RIYADH — Saudi Arabia’s National Cybersecurity Authority (NCA) has published the official Schedule of Classification of Cybersecurity Violations and Corresponding Penalties, established pursuant to Paragraph 4 of Clause Fifth of the Authority’s Statutory Enablers issued under Royal Decree No. M/117 dated 21/6/1446 AH. The regulatory framework is designed to enforce statutory compliance and ensure the implementation of international best practices across the Kingdom’s national cyberspace.
Under the new schedule, regulated entities are categorized into four corporate tiers alongside individuals, aligning directly with enterprise size standards established by the Small and Medium Enterprises General Authority (Monsha’at), spanning micro enterprises (Category A), small enterprises (Category B), medium enterprises (Category C), and large enterprises (Category D). The Committee for Examining Cybersecurity Violations is empowered to elevate the severity classification of any violation from medium to high, doubling the maximum statutory fine ceiling whenever an infraction negatively impacts vital state interests, national security, critical national infrastructure, priority economic sectors, or government services. Conversely, the committee may downgrade violation severity when objective justifications exist, such as the absence of actual harm or demonstrated partial compliance, provided the reduced penalty does not fall below 50 percent of the baseline minimum fine.
Article Four of the regulatory document enumerates 26 distinct cybersecurity violations graded across medium and high severity levels. The steepest financial penalties target entities operating Tier 1 cybersecurity activities without an official NCA license, carrying fines for large enterprises ranging from SAR 5 million to SAR 25 million per unlicensed activity alongside potential service suspension, while unlicensed Tier 2 cybersecurity activities incur fines between SAR 2 million and SAR 10 million for large enterprises. High severity compliance failures carrying fines of up to SAR 5 million for large organizations include non compliance with the Essential Cybersecurity Controls, Data Cybersecurity Controls, Critical Systems Controls, Social Media Accounts Controls, Telework Controls, Cloud Computing Controls, Operational Technology (OT) Controls, the National Policy for Managed Security Operations Centers (MSOC), and the National Cybersecurity Risk Management Framework.
Additional high severity infractions include providing misleading cybersecurity data to the public, government entities, or the NCA, refusing to supply mandatory documentation or audit reports, obstructing regulatory inspectors, and selling, importing, exporting, manufacturing, or utilizing unauthorized cybersecurity hardware, software, or tools without required licensing and customs clearance, which carries fines of up to SAR 500,000 per category for large enterprises. Furthermore, failing to execute mandatory NCA security alerts, vulnerability patches, threat detection rules, indicators of compromise, and incident response directives within specified timeframes via the National Portal for Cybersecurity Services (Haseen) carries fines reaching SAR 5 million for large enterprises, while failing to immediately report actual or potential cyber breaches through the Haseen portal incurs fines of up to SAR 500,000. Non monetary sanctions include formal warnings for first time medium severity offenses without material impact, license suspension for up to one year, permanent license revocation, or operational shutdown.
Article Five establishes structured aggravating and mitigating calculation matrices to determine final penalty amounts. Repeat offenses committed within a two year window trigger progressive fine escalations of 50 percent for a second offense, 75 percent for a third offense, and 100 percent for a fourth offense, culminating in maximum statutory penalties and doubling for fifth and subsequent violations. Fines are further increased by up to 30 percent if the offending organization owns, operates, or hosts critical national infrastructure, and are doubled if the violator generated financial returns from the infraction. To incentivize proactive governance, the framework grants a 20 percent fine reduction for voluntary self reporting prior to NCA detection and a 30 percent reduction when an entity executes comprehensive corrective and remedial measures prior to formal committee proceedings.
