Selling SaaS into Saudi Arabia? The Security Requirements Your Buyers Will Ask For: A vendor's guide from Sumrite.

Western and European SaaS companies often arrive in Saudi Arabia with SOC 2 or ISO 27001 and expect that to close the security review. It helps, but it is rarely enough. Saudi buyers answer to Saudi regulators, so their questionnaires ask about Saudi controls, Saudi data handling and, increasingly, where your people and systems sit.

This guide, current as of November 2026, sets out what Saudi buyers will ask for, where each requirement comes from and how to build an evidence pack that gets you through procurement.

Which Saudi security rules apply when you sell SaaS into Saudi Arabia?

The rules that apply depend mainly on who your buyer is. A foreign SaaS vendor is rarely regulated directly by the NCA; instead, Saudi buyers pass their own obligations down to you through contracts, questionnaires and audits.

Your Saudi buyer	Framework they flow down	What it means for you
Government entity or CNI operator	NCA ECC-2:2024, especially ECC 4-1	Contract clauses, risk assessment, policy alignment
Government or CNI buyer using your cloud service	NCA CCC-2:2024	You become a cloud service provider with your own control set
Bank, insurer or finance company	SAMA Cyber Security Framework, domain 3.4 Third Party Cyber Security	Vendor, outsourcing and cloud assurance
Any organisation handling personal data	PDPL and SDAIA regulations	Processor duties, transfers, breach support
Other private companies	NCA’s Non-CNI Private Sector Entities Cybersecurity Controls (NCNICC-1:2025), per Al Tamimi & Company	Lighter baseline, but buyers still ask for evidence

Two further checks are worth making early. If your product is itself a cybersecurity product or service, the NCA states on its registration and licensing page that registration is mandatory for entities offering cybersecurity products, solutions or services in the Kingdom, a requirement since 1 August 2022. And if you plan to host in Saudi Arabia, the Communications, Space and Technology Commission (CST) runs a cloud computing services provider registration with classes A to C; confirm with local counsel whether it applies to your model.

For the full NCA picture, read our NCA ECC compliance guide, and for financial buyers our SAMA Cyber Security Framework guide.

What does NCA ECC 4-1 require from third-party suppliers?

NCA ECC 4-1 (Third-Party Cybersecurity) requires Saudi entities to define cybersecurity requirements for supplier contracts and enforce them. For a SaaS vendor that means contract clauses on confidentiality and data deletion, incident communication, and a duty to follow the buyer’s cybersecurity policies and Saudi law.

We checked the numbering against the ECC-2:2024 document: ECC 4-1 is the Third-Party Cybersecurity subdomain inside Domain 4, Third-Party and Cloud Computing Cybersecurity, and ECC 4-2 covers cloud computing and hosting.

ECC 4-1-1

Cybersecurity requirements for third-party contracts and agreements are identified, documented and approved

ECC 4-1-2-1

Non-disclosure clauses and secure removal of the entity's data when the service ends

ECC 4-1-2-2

Communication procedures for cybersecurity incidents

ECC 4-1-2-3

The third party must follow the entity's cybersecurity requirements, policies and applicable laws

ECC 4-1-3-1

For outsourced IT, cybersecurity and managed services: a risk assessment before contracting

ECC 4-1-3-2

Managed service centres that monitor or operate through remote access must be located fully inside Saudi Arabia

ECC 4-1-4

Periodic review of third-party cybersecurity requirements

ECC 4-1-3-2 is the clause that surprises foreign vendors most. If your offering includes monitoring or operating the customer’s environment over remote access, such as managed detection, managed administration or a support team with standing access, expect the buyer to ask where that service centre sits. A pure multi-tenant SaaS product is a different model from a managed service, so document clearly which one you provide.

ECC 4-1-2-3 also means your incident process must fit theirs. Buyers will want named contacts, notification timelines and evidence that you will cooperate with their response. Our NCA ECC checklist lists every Domain 4 control a buyer will test you against.

Does NCA CCC apply to a SaaS company?

NCA CCC-2:2024 applies to a SaaS company when it provides cloud services to in-scope tenants: Saudi government entities (inside or outside the Kingdom), their companies and sub-entities, and private organisations that own, operate or host critical national infrastructure (CNI). In that case the SaaS company is a cloud service provider (CSP) under CCC and must meet both ECC and CCC.

The CCC-2:2024 document sets out what that involves:

• Control volume. CSPs have 37 main controls and 94 subcontrols; tenants have 18 main controls and 26 subcontrols. Provider controls carry a “P” in the reference (for example 1-3-P-1-1) and tenant controls a “T”.
• Data classification levels. Controls are mandatory or optional across four levels that map to top secret, secret, confidential and public data. Where data sets mix levels, the highest level applies.
• Penetration testing. Subcontrol 2-10-P-1-1 requires penetration tests that cover the cloud technology stack at least once every six months.
• Saudi staffing. Subcontrol 1-4-P-1-1 requires cybersecurity roles in CSP data centres within the Kingdom to be filled by qualified Saudi nationals.
• Access approval. Subcontrol 2-2-P-1-9 requires CSPs and their third parties to obtain the tenant’s approval before accessing tenant-related assets.
• Data localisation. CCC-2:2024 moved data localisation controls to the National Data Management Office (NDMO), so hosting location questions now go through NDMO rules and your buyer’s data classification.

