The National Cybersecurity Authority's Essential Cybersecurity Controls framework establishes a clear obligation for entities to deliver regular cybersecurity awareness training to all personnel. Control 1-4-1 specifically addresses this requirement, and compliance officers responsible for annual training programs have historically understood the baseline topics: password hygiene, phishing recognition, physical security, incident reporting and acceptable use of corporate systems. Those topics remain necessary, but they are no longer sufficient.
Recent NCA guidance circulars and observed regional threat patterns have introduced three awareness topics that were considered optional or advanced in 2023 but are now baseline expectations when inspectors verify NCA cybersecurity awareness training requirements during control 1-4-1 assessments. Entities preparing their 2025 training calendars should understand which modules to add, how to structure the content for different audiences, and the evidence format that inspectors request during verification visits.
The Three New Baseline Topics
Deepfake Social Engineering
Voice cloning and video manipulation technologies have moved from theoretical risk to operational threat. Attackers now use generative AI to impersonate executives in video calls, replicate voices in urgent phone requests, and fabricate approval messages that appear to come from trusted colleagues. The technology required to produce convincing deepfakes is commercially available, inexpensive, and requires minimal technical skill.
The NCA has observed an increase in social engineering attacks that exploit this technology, particularly targeting finance teams authorized to approve wire transfers and IT administrators with privileged access. Awareness training must now equip employees to recognize the indicators of synthetic media, understand the verification procedures required before acting on high-risk requests, and know when to escalate unusual communication patterns even when they appear to originate from legitimate sources.
Training content should address voice call verification protocols, the limitations of video as an authentication factor, and the specific phrases or procedures employees should use when they suspect manipulation. The training must be practical: employees need to know what to do when they receive an urgent request from someone who sounds and looks like their manager but is asking them to bypass normal approval workflows.
Supply-Chain Phishing via Trusted Vendors
Traditional phishing awareness has focused on suspicious emails from unknown senders—misspelled domains, grammatical errors, urgent requests from unfamiliar parties. That model no longer reflects the threat landscape. Attackers now compromise legitimate vendor accounts and send malicious messages from genuine email addresses, using existing conversation threads, appropriate terminology, and context that makes the message appear routine.
An employee who has been trained to distrust emails from strangers may not hesitate to open an invoice attachment from a vendor they work with weekly, especially when the email arrives in an ongoing thread about a real project. The compromise of a trusted vendor's email system or customer portal allows attackers to bypass most of the traditional phishing indicators that awareness programs have taught employees to recognize.
The NCA expects training programs to address this evolved threat. Employees must understand that a familiar sender address does not guarantee message authenticity, that invoice and payment processes require verification through independent channels, and that even trusted vendors can be compromised. Training should cover out-of-band verification procedures, the risks associated with clicking links in vendor emails even when the sender is known, and the specific steps required before processing payment requests or updating banking details.
Secure Use of Generative AI Tools
Employees across all functions now have access to generative AI tools—large language models for drafting, coding assistants, image generators, and summarization services. Many of these tools are cloud-based, operated by third parties, and process the data users provide to generate responses. An employee who pastes a draft contract into a public AI service to improve the language may inadvertently disclose confidential terms. A developer who uses a coding assistant to debug proprietary algorithms may expose intellectual property.
The NCA has issued guidance noting that uncontrolled use of generative AI tools introduces data leakage risks, intellectual property concerns, and compliance challenges. Entities subject to the ECC framework are expected to address this risk through policy and awareness. Training must help employees understand which AI tools are approved for corporate use, what types of data may never be entered into external AI services, and how to recognize when a task involves sensitive information that requires alternative approaches.
This topic is not about prohibiting AI use—many organizations are adopting these tools to improve productivity—but about ensuring employees understand the boundaries. Training should address the difference between approved enterprise AI services with appropriate data handling agreements and public consumer tools, the risks of prompt injection and data retention by AI providers, and the procedures for requesting approval when employees want to use a new AI tool for work purposes.
Evidence Format for Control 1-4-1 Verification
Understanding what topics to cover is only part of the compliance obligation. Inspectors verifying control 1-4-1 will request evidence that training has been delivered, that it covered the required topics, and that the entity has a mechanism to track completion and measure effectiveness.
The evidence package typically includes the annual awareness plan and calendar showing scheduled training sessions, the content of training materials for each topic, attendance records or completion certificates, and any assessment or testing results that demonstrate employees have understood the material. For the three new topics, inspectors may ask to see specific modules or slides that address deepfake recognition, supply-chain verification procedures, and AI usage policies.
Entities should maintain records showing that training has been delivered to all personnel, not only technical staff. The NCA's expectation is that baseline awareness topics reach every employee, with additional role-based training for populations that face elevated risks. A finance team member who processes payments needs deeper training on supply-chain phishing and verification procedures than a warehouse employee, but both need to understand the baseline threat.
Awareness metrics and reporting are also part of the verification process. Inspectors want to see that the entity is measuring training effectiveness—through completion rates, assessment scores, or phishing simulation results—and using that data to improve the program. An entity that delivers training but cannot demonstrate whether employees retained the information or changed their behavior will face questions about whether the program meets the control's intent.
