NCA CCC compliance and requirements for cloud services that Saudi national entities can rely on.

What it is

What is NCA CCC and what is it used for?

The Cloud Cybersecurity Controls are issued by the National Cybersecurity Authority (NCA) of the Kingdom of Saudi Arabia. They set minimum cybersecurity requirements for cloud computing and were developed as an extension to the Essential Cybersecurity Controls (ECC), so an organisation in scope must keep complying with both.

A cloud service provider (CSP) carries one set of obligations; a cloud service tenant (CST), the organisation using the service, carries a separate, smaller set. Each control is coded to one party, and how much becomes mandatory depends on the classification level of the data, from public to top secret.

Current version. CCC-2:2024, which replaced CCC-1:2020. The NCA states that the Arabic text is binding on meaning and interpretation. Confirm any date that applies to your organisation directly with the NCA.

Who it is for

Who needs NCA CCC compliance?

On the tenant side, the CCC covers government agencies in the Kingdom and private-sector entities that own, operate or host critical national infrastructure, when they use or plan to use cloud services. On the provider side, it covers any provider serving those tenants, wherever the provider is based. Other organisations are encouraged to adopt the controls. Enquiries usually start from one of four places:

• A government or infrastructure customer asks for it. Ask the classification level of the data involved: it decides which controls are mandatory.
• A tender for cloud, hosting or managed services lists it. Plan the evidence before bidding, with the ECC position alongside.
• The NCA or a sector regulator raises it. A self-assessment request or audit notice leaves little time, so evidence must already exist.
• A group company already complies. Subsidiaries serving Saudi customers are asked to match the group's controls.

Requirements

What are the main NCA CCC requirements?

CCC-2:2024 follows the ECC's pattern of four main domains, here with 24 subdomains. Providers face 37 main controls and 94 subcontrols; tenants face 18 main controls and 26 subcontrols. Each CCC control adds to an ECC control, which still applies. The list stays at title level.

• Cybersecurity governance (1-1 to 1-5): roles and responsibilities, risk management, compliance with standards, laws and regulations, human resources and change management.
• Access and asset protection (2-1 to 2-3): asset management, identity and access management, and protection of information systems and processing facilities.
• Networks, devices and data (2-4 to 2-8): network security management, mobile devices, data and information protection, cryptography, and backup and recovery.
• Detection and response (2-9 to 2-12): vulnerabilities management, penetration testing, event logs and monitoring, and incident and threat management.
• Further defence controls (2-13 to 2-17): physical security, web application security, key management, system development security and storage media security.
• Cybersecurity resilience (3-1): the cybersecurity aspects of business continuity management.
• Third-party cybersecurity (4-1): supply chain and third-party cybersecurity.
• Applicability by level: annex tables mark each control mandatory or optional (recommended) for data at level 1 (top secret) to level 4 (public).

Compliance process

How do you become NCA CCC compliant?

There is no certificate at the end of this route. The NCA evaluates compliance through means such as self-assessment, periodic reports from its compliance tool and on-site audits.

1. 01
   Fix your role, services and data levels.Provider, tenant or both; services in scope; the highest data classification level.
2. 02
   Gap analysis: test today's position against CCC-2:2024 and the ECC beneath it.Each applicable control is compared with your configurations, contracts and records; actions get owners and dates.
3. 03
   Implement the controls and record evidence as you go.Access, keys, logging, change, secure development, storage media, supplier terms and incident communication.
4. 04
   Review, audit internally and rehearse the self-assessment.We test each control as the NCA might and close findings with evidence.
5. 05
   Answer the NCA's evaluation and stay compliant.Submit the self-assessment or tool report requested, host any on-site audit, then keep the controls running.

Check the route before you sign. The CCC has no certificate, no accreditation scheme and no approved assessor list, so be wary of anyone selling a "CCC certificate". Read the current version on the NCA's website and ask how each control will be tested. The certification buyer's checklist

Cost

How much does NCA CCC compliance cost?

The budget follows the size of the control set that applies to you, which in turn follows your role and data levels.

Timeline

How long does NCA CCC compliance take?

Timing depends on whether the ECC controls already operate,, your data level and how fast contracts and technology can change. As an estimate, a programme built on working ECC controls takes four to nine months.

Your engagement

What your NCA CCC engagement includes

Sterling OS™ runs every engagement. Sterling does not certify or assess on behalf of the NCA: the National Cybersecurity Authority evaluates your compliance.

• Design™: guided support

  Your teams put the controls in place; a Sterling consultant sets the method, reviews each output and coaches the owners.

• Drive™: managed support

  The alternative to Design™: Sterling drafts policies, contract clauses and evidence with your owners and runs the programme.

• Sustain™: after go-live

  Internal audits, self-assessment updates and re-baselining when the NCA revises the controls.

• Automate™: Effivity

  Your control register, risks and evidence run in Effivity, included with the engagement at no additional cost.

• Training for your people

  Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

Compliance decisions remain with the National Cybersecurity Authority.

Often combined with

Standards organisations pair with NCA CCC

• ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
• CIS ControlsCIS Controls implementation and requirements: the 18 Controls and 153 Safeguards of v8.1, Implementation Groups, assessment with no certificate, cost and time.
• CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.
• CSA STARCSA STAR certification consulting for cloud providers: CCM controls and evidence for a STAR Registry entry by self-assessment, certification or attestation.
• Cyber EssentialsCyber Essentials certification consulting: the five technical controls in place for your verified self-assessment, and Cyber Essentials Plus audit-ready.
• DESC ISR (Dubai)DESC ISR compliance consulting for Dubai government entities and suppliers: information security risks and incidents managed, with the evidence to show it.