and systems have become a core part of business continuity rather than a side issue for the technical team.
Who sets cybersecurity requirements in the Kingdom?
The National Cybersecurity Authority is the national reference for cybersecurity. It issues policies, controls, standards and guidance frameworks, follows up on compliance by the entities concerned, and raises awareness in the field. Alongside it, other bodies may set their own requirements for the sectors they supervise, including:
- The Saudi Central Bank (SAMA) for banks, finance companies, payment companies and other entities under its supervision.
- The Capital Market Authority (CMA) for persons licensed to operate in the capital market.
- The Insurance Authority for insurance companies and the professions linked to them.
- The Saudi Data and Artificial Intelligence Authority (SDAIA) on matters of personal data protection.
How binding the requirements are depends on the nature of the business. Government entities and organizations that operate sensitive national infrastructure are usually subject to stricter requirements, and this can extend to the service providers of those entities, depending on the contracts and the approved requirements. For other businesses, the controls remain a practical reference for best practice, and clients may make them a condition in contracts. To find out exactly what applies to your business, check what the National Cybersecurity Authority and your sector regulator publish.
Steps to build a cybersecurity program in your business
- Identify your assets: list the important systems, devices, applications and data, and find out where they are kept and who can access them.
- Assess the risks: identify the likely threats to each asset and their impact on the business, and rank your priorities by severity.
- Identify the requirements that apply: find out whether the business is subject to mandatory controls from the National Cybersecurity Authority or from its sector regulator, or to contractual requirements from its clients.
- Adopt policies: write clear policies on acceptable use, passwords, access rights, backups and incident handling, and have management approve them.
- Apply technical controls: such as multi-factor authentication, regular system updates, anti-malware software, encryption of sensitive data and segregation of access rights.
- Train employees: build awareness of phishing and social engineering, because many incidents start with a simple human mistake.
- Prepare for incidents: draw up a response plan that sets out who is notified, how infected systems are isolated and how data is restored from backups.
- Review regularly: measure compliance, test the controls and update them whenever the systems, the risks or the requirements change.
What a business usually needs
- A clearly named person responsible for cybersecurity within the business, or a qualified external provider if that is not available in-house.
- An up-to-date register of technology assets, data and their owners.
- A policies and procedures document approved by senior management.
- Contracts with technology service providers that include clear clauses on data protection and incident reporting.
- Regular, tested backups that are kept away from the main systems.
- An ongoing awareness program for employees, rather than a single session at hiring.
- A short internal reporting guide, so that every employee knows what to do if they suspect a message, a device or unusual behavior.
Common cybersecurity mistakes in companies
- Treating it as the IT department’s job alone: cybersecurity is a management decision that needs management support, a budget and follow-up.
- Buying tools without policies: hardware and software are not enough if access rights, procedures and each person’s responsibility are not defined.
- Sharing accounts and passwords: especially for government and banking platforms, which makes it hard to trace who is responsible.
- Neglecting the access of departing employees: accounts that stay active after the employment relationship has ended.
- Untested backups: discovering that the backup does not work in the middle of the incident itself.
- Confusing compliance with protection: having the required documents in place does not necessarily mean the systems are actually protected.
How to stay compliant over time
Meeting cybersecurity requirements is not a project that ends on a set date. It is an ongoing cycle. Set an internal schedule to review policies, test backups, review access rights and update the risk register, and follow the updates published by the National Cybersecurity Authority and your sector regulator.
If your business collects personal data about customers or employees, also review the personal data protection requirements overseen by SDAIA. Cybersecurity and data protection go hand in hand in many cases: the first protects systems and data from intrusion, while the second sets out how data is collected, used and stored, and who is entitled to see it. Innovant’s team can help assess the requirements that apply to your business and organize the related governance documents and policies.
