Apply CGIoT-1 IoT security guidance with less manual effort

CGIoT-1:2024 is the Cybersecurity Guidelines for Internet of Things published by Saudi Arabia's National Cybersecurity Authority (NCA). It gives organisations recommended cybersecurity practices for IoT devices and services, organised into 4 main domains, 27 subdomains and 81 guidelines. It also includes 11 cybersecurity principles for IoT manufacturers in Appendix A. The code means version 1, issued in 2024.

No. The document describes itself as non-mandatory guidance. The NCA advises every organisation in the Kingdom that uses IoT to follow it and encourages manufacturers to apply it. Binding obligations for regulated entities come from NCA control documents such as the Essential Cybersecurity Controls, and Industrial IoT is expected to comply with the Operational Technology Cybersecurity Controls (OTCC-1:2022).

Any organisation in Saudi Arabia that uses IoT technology, such as connected sensors, cameras, building management systems or smart devices, is advised to follow CGIoT-1. IoT manufacturers are encouraged to apply the guidelines and the Appendix A principles when designing products and services. Organisations running industrial IoT in operational technology environments should use the NCA OTCC-1:2022 controls instead.

CGIoT-1 has four main domains: Cybersecurity Governance (subdomains 1-1 to 1-9), Cybersecurity Defense (2-1 to 2-15), Cybersecurity Resilience (3-1) and Third-Party and Cloud Computing Cybersecurity (4-1 and 4-2). Each guideline is numbered by main domain, subdomain and guideline, for example 2-4-4. The guidelines are written around four pillars: strategy, people, processes and technology.

Because CGIoT-1 is non-mandatory guidance, it does not set penalties of its own. The practical consequence of ignoring it is higher IoT cyber risk, and possible gaps against binding NCA controls or customer requirements that the guidelines help address. Organisations subject to NCA control documents should check those documents for their own compliance obligations.

CGIoT-1 follows the same domain and subdomain style as the NCA's control documents, covering areas such as risk management, access control, cryptography, logging, incident management and third-party security. Many guidelines overlap with ISO 27001 Annex A controls and NCA ECC, so an organisation with an existing security programme can treat CGIoT-1 as an IoT overlay and reuse much of its existing evidence.

Start by building an inventory of IoT devices and services, then assess IoT risks and record them in your risk register. Next, add IoT requirements to your strategy, policies and project lifecycle, apply the defence guidelines such as access control, patching, logging and network segmentation, and include IoT in business continuity plans. Finally, set IoT security requirements in supplier and cloud contracts and review them periodically.

Yes, on request. CGIoT-1:2024 is mapped in OneClickComply's control library and available on request, rather than live as a self-serve framework today. Once enabled, your existing controls, policies, risk register and evidence can be mapped to the CGIoT-1 guidelines, so work done for ISO 27001 or other frameworks counts towards it. Contact us to discuss enabling it.