What is security policy management?
In short: Security policy management is the lifecycle for writing, approving, publishing, enforcing and reviewing an organisation's cybersecurity and information security policies. Saudi frameworks make it mandatory: NCA ECC-2:2024 includes a Cybersecurity Policies and Procedures subdomain in its Governance domain, and the SAMA Cyber Security Framework's Leadership and Governance domain requires an approved cyber security policy. Under both, policies must be documented, approved, communicated to staff and reviewed periodically.
Information security governance in Saudi Arabia
Policies are one part of a wider governance structure that both Saudi frameworks place first. Under the SAMA Cyber Security Framework, the Cyber Security Leadership and Governance domain covers board-level ownership, strategy, policy, roles and awareness, and SAMA expects an independent cyber security function. Under NCA ECC-2:2024, the Cybersecurity Governance domain covers strategy, management, policies and procedures, roles, risk management, compliance and periodic review.
ECC-2:2024 also strengthened Saudization: all cybersecurity positions must be filled by full-time, qualified Saudi professionals, not only senior roles as under ECC-1:2018.
Leadership and ownership
A board-approved mandate, a senior owner (typically the CISO) and a cyber security function independent of IT operations.
Strategy
A documented cybersecurity strategy aligned with the organisation's objectives and regulatory obligations.
Policies and procedures
An approved policy set, supporting standards and procedures, communicated to every employee and relevant third party.
Review and assurance
Periodic review of policies and controls, plus independent review and audit of compliance.
The security policy lifecycle
- 1
Identify requirements
List the obligations each policy must satisfy — NCA ECC, SAMA CSF, PDPL, sector rules — and map each requirement to a policy statement.
- 2
Draft from a standard structure
Use a consistent template (purpose, scope, roles, policy statements, compliance, review). The NCA publishes cybersecurity toolkits that help entities draft documents aligned with its controls.
- 3
Review and approve
Route drafts through legal, risk and business owners, then formal approval at the level your framework requires. An unapproved policy will not pass a SAMA Level 3 assessment.
- 4
Publish and collect attestations
Publish in one repository, communicate to staff and collect acknowledgements so you can prove people have read the current version.
- 5
Enforce and monitor
Link each policy to the technical and procedural controls that enforce it, and track exceptions with expiry dates and approvals.
- 6
Review and update
Review periodically and whenever regulations, technology or threats change, keeping a full version history.
Core cybersecurity policies Saudi regulators expect
Exact titles vary, but an ECC- or SAMA-aligned policy set typically covers:
- An overarching cybersecurity policy approved by senior leadership
- Identity and access management, including privileged access and multi-factor authentication
- Asset management and information classification
- Acceptable use of information and technology assets
- Data protection and privacy, aligned with the PDPL
- Vulnerability and patch management
- Event logging, monitoring and incident management
- Third-party and cloud computing security — see third-party risk management
- Cybersecurity resilience and business continuity
- Cybersecurity awareness and training
Security policy management checklist
- Map every NCA ECC and SAMA CSF policy requirement to a named policy and owner.
- Use one template and one repository for all policies, standards and procedures.
- Obtain formal approval at the level your framework requires, and record it.
- Collect employee acknowledgements for each new or updated policy.
- Link policies to the controls that enforce them and log approved exceptions.
- Review every policy periodically and after regulatory or significant technology change.
- Keep a complete version history as evidence for regulators and auditors.
Frequently asked questions
Does NCA ECC require written cybersecurity policies?
Yes. ECC-2:2024's Governance domain includes a Cybersecurity Policies and Procedures subdomain: in-scope entities must define, document, approve and communicate cybersecurity policies and procedures and keep them under review.
What does SAMA require for cyber security policy?
The SAMA Cyber Security Framework's Leadership and Governance domain requires a cyber security policy approved at senior level, supported by standards and procedures, communicated to staff and reviewed periodically. Policies must be formally approved to reach the Level 3 maturity SAMA expects.
What is information security governance?
Information security governance is the leadership, structures and processes that direct and oversee an organisation's security: who is accountable, what the strategy is, which policies apply, and how compliance and performance are reviewed.
How often should security policies be reviewed?
Review policies periodically at planned intervals and whenever regulations, technology or the threat landscape change. An annual review cycle is common practice.
Do cybersecurity roles have to be held by Saudi nationals?
Under NCA ECC-2:2024, cybersecurity positions must be filled by full-time, qualified Saudi professionals — an expansion from ECC-1:2018, which applied the requirement to senior roles.
How does Siraaj manage security policies?
Siraaj's policy and procedure lifecycle provides a policy repository, review and approval workflows, employee attestations and version history, and its regulatory compliance library links each policy to the NCA, SAMA and PDPL obligations it satisfies.
Sources
The official texts and expert commentary this page is based on. Always confirm requirements against the current version published by the regulator.
- Essential Cybersecurity Controls (ECC-2:2024) — National Cybersecurity Authority (NCA)
- Guide to Essential Cybersecurity Controls (ECC) Implementation — National Cybersecurity Authority (NCA)
- Regulatory documents (controls, frameworks and toolkits) — National Cybersecurity Authority (NCA)
- Cyber Security Framework (v1.0) — Saudi Central Bank (SAMA)
- Saudi Arabia's Essential Cybersecurity Controls 2024 (ECC-2): key updates — Clyde & Co
Related guides
Approved, attested and audit-ready policies
Run the full policy lifecycle in Siraaj GRC — drafting, approval workflows, employee attestations and version history — linked to the NCA, SAMA and PDPL requirements each policy satisfies.