Organisations in Saudi Arabia rarely answer to a single logging rule. Depending on sector, a bank, a government entity or a cloud provider may need to satisfy the National Cybersecurity Authority (NCA), the Saudi Central Bank (SAMA), the Personal Data Protection Law (PDPL) and sector regulators at the same time. The good news: one well-engineered log architecture can satisfy all of them.
The frameworks that shape logging in KSA
- NCA Essential Cybersecurity Controls (ECC): the national baseline for government and critical national infrastructure, including event logging, monitoring and log retention.
- SAMA Cyber Security Framework (CSF): applies to banks, insurers, finance companies and payment providers.
- NCA Cloud Cybersecurity Controls (CCC): adds requirements for cloud service providers and tenants.
- Personal Data Protection Law (PDPL): governs how personal data is processed, including in logs.
- Communications, Space & Technology Commission (CST): sector requirements for telecom and ICT providers.
NCA ECC: what auditors look for
- Event logging enabled on critical systems, network devices and security controls.
- Continuous monitoring through a SIEM or SOC, with defined use cases.
- Privileged access logging, covering administrator sessions and changes.
- Online log retention of at least 12 months, with longer retention where sector rules require it.
- Protection of log integrity and restricted access to log data.
SAMA CSF for financial institutions
- Centralised log forwarding into a monitored SIEM.
- Real-time monitoring and alerting with documented escalation.
- Defined retention periods aligned to business and regulatory needs.
- Oversight of outsourced and cloud logging: third parties must provide timely access to the logs you need.
NCA CCC and data sovereignty
Cloud tenants need access to the security logs for their workloads, and those logs must flow into monitoring. For many classifications, log data must also be stored and processed inside the Kingdom, which affects where your pipeline, SIEM and archive run.
PDPL: logging personal data responsibly
- Keep records of who accessed personal data, when and why.
- Use logs to detect, scope and report personal data incidents.
- Minimise personal data in the logs themselves: mask or tokenise identifiers in the pipeline where full values aren't needed.
Common gaps we see in Saudi organisations
- Log sources never onboarded, especially applications, OT and cloud workloads.
- Detection rules that exist but have never fired or been tested.
- Retention shorter than required, or kept at SIEM prices.
- No verification of log integrity.
- No documented log management policy or annual review.
A compliant log architecture for KSA
- Full source coverage into a central SIEM: identity, network, endpoint, cloud, applications and OT/ICS.
- A security data pipeline to filter, normalize, enrich and mask before ingestion.
- Tiered storage: hot in the SIEM, warm in an in-Kingdom security data lake, cold in immutable archive.
- Integrity controls: hashing, write-once storage and access logging.
- Sovereignty by design: in-Kingdom cloud regions or on-premises storage for regulated data.
- A formal policy reviewed annually and mapped to ECC, SAMA CSF, CCC and PDPL.
Typical retention reference
| Log category | Typical minimum | Driven by |
|---|---|---|
| Security event logs (SIEM) | 12 months online, longer in archive | NCA ECC |
| Privileged access logs | 12 months | NCA ECC, SAMA CSF |
| Financial transaction logs | Multi-year, per SAMA rules | SAMA |
| Cloud workload logs | Aligned to the data's classification | NCA CCC |
| Personal data access logs | Duration of processing plus regulatory period | PDPL |
Always validate retention periods against the latest NCA, SAMA and sector guidance for your classification.
Frequently asked questions
Does Saudi Arabia require logs to stay inside the country?
For many government, critical infrastructure and regulated workloads, yes. NCA and sector rules expect sensitive data, including logs, to be stored and processed in the Kingdom. Design the pipeline and storage tiers with that in mind from day one.
How long must logs be retained under NCA ECC?
NCA ECC expects security event logs to be retained for at least 12 months, and sector regulators can require longer. A tiered architecture keeps that retention affordable.