In a major developmental step aimed at enhancing digital sovereignty and protecting sensitive infrastructure in the Kingdom, the National Cybersecurity Authority has officially begun implementing a package of strict new regulatory rules, including 'Rules for Controlling and Investigating Cybersecurity Violations' and 'Rules for Regulating Whistleblowing'.

The new decisions, which came into effect immediately upon publication, carried surprises ranging from granting inspectors broad 'surprise' powers to access networks, to allocating generous financial rewards for whistleblowers, amid strong warnings against 'malicious reports' or using illegal means to hack.

The Cyber Inspector: Broad Powers and Immediate Suspension

Under the new regulation, inspectors authorized by the Authority now have firm powers to monitor and inspect the places, technical and operational systems of facilities and individuals, and for that purpose they have:

Immediate access and seizure: The right to enter premises, direct access to networks and software, and to view, examine, and seize data and backup copies in case of suspicion.

Immediate suspension of systems: In urgent and necessary cases that threaten the Kingdom's digital security, the Governor of the Authority (or his delegate) has the legal authority to issue an immediate decision to suspend or halt the activities or networks in violation.

Prohibition of tampering: The system imposes a full obligation on all parties to cooperate absolutely, and completely prohibits refusing to provide records, tampering with or destroying them, while imposing absolute confidentiality on investigations.

Financial Rewards for Whistleblowers

On the other hand, the Authority opened the door for individuals to contribute to protecting the digital space through an official and confidential reporting platform, announcing the provision of encouraging financial rewards, with a special committee established to evaluate them based on the severity of the violation and the importance of the report.

The reward controls set a specific financial ceiling:

Reward amount: The system set the reward at no more than 50,000 Saudi Riyals, or equivalent to (1%) of the amount of the financial penalty collected.

Strict eligibility condition: The Authority required that the report be submitted through 'legitimate means', as the right to reward is completely forfeited (and may be subject to legal penalties) if the report involved illegal practices such as 'unauthorized access' or 'hacking' into the reported entity's systems to prove the violation.

Exclusion of relatives and employees: The system completely prohibits granting the reward to Authority employees or their relatives up to the fourth degree, or if the disclosure of the violation resulted from the person's original job duties.

Firmness Against 'Malicious Reports'

In a legal move that ensures protection of facilities and companies from settling scores or misusing the system, the rules stressed that the Authority will take strict legal measures against anyone proven to have submitted a 'malicious report', including referring them directly to judicial authorities for penalties.

Through this integrated regulatory environment, which relies in all its activations on modern electronic and technical means, the Kingdom seeks to build a safe and compliant cyber society that balances firm deterrence against violators and smart incentives for those who preserve the nation's digital security.