Building a 2025 Training Calendar
Compliance officers and HR directors preparing the 2025 training calendar should plan for these three topics to be integrated into the annual awareness program, not treated as optional or advanced modules. The delivery format will depend on the organization's size, geographic distribution, and workforce characteristics, but the content must reach all personnel.
A typical approach is to deliver baseline awareness training that includes all required topics—traditional phishing, password security, physical security, incident reporting, acceptable use, and the three new topics—at least annually, with more frequent reinforcement through shorter campaigns or simulations. Role-based training sessions can then provide deeper coverage for populations that face specific risks: finance teams receive extended training on payment verification procedures, IT administrators receive detailed guidance on AI tool evaluation and approval processes, and executives receive briefings on deepfake threats targeting leadership.
Training can be delivered on site at the entity's premises in Riyadh or elsewhere in the Kingdom, or remotely, depending on operational needs and workforce distribution. Content should be available in Arabic and English to ensure all employees can engage with the material in their preferred language.
The calendar should specify not only the training dates but also the assessment method, the evidence that will be retained, and the process for tracking completion. Entities that wait until the fourth quarter to deliver annual training may find themselves unable to demonstrate compliance if an inspection occurs earlier in the year, so a rolling schedule that delivers training in phases throughout the year is often more defensible.
When to Seek Structured Program Support
Many organizations have internal learning and development functions capable of delivering cybersecurity awareness training, but the introduction of these three new topics presents challenges. Internal teams may lack current threat intelligence on deepfake techniques, may not have ready-made content that addresses supply-chain phishing in the context of Saudi regulatory expectations, or may be uncertain how to frame AI usage guidance in a way that is practical rather than prohibitive.
Entities should consider structured program support when they need to update their training content to reflect current NCA expectations, when they lack the internal resources to develop role-based modules for different audiences, or when they need to establish the metrics and reporting framework that inspectors will request during verification. The goal is not to outsource the compliance obligation but to ensure the program is built around real risks, covers the topics regulators now expect, and produces the evidence required during control 1-4-1 assessments.
How Structured Awareness Programs Are Delivered
A structured cybersecurity awareness program begins with an annual awareness plan and calendar that maps training topics, delivery methods, and target audiences across the year. The plan reflects the entity's specific risk profile and regulatory obligations, ensuring that baseline topics reach all personnel and that role-based training addresses the elevated risks faced by specific functions.
Board and executive briefings equip leadership to understand the current threat landscape, ask informed questions about the organization's security posture, and fulfill their governance responsibilities. These briefings are not technical deep dives but focused sessions that explain what has changed in the threat environment, what the organization is doing in response, and what decisions or resources leadership should consider.
Role-based training sessions provide deeper coverage for technical teams, finance personnel, procurement staff, and other populations that face specific threats or have elevated privileges. These sessions go beyond baseline awareness to address the procedures, tools, and judgment calls relevant to each role.
Awareness metrics and reporting provide the evidence base for compliance verification and program improvement. Metrics track completion rates, assessment results, and behavioral indicators such as phishing simulation performance, allowing the entity to demonstrate that training is reaching its audience and achieving its objectives.
Campaign materials support the training program with posters, email templates, intranet content, and other reinforcement tools that keep security awareness visible between formal training sessions. Content is available in Arabic and English to ensure accessibility across the workforce.
Programs can be structured as an annual engagement or delivered as individual sessions depending on the entity's needs and existing capabilities. Sessions can be delivered at the entity's premises in Riyadh or elsewhere in the Kingdom, or remotely, with content and delivery format tailored to the audience and operational context.
Preparing for 2025 Verification
Entities subject to NCA ECC control 1-4-1 should treat the addition of these three awareness topics as a compliance priority for 2025. Inspectors will expect to see evidence that training programs have evolved to address current threats, that employees understand the risks associated with deepfake social engineering, supply-chain compromise, and generative AI tools, and that the entity has a structured approach to measuring and improving awareness over time.
The organizations that will face the least friction during verification are those that have updated their training calendars early in the year, delivered content that directly addresses the three new topics with practical guidance, and maintained clear records of who was trained, when, and with what results. Waiting until an inspection is scheduled to update training content or scrambling to assemble evidence retrospectively creates unnecessary risk and diverts resources from other compliance priorities.
Compliance officers and HR directors responsible for awareness programs should review their current training content against these expectations now, identify gaps, and plan the updates required to meet the baseline the NCA now expects. The regulatory environment has shifted, and training programs must shift with it.
Moving Forward with Confidence
Organizations that need to update their cybersecurity awareness programs to meet current NCA expectations, add the three new baseline topics to their training calendar, or establish the evidence framework required for control 1-4-1 verification can benefit from structured support. Programs built around real risks, delivered in Arabic and English, with measured results that can be reported during inspections, provide the foundation for both regulatory compliance and genuine improvement in security behaviors across the workforce.
