Many Saudi firms weigh a virtual arrangement against a full-time executive hire. The question that follows is whether NCA ECC virtual CISO appointment requirements permit it. NCA ECC requires the entity to appoint a qualified CISO and to notify the regulator. It does not explicitly prohibit a virtual arrangement. That leaves the decision, and the burden of proof, with the entity.
This article is for CEOs, CFOs and board members. It explains what examiners look at when a notification arrives, how to evidence it, and what the contract should say.
What the requirement says and what it leaves open
NCA ECC places cybersecurity leadership under a dedicated, accountable function and expects a named, qualified head of it. The control on appointment does not specify whether that person is an employee, a contractor or a retained adviser. Because the text is silent on the model, regulators judge the substance: is this individual qualified, and can they actually discharge the role for this entity?
Sector regulators such as SAMA, CMA and CITC may ask their own questions in addition to NCA's. A firm in a regulated sector should assume that the notification will be read against both NCA ECC and its sector requirements, including the SAMA Cyber Security Framework where it applies.
The four qualification criteria
1. Professional certifications
Examiners expect recognised credentials such as CISSP or CISM, or an equivalent. Equivalence is a judgment, so state why the credential is comparable and attach proof that it is current.
2. Demonstrable experience in a regulated sector
A certificate alone rarely satisfies a reviewer. They look for leadership experience in a regulated environment, described by role, scope and period. Avoid generic claims. Describe the types of programmes the person has led, such as governance, incident response or regulatory examinations.
3. Knowledge of NCA controls and the Saudi regulatory landscape
The candidate should be able to explain how NCA ECC, the sector framework and data-protection obligations interact for your entity. Expect examiners to ask practical questions about your own control environment, so the named individual should be able to answer them without preparation by others.
4. Sufficient time allocation
This is the criterion most often challenged in virtual arrangements. A CISO who is stretched thin cannot lead. The entity must show a defined commitment of time, a way to reach the individual during incidents, and a clear account of what happens when they are unavailable.
Evidence format that works
Prepare a single notification pack rather than scattered documents. A sensible structure:
- A cover letter from the CEO or board delegate confirming the appointment and its effective date.
- A concise professional profile of the individual, no more than two pages.
- Copies of certifications with validity dates.
- A experience schedule mapping roles to regulated-sector work.
- A statement of the time commitment, expressed in days per month, with the escalation arrangement.
- The reporting line, showing access to the CEO and board.
- The relevant extract of the engagement contract.
Keep the pack consistent with your cybersecurity policy and governance documents. A mismatch between the notification and the approved policy is a common reason for follow-up questions.
Contract clauses that answer examiner questions
Examiners ask two things about a virtual model: who is accountable, and is the person available. The contract should answer both plainly.
- Named individual: the contract names the person and requires consent before any replacement.
- Accountability: the CISO reports to the CEO or a board committee, and the entity retains ownership of risk acceptance decisions.
- Time commitment: days per month are fixed, with a mechanism to increase them during incidents or regulatory examinations.
- Availability: response expectations for incidents, and a named deputy for absences.
- Regulator liaison: the CISO may represent the entity before NCA, the sector regulator and auditors.
- Confidentiality and data handling: obligations that reflect Saudi data-protection requirements.
- Reporting: a defined cadence of management and board reporting.
- Exit and transition: continuity and handover terms, so the function does not lapse if the arrangement ends.
Usual gaps
- The notification names a qualified person, but the time commitment is vague.
- The CISO has no direct access to the board, which undermines independence.
- The contract treats the role as advisory, leaving accountability unclear.
- Certifications have lapsed or are not evidenced.
- No one has defined who acts during an absence.
A sensible order of work
- Confirm with your regulators which notification channel and format apply to your sector.
- Define the role: scope, reporting line, decision rights and time commitment.
- Select the candidate against the four criteria and collect the evidence.
- Draft the contract clauses above and have legal review them.
- Obtain board approval and submit the notification pack.
- Set the reporting cadence and committee structure so the arrangement is visible from the first month.
How CISO Consulting supports this
Our vCISO Services provide strategic cybersecurity leadership on demand, with a dedicated virtual CISO aligned to your business objectives. The engagement is a retainer with an agreed number of days per month, which gives you a time commitment you can state in the notification and in the contract. Our service is aligned to NCA ECC and the SAMA CSF.
The work follows four stages. In the first 30 days we assess posture, risks and quick wins. We then agree a roadmap with management, lead on an ongoing basis through committees and reporting, and, if you wish, build the team and support hiring of a permanent CISO. That last stage matters for boards that see a virtual arrangement as a bridge rather than an end state.
The service features that examiners tend to probe are part of the engagement: regulator and auditor liaison, committee and board reporting, and vendor and budget oversight. The deliverables give you evidence of leadership in practice: a security roadmap and priorities, a monthly management report, a quarterly board pack, and committee minutes with action tracking.
Where the board wants a longer view, our Cybersecurity Strategy & Roadmap service translates business priorities, regulatory obligations and the threat landscape into a costed, prioritized strategy and multi-year roadmap.
Next step
If you are considering a virtual arrangement, start with the four criteria and the evidence pack. Our vCISO Services team can help you test whether the model fits your obligations before you notify the regulator.
