Who is responsible for meeting NCA cybersecurity requirements? Many people would say “the CISO.” The CISO leads cybersecurity, so this answer may seem obvious. In reality, the responsibility is shared. Here is why.
The CISO sets direction, advises management, and coordinates the work. Leadership, cybersecurity, IT, business teams, system owners, HR, procurement, legal, and audit all have roles. One person cannot implement every control and independently audit the result.
Two NCA documents explain different parts of the work
The Saudi Cybersecurity Workforce Framework, or SCyWF, describes cybersecurity work and the people who do it. It covers job roles, tasks, knowledge, and skills.
The Essential Cybersecurity Controls, or ECC 2:2024, focus on the organization. They describe the cybersecurity measures it needs to put in place and maintain.
ECC 2:2024 applies to Saudi government agencies and their affiliated entities. It also applies to private organizations that own, operate, or host Critical National Infrastructure. Other organizations in Saudi Arabia are strongly encouraged to use these controls as cybersecurity best practices.
Before assigning responsibilities, an organization needs to know which NCA requirements apply to it. This can be harder when it must also meet requirements from SAMA, CST, SDAIA, or a regulator for its industry. Our article on navigating Saudi cybersecurity compliance across multiple frameworks explains this challenge in more detail.
How the NCA describes the CISO role
In the SCyWF, Chief Information Security Officer/Director is listed as role LWD-L-001.
The framework describes the CISO as the person who leads cybersecurity work and sets its vision and direction. The CISO oversees cybersecurity strategies, resources, and activities. They also advise leadership on how to manage cyber risks effectively.
A CISO needs to understand the security program and explain it to people outside the security team. Leadership needs to know which risks could affect the business, where investment is needed, and which decisions are urgent. IT and business teams need to know how to apply the cybersecurity strategy in their daily work.
Organizations can adapt the SCyWF to their size and structure. A large government entity may have separate governance, risk, architecture, operations, and compliance teams. A smaller company may rely more on IT or external specialists. In each case, responsibilities must be clear.
Why one person cannot manage all NCA compliance work
ECC control 1-4-1 requires the Authorized Official to identify, document, and approve the organization’s cybersecurity governance structure, roles, and responsibilities. The organization then needs to assign people to these roles and give them the support they need.
Consider a typical access request. An employee needs access to a business application. Their manager confirms why they need it. The application owner decides which permissions to give them. IT creates or updates the account. The cybersecurity team sets the access requirements and checks that the process follows policy. If the employee changes roles or leaves the company, HR may start the process to review or remove access.
At the CISO level, the task is to set a consistent approach to access management across the organization. The CISO may define the direction, help assign ownership, or initiate a project to align access and authentication policies across teams. The CISO does not review every request personally. IAM, IT, security teams, and system owners usually design and run the day-to-day process. Clear governance helps prevent access from being granted without approval, remaining active too long, or becoming difficult to trace during an assessment.
What CISO responsibilities look like in practice
In practice, the CISO’s work can be grouped into four main responsibilities: setting the cybersecurity strategy, defining governance and decision-making, reporting to senior management, and building a strong cybersecurity culture.
Strategy
Strategy is a core CISO responsibility. ECC subdomain 1-1 requires organizations to develop, document, approve, implement, and review a cybersecurity strategy. The CISO connects that strategy with business goals, critical assets, risks, resources, and technology so it guides daily work.
Governance and decision-making
The CISO also helps define how cybersecurity decisions are made. People need to know who can approve an exception to a security rule, who can accept a risk, when to raise an issue with senior management, and which department should resolve it. The CISO may help design these processes, but does not have to make every decision.
Reporting to senior management
Reporting turns technical issues into decisions. Senior management needs to know the business impact, urgency, options, consequences of delay, who is responsible, and where support is needed.
Cybersecurity culture and awareness
Cybersecurity leadership also involves helping employees understand what they need to do. Policies and dashboards alone are not enough: people need to apply the controls in their work. Our article on cybersecurity awareness and CISO leadership explores this part of the role.
