Saudi Arabia: Closed consultation on Non-Critical National Infrastructure Private Sector Organizations Cybersecurity Controls

On 31 January 2024, the Communications, Space & Technology Commission of Saudi Arabia (CST) closed its consultation on the draft Non-Critical National Infrastructure Private Sector Organizations Cybersecurity Controls. These Controls outline the minimum cybersecurity standards for organizations that are not considered Critical National Infrastructure (CNI). The CNI Cybersecurity Controls is organised into three domains of cybersecurity governance, cybersecurity defence, and third party cybersecurity and sets out different controls in each. The goal is to help these organizations reduce cyber risks from internal and external threats by leveraging industry best practices.