Changing the marketing agency
Remove old delegated permissions, transfer approved ownership and confirm recovery contacts. A changed password may leave connected applications or administrator roles active.
Saudi regulatory frameworks
National Cybersecurity Authority
NCA Social Media Accounts Cybersecurity Readiness
Protect official social media accounts through NCA OSMACC readiness, account ownership, access controls, recovery planning and incident evidence.
Published Organizations’ Social Media Accounts Cybersecurity ControlsSources reviewed: 4 November 2026
Understand the requirement. Connect it to operations.
NCA's Organizations' Social Media Accounts Cybersecurity Controls address risks to official organizational accounts, including theft, misuse and impersonation. NCA describes these controls as an extension to ECC. They are relevant to the connection between business communication, identity security and incident management—not just the content a marketing team publishes.
Account ownership is often split among employees, agencies, platform administrators and recovery contacts. A readiness review makes those relationships visible and establishes how access is granted, reviewed, removed and recovered. This is particularly important during staff changes, agency transitions and account-compromise incidents.
Confirm applicability before choosing controls.
Confirm applicability under the official control document and the organization's NCA obligations. Identify official accounts, business managers, delegated publishing tools, linked email addresses, agency permissions and recovery mechanisms within scope. Document unofficial or abandoned accounts that require an ownership decision.
Coordinate the assessment across communications, marketing, IT, security, legal and external agencies. Technical controls alone cannot settle who may publish an urgent statement or request an account recovery. Define decision rights and handling procedures alongside access and monitoring safeguards.
Turn requirements into implementation and evidence.
| Focus area | Implementation examples | Evidence to maintain |
|---|---|---|
| Ownership and inventory | Record official accounts, platforms, business owners and recovery dependencies. | Account register and approved responsibilities. |
| Identity and delegation | Review authentication, administrative roles and third-party publishing access. | Role reviews, access approvals and removal evidence. |
| Secure administration | Protect linked email, devices, credentials and recovery mechanisms. | Configuration checks and documented recovery arrangements. |
| Monitoring and incidents | Define escalation for suspicious access, compromise and unauthorized activity. | Alert procedures, contacts and exercise records. |
| Lifecycle and continuity | Plan staff changes, agency handover, account closure and emergency access. | Handover records, tested procedures and exception approvals. |
What this looks like in practice.
An official account is compromised
Follow an agreed decision path for security containment, platform recovery and public communication. Test the handoff before an incident creates competing instructions.
From readiness assessment to working controls.
Agree the scope, responsible owners and acceptance criteria before work begins. The approach is tailored to your systems, suppliers, operating constraints and existing evidence.
Assess and prioritize
Review applicability, current controls and evidence. Identify gaps and dependencies, distinguish design from operating effectiveness, and prioritize actions with accountable owners.
Design the improvements
Translate approved requirements into architecture, policies, processes and technical changes. Reuse effective controls while keeping national and sector mappings distinct.
Implement and validate
Configure agreed safeguards, document procedures and validate representative workflows within authorized access and change windows. Record exceptions and residual risks.
Handover and sustain
Organize evidence, transfer operating knowledge and define a review cadence. Track corrective actions as systems, services, suppliers and requirements change.
Agree concrete deliverables.
- A scope and applicability record with assumptions and responsibilities.
- A gap/risk register and prioritized remediation roadmap.
- Control mapping, architecture recommendations and operating procedures.
- An evidence register, agreed validation results and handover material.
Deliverables, depth, access and timing depend on the statement of work. This is readiness and implementation support; it does not include a promise of regulator acceptance or formal certification.
Common questions.
Are these only marketing guidelines?
No. They address cybersecurity of organizational social media accounts. Content governance and brand management may complement the program but do not replace security controls.
Does multifactor authentication solve the whole problem?
It is an important safeguard, but ownership, delegated roles, linked applications, recovery, monitoring and lifecycle controls also need review.
Should agencies hold permanent administrator access?
Access needs an approved purpose, defined scope and periodic review. The assessment should identify unnecessary privileges and establish a controlled handover process.
Does this cover every form of brand impersonation?
No. Account-security readiness and external brand-protection monitoring are related but distinct scopes. Define the accounts and threats covered by each service.
Can IRIS guarantee recovery of a platform account?
No. Platform recovery decisions and access remain with the relevant provider. Support can strengthen preventive controls, evidence and incident procedures without promising a recovery outcome.
Start with the official sources.
Read the linked authority publications for the binding scope, wording and applicable updates. The implementation examples on this page are practical recommendations, not a reproduction of every regulatory requirement.
General readiness and technology information, not a legal opinion, regulator endorsement or guarantee of compliance. Confirm applicability, current versions and sector directions with the competent authority and qualified advisers.
Related frameworks and requirements
Define the right scope for your organization.
Bring your services, systems, supplier dependencies and existing findings. We will help turn them into a practical assessment and implementation scope.
Discuss your readiness