The importance of cybersecurity for business: breach costs and a 10-point checklist

The importance of cybersecurity for business comes down to cost and continuity. IBM puts the global average cost of a data breach at $4.99 million in 2026 [1], and Saudi rules add a 72-hour notice duty for harmful personal data breaches [5] and fines of up to SAR 5 million [4]. Ten basic controls remove much of that risk.

This guide is written for owners and managers of small and medium companies in Saudi Arabia. It covers what a breach costs, what Saudi rules require once one happens, which official controls apply to a company of your size, and a 10-point checklist you can start this month. It is general information, not legal advice.

Why the importance of cybersecurity for business keeps rising

Most companies now run on a handful of online accounts: email, a cloud drive, an accounting system, a store or booking page, and the banking portal. Whoever controls those accounts controls the business. A single stolen password can stop sales, expose a customer list or redirect a supplier payment.

Saudi companies already treat this as a cost of doing business. The National Cybersecurity Authority (NCA) puts the Kingdom's cybersecurity market at about SAR 16.3 billion in 2025, and private-sector entities spent SAR 11.2 billion of it, or 69% [3]. Government entities accounted for the remaining SAR 5.1 billion [3].

The damage from an attack falls into three groups:

• Money: days without sales, emergency IT work, replaced devices and staff overtime.
• Legal exposure: the Personal Data Protection Law (PDPL) sets notice duties and fines once personal data leaks.
• Trust: customers, banks and larger clients judge you by how you handled the incident.

NCA's own definition is broad. It describes cybersecurity as protecting networks, IT and operational technology systems, their hardware and software, the services they provide and the data they hold from unauthorised penetration, disruption, modification, access, use or exploitation, and says the concept also covers information security and digital security [9].

What a data breach costs in 2026

Two widely used annual studies give a consistent picture.

• Cost: IBM's Cost of a Data Breach Report 2026, produced with the Ponemon Institute, puts the global average cost of a breach at $4.99 million, a 12% increase on the previous year and a record high [1].
• Savings from automation: the same report finds that organisations making extensive use of AI and automation in security saved $1.93 million compared with those using none [1].
• AI-driven attacks: IBM reports a 56% increase in AI-driven attacks, led by deepfake impersonation and AI-enabled malware [1].
• How attackers get in: Verizon's 2026 Data Breach Investigations Report finds that 31% of breaches started with the exploitation of a software vulnerability, overtaking stolen passwords as the top entry point [2].
• Ransomware: Verizon finds ransomware in 48% of all breaches, although ransom payouts are shrinking [2]. Its data covers incidents from 1 November 2024 to 31 October 2025 [2].

These are global figures, weighted towards larger organisations. A small company's bill is smaller in dollars, but it lands on thinner cash reserves and fewer people. The useful question is not the global average but what each cost line would look like in your own company.

What Saudi law adds: 72 hours, notices and fines

Under Article 20 of the PDPL, as amended by Royal Decree M/148 dated 5/9/1444H, a controller must notify the competent authority when it learns of a leak, damage or unlawful access to personal data, and must notify the affected person where the incident could harm their data or conflict with their rights or interests [4].

The Implementing Regulation sets the detail in Article 24 [5]:

• Deadline: notify the competent authority within 72 hours of becoming aware of the incident, if it could harm the personal data or the data subject, or conflict with their rights or interests.
• Content: what happened, when and how, and when you found out; the categories and actual or approximate number of people affected and the types of data; the risks and the measures taken; whether the people affected have been or will be told; and a contact person.
• Late details: information you cannot gather within 72 hours must follow as soon as possible, with the reasons for the delay.
• Records: keep copies of the reports and document the corrective measures taken.
• People affected: tell them without undue delay, in simple and clear language, with advice on how to protect themselves.
• Other duties: the article does not affect any duty to report incidents under NCA rules or other regulations.

SDAIA's National Data Governance Platform offers a "Personal Data Breach Notification" e-service for filing the notice, and it asks for a valid registration certificate from the National Data Management Office [6]. Check that your company is registered before an incident rather than during one.

The penalties are real. Article 36 allows a warning or a fine of up to SAR 5 million for a private person or entity that breaches the law or its regulations, and the fine may be doubled for a repeat violation [4]. Article 35 sets up to two years in prison and a fine of up to SAR 3 million, or either penalty, for disclosing or publishing sensitive data with intent to harm the data subject or for personal gain [4].

Enforcement has started. Okaz reported on 30 June 2026 that SDAIA's violation committees had issued fines and warnings, including for failing to notify a breach within the 72-hour period and for failing to take the measures needed to protect personal data [7]. If your data sits with cloud or AI tools abroad, our guide to data residency in Saudi Arabia covers the transfer conditions. This section is general information; for your specific case, check SDAIA's current regulations or ask a licensed advisor.

Illustrative example: three days offline at a Riyadh online store

Illustrative example. An online store in Riyadh with 18 staff sells about SAR 30,000 a day at a 35% gross margin. Ransomware locks its order system and two laptops for three days. The figures below are assumptions for the example, not survey data.

