In brief: On 30 October 2026, Saudi Arabia’s National Cybersecurity Authority (NCA) published its “Table of Classification of Cybersecurity Violations and Corresponding Penalties”. The table lists 26 violations rated “high” or “medium”. Fines scale with company size under the Monsha’at classification, and the highest ceiling is SAR 25 million. The list includes failing to comply with the NCA’s cybersecurity controls for private-sector entities and failing to report breaches immediately through the “Haseen” portal.
What did the NCA publish?
The NCA said the document is based on its regulatory enablers issued by Royal Decree No. (M/117) dated 21/6/1446 AH. It sets violations and penalties according to the size, nature, repetition and seriousness of each violation, with criteria for aggravating and mitigating circumstances. Argaam reported that the NCA board approved the table and that it covers 26 violations.
How are companies classified?
Article 2 classifies entities using the criteria of the Small and Medium Enterprises General Authority (Monsha’at):
- Category A: micro.
- Category B: small.
- Category C: medium.
- Category D: large.
Examples of violations and fines
| Violation | Severity | Micro | Small | Medium | Large |
|---|---|---|---|---|---|
| Practising a level-one cybersecurity activity without an NCA licence | High | 50K – 500K | 100K – 1M | 1M – 5M | 5M – 25M |
| Not complying with the cybersecurity controls for private-sector entities (non-critical-infrastructure) | High | 15K – 60K | 30K – 100K | 200K – 1M | 1M – 5M |
| Not immediately reporting a threat, risk or breach via the national “Haseen” portal | Medium | 10K – 30K | 15K – 50K | 50K – 100K | 100K – 500K |
Amounts are in Saudi riyals as stated in the document. The table also covers non-compliance with the Essential Cybersecurity Controls, the data controls, the cloud computing controls and the telework controls, as well as obstructing or not cooperating with inspectors.
Repeat violations cost more
Under Article 5, repetition is counted within two years of the same violation:
- Second time: +50% on the last fine.
- Third time: +75%.
- Fourth time: +100%.
- Fifth time and beyond: the maximum fine applies, then doubles for later repeats.
For a first violation, outside the cases where a warning applies, the minimum fine is applied. In all cases the fine cannot exceed the ceiling set in the regulatory enablers.
What does this mean for your system?
Your ERP holds your most important data: invoices, customers, payroll and inventory. That makes it a core part of any cybersecurity compliance review. Start with three questions: who has access to each screen, where is the database stored, and who is responsible for reporting a breach?
With RivDesktop, the system runs on your own server, so data stays in your environment and under your policies. Riv-ERP Cloud runs in the browser on Oracle Cloud. In both, each user’s permissions are set by role. Read also: ERP user permissions and financial control, Oracle Cloud in Saudi Arabia and data residency and .NET 8 and .NET 9 end of support.
This article is for awareness only. Read the official document or consult a specialist to confirm which requirements apply to your company.
Sources
See Riv-ERP in action
Two editions: RivDesktop on your own server, or Riv-ERP Cloud on Oracle Cloud.
Book a demo