CCC does not cover CSPs that serve only non-Saudi entities outside the Kingdom, or only individuals and private non-CNI companies with no in-scope tenants. The NCA still strongly encourages other organisations to use CCC as best practice, so many private Saudi buyers use it as their questionnaire baseline anyway. Our guide to NCA CCC testing requirements explains the provider and tenant split in detail.

How does the Saudi PDPL affect a foreign SaaS vendor?

The Saudi PDPL applies to any processing of personal data of people residing in Saudi Arabia, including processing by parties outside the Kingdom. SDAIA’s guide for controllers and processors states that entities abroad remain parties to the processing, and that data hosted on a foreign cloud is still subject to the PDPL.

Most SaaS vendors act as processors. That puts four practical demands on you:

1. Contractual compliance. SDAIA’s guide says a controller must ensure the processors it engages fully comply with the PDPL, so expect a data processing agreement and audit rights.
2. Security safeguards. The guide requires adequate technical and organisational measures to protect confidentiality, integrity and availability in transit and in storage.
3. Breach support. Under Article 24 of the Implementing Regulation, your customer must notify SDAIA within 72 hours of becoming aware of a qualifying breach, so your own notification to the customer has to be faster.
4. Transfers outside the Kingdom. Hosting or support access from outside Saudi Arabia is a transfer. SDAIA’s Standard Contractual Clauses (version 1.0, September 2024) include controller-to-processor and processor-to-processor modules.

European vendors will recognise much of this from GDPR, but the details differ. Watch the draft amendments too: law-firm analysis of SDAIA’s October 2026 draft Implementing Regulation changes reports a proposed express duty to store personal data inside the Kingdom. Our Saudi PDPL compliance guide and analysis of the 2026 Implementing Regulation amendments cover both.

What penetration testing evidence will Saudi buyers ask for?

Saudi buyers expect a recent, manual penetration test of your SaaS application and APIs, with a report showing scope, method and findings by severity, plus retest proof that serious findings are closed. An automated scan output or a self-declaration will not satisfy a buyer that must evidence ECC 4-1 and its own ECC 2-11 testing programme.

Tenant isolation deserves special attention. A Saudi government or CNI buyer will ask whether another customer could reach its data, and CCC expects CSPs to separate tenants. Test it directly with web application VAPT and API security testing, and check the cloud layer with a cloud security assessment.

Our pillar guide to penetration testing in Saudi Arabia explains how ECC 2-11 and SAMA testing work, and the sample VAPT report shows the level of detail buyers expect.

What does a Saudi vendor security questionnaire ask?

A Saudi vendor security questionnaire asks the same core questions as a European one, plus Saudi-specific questions on data location, staff access, incident timelines and NCA control mapping. Prepare a reusable answer and evidence for each.

Question you will be asked	Evidence that closes it
Where is customer data stored and processed?	Data flow diagram, hosting regions, sub-processor list
Who can access our data, and from where?	Access model, support locations, approval workflow
How will you notify us of an incident?	Incident response plan with contacts and timelines
Do you meet NCA ECC 4-1 contract requirements?	Contract clause mapping to ECC 4-1-2
Are you a CSP under NCA CCC?	Service model statement and CCC control mapping if in scope
How do you protect personal data under the PDPL?	DPA, transfer mechanism, security measures summary
When was your last penetration test?	Report or summary, plus retest evidence
What certifications do you hold?	ISO 27001 certificate or SOC 2 report, mapped to ECC

ISO 27001 covers much of what ECC asks, and a mapping saves you from answering each control from scratch; see our ISO 27001 to NCA ECC mapping. Our vendor risk and TPRM page explains how buyers tier vendors and what they expect in an evidence pack.

How should a SaaS vendor prepare before entering Saudi Arabia?

Prepare before the first tender: map your controls to ECC and CCC, settle your data residency and transfer position, and commission a penetration test that covers what Saudi buyers will ask about. Vendors who arrive with an evidence pack move through procurement far faster than those who start when the questionnaire lands.

If you are weighing the threat side of the market, our overview of cyber attacks in Saudi Arabia in 2026 shows what Saudi security teams are defending against, which shapes the questions they ask you.

How Sumrite helps

Sumrite runs penetration testing and compliance programmes for SaaS vendors entering Saudi Arabia end to end with our verified NCA-registered partner firm, and has served 100+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. We test your application, APIs, tenant isolation and cloud configuration manually, map findings to ECC and CCC control numbers, retest your fixes and help you assemble an evidence pack for Saudi questionnaires. Our Saudi Arabia page explains how to get a Sumrite VAPT report for Saudi reviews in 48 hours.