The table leaves out the hardest costs to price: customers who do not come back and management time over the following weeks. If customer data was also copied, the store faces the 72-hour notice and possible PDPL penalties on top. Several of the ten controls below are settings rather than purchases, such as multi-factor authentication and email authentication, so the comparison usually favours prevention.

Digital security for small companies: what is mandatory and what is advised

Not every NCA document binds every company, and it helps to know where you stand.

• The Essential Cybersecurity Controls (ECC-2:2024) apply to government agencies and their affiliated companies and entities, and to private-sector entities that own, operate or host critical national infrastructure. NCA strongly encourages all other entities to use them as best practice [9].
• The Non-CNI Private Sector Entities Cybersecurity Controls (NCNICC-1:2025), issued by NCA in 2025, cover private companies outside critical infrastructure [8]. Category A, large entities with more than 250 full-time employees or more than SAR 200 million in annual revenue, has 65 essential controls. Category B, small and medium entities with 6 to 249 employees or SAR 3 million to SAR 200 million in revenue, has 26 essential controls in 13 subdomains, all under cybersecurity defence [8].
• Who is bound: the controls are binding on entities in each category that NCA notifies, and NCA may require additional controls where needed; entities outside the scope are responsible for using them as appropriate [8]. A company with fewer than six employees and under SAR 3 million in revenue falls outside both categories.

So unless NCA has notified your company, or a client contract or sector regulator requires it, these controls are a strong reference rather than a legal duty. The PDPL's breach rules, by contrast, apply whenever you process personal data. The checklist below follows the defensive areas NCA chose for small and medium companies, because they are a sensible baseline whatever your legal position.

A 10-point protection checklist for small companies

Use it as-is. Each point ends with a test that tells you it is done.

1. Turn on multi-factor authentication. Cover email, remote access, cloud admin panels and the banking portal. NCNICC lists multi-factor authentication for remote access, including email and external applications, among the controls mandatory for Category B [8]. Done when no mailbox or admin account opens with a password alone.
2. List what you must protect. Devices, cloud accounts, domain names and key data (customer list, payroll, contracts), each with an owner. Done when one sheet exists and changes whenever someone joins or leaves.
3. Patch on a schedule. Switch on automatic updates for operating systems, browsers and your store or website platform, and scan internet-facing applications for vulnerabilities [8]. Done when nothing important is more than a month behind.
4. Change default settings. Replace default passwords on routers, cameras, printers and admin panels, and switch off services you do not use [8]. Done when no device still has its factory password.
5. Protect every device against malware. Servers, laptops and phones all need current protection [8]. Done when every device on your list shows it active.
6. Lock down your email domain. Filter phishing and spam, and publish SPF, DKIM and DMARC records for your domain [8]. Done when your IT provider confirms all three records are live.
7. Back up and test the restore. Back up critical systems regularly and test that the backups restore [8]. NCA's guidelines for small e-commerce sellers suggest backing up at least weekly and checking the data on the backups [10]. Done when you have restored one real file from last week's backup.
8. Give each person only what they need. Apply least privilege and review access regularly [8], keep admin rights to a few named people, and close a leaver's accounts on their last day. Done when the last review date is written on your asset sheet.
9. Train staff to pause and verify. Cover phishing, fake invoices and voice or video requests to change bank details. NCA's free Tahqaq service checks suspicious links, files and QR codes [11]. Done when any change to payment details needs a call-back on a known number.
10. Write a one-page incident plan. Name who decides, the IT contact, how to disconnect affected devices, the 72-hour PDPL clock and who talks to customers. Done when it is printed and you have rehearsed it once.

To turn these points into written policies, NCA publishes free templates for policies, standards and procedures that it says are intended for government, private and other entities [12].

The first 72 hours after a breach

If something goes wrong, the order of work matters more than speed alone.

1. Contain (first hours). Disconnect affected devices from the network but do not wipe them, because they hold the evidence. Reset passwords and sign out active sessions from a clean device.
2. Assess (first day). Establish what was accessed, whose data it was, roughly how many people are affected and when it started. Write down the time you became aware; the 72-hour clock runs from that moment [5].
3. Notify (by hour 72). If the incident could harm the people concerned, file the notice through SDAIA's platform [6] and tell those affected in plain language [5]. If NCA has notified your company under NCNICC, reporting incidents to NCA is also mandatory [8].
4. Recover and document. Restore from tested backups, fix the entry point, and keep copies of every report and the corrective measures taken, as Article 24 requires [5].

Your next step

This week, do points 1 and 7: turn on multi-factor authentication for every mailbox and admin account, and restore one real file from your backup. Together they make it harder for an attacker to get in and faster for you to recover. If you are commissioning new software, write the checklist into the requirements; our guide to choosing a software development company in Saudi Arabia lists the questions to ask before you sign. You can read more about O AI, a software and AI company in Al Khobar, on our home page. The importance of cybersecurity for business is easiest to see before an incident, not after.