Identity and access management is a governance responsibility
Governance becomes practical when an organization applies it to identity and access management. Saudi cybersecurity frameworks commonly treat IAM as a full area of requirements rather than a single control. It covers how users are identified, authenticated, granted access, monitored, reviewed, and removed.
ECC subdomain 2-2 is one example. It covers MFA for remote access and privileged accounts, least privilege, segregation of duties, privileged access management, and regular reviews of identities and access rights. The ECC Implementation Guide also addresses approvals, privileged account monitoring, and evidence that the controls are working.
At the governance level, the CISO helps align access and authentication policies across business units and systems, define clear ownership, and make sure teams have the tools they need for secure and convenient access. IAM, IT, security teams, and system owners then design and run the day-to-day processes.
Use access management to test your cybersecurity processes
To test how well this model works, choose one critical system and follow the access lifecycle from request to removal:
- How is access requested, approved, and granted?
- Do authentication methods and permissions match the user, system, and risk?
- Can privileged activity be monitored and linked to a specific person?
- Are access rights reviewed when a user changes roles?
- Is access removed promptly, and can the organization show evidence of each step?
Gaps become visible quickly. MFA may be available but not required consistently. Privileged sessions may be recorded but not reviewed. Access may be removed when an employee leaves, while role changes are handled inconsistently. These are governance gaps, not only technical gaps.
Our guide to MFA and strong authentication in Saudi Arabia explains more about choosing appropriate authentication methods for different access scenarios.
How Axidian can help
Axidian Privilege helps security teams manage and monitor access to critical systems. It allows teams to control administrative credentials centrally and record privileged sessions as text logs, video, or screenshots. Teams can then see more clearly who accessed a system and what happened during the session.
Axidian Access helps organizations verify users’ identities. It centralizes authentication policies and applies reliable authentication methods, including MFA, based on the user, system, and level of risk. This gives each access scenario the right level of protection without relying on passwords everywhere.
Frequently asked questions
What is the role of a CISO according to the NCA?
The Saudi Cybersecurity Workforce Framework describes the CISO as the person who leads cybersecurity work and sets its vision and direction. The CISO oversees cybersecurity strategies and resources, and advises leadership on managing cyber risks.
Is the CISO responsible for every NCA control?
Not necessarily. The CISO does not implement every control personally, but the organization may still make the CISO ultimately accountable for cybersecurity compliance. It may appoint a compliance project manager or a cybersecurity committee to coordinate the program and track whether every control is addressed. Each control still needs an operational owner. If a control is missed, the CISO may remain accountable even when another manager was responsible for implementation. These responsibilities should be documented, approved, and periodically reviewed.
What is the difference between ECC and SCyWF?
The Essential Cybersecurity Controls (ECC 2:2024) describe the cybersecurity controls an organization needs to implement. The Saudi Cybersecurity Workforce Framework (SCyWF) describes cybersecurity job roles and the tasks, knowledge, skills, and competencies associated with each role.
Which ECC controls address privileged access and MFA?
ECC subdomain 2-2 on identity and access management covers both. Controls inside this subdomain include MFA for remote access and privileged accounts, privileged access management, rules for granting permissions, and regular access reviews.
Can PAM and MFA make an organization fully compliant with NCA requirements on Identity and Access Management?
Privileged access management (PAM) and multi-factor authentication (MFA) can meet key technical controls in the Identity and Access Management subdomain. But deploying these products alone is not enough for full IAM compliance. The organization also needs documented access policies, clear ownership and operating procedures, periodic reviews of the policies and access settings, and evidence that the controls are implemented and working as intended.
Regulatory note: This article provides general information. It is not legal or compliance advice. Always check the latest NCA documents. If there are differences in how the ECC 2:2024 controls are interpreted, use the Arabic version as the official reference.
