More organizations in the Kingdom are moving to the cloud, and regulators are paying closer attention. The National Cybersecurity Authority's Cloud Cybersecurity Controls set the minimum cybersecurity requirements for cloud computing, for the providers who deliver cloud services and the organizations that use them. The current version is CCC-2:2024, which replaced CCC-1:2020.

Who the CCC applies to #

The CCC speaks to two roles:

  • Cloud Service Providers (CSPs): any provider that delivers cloud computing services to tenants within the scope of the controls.
  • Cloud Service Tenants (CSTs): government entities in the Kingdom, including ministries, authorities and their companies and sub-entities, and private sector entities that own, operate or host Critical National Infrastructure, when they use or plan to use any cloud service.

The document also gives examples of providers outside its scope, such as providers that serve only individuals and private companies outside critical infrastructure, and have no in-scope tenants. Even so, the Authority strongly encourages every other entity in the Kingdom to use the controls as best practice.

In short: if you are a government entity or run critical infrastructure and you use the cloud, the CCC applies to you as a tenant. If you sell cloud services to such organizations, it applies to you as a provider.

Built on top of the ECC #

The CCC builds on the Essential Cybersecurity Controls. The document is explicit that tenant controls and provider controls are an extension and complement to the ECC, so in-scope organizations must comply with both continuously. Providers must do so whether or not they are otherwise within the ECC's scope.

This helps with planning: if you already run an ECC programme, the CCC adds cloud-specific requirements to foundations you know, instead of starting a new framework.

The four domains #

The CCC follows the same four main domains as the ECC:

  • Cybersecurity governance: roles and responsibilities, risk management, compliance, cybersecurity in human resources and in change management.
  • Cybersecurity defence: the largest domain, covering asset management, identity and access, system protection, network security, data protection, cryptography, backup and recovery, vulnerability management, penetration testing, logging and monitoring, incident management, physical security, web application security, key management, secure development and storage media.
  • Cybersecurity resilience: the cybersecurity aspects of business continuity.
  • Third-party cybersecurity: supply chain and third-party security.

Within these domains, separate controls are written for providers and for tenants, and the level of commitment depends on the levels set out in the document's annex.

What changed in CCC-2:2024 #

The update list in the document is short and specific. The most important change concerns data localization:

  • Two provider subcontrols were deleted: one required cloud services, including storage, processing and disaster recovery systems, to be provided from within the Kingdom, and one required the same for monitoring and support systems.
  • The rationale given is that controls related to data localization have been transferred to the National Data Management Office at the Saudi Data and Artificial Intelligence Authority, in line with its mandate.
  • Entities must now refer to the National Data Management Office on data localization before taking any action in this regard.

There was also a translation update to the definitions of confidential and sensitive data.

In practice, data residency still matters. It is now governed through the national data management framework rather than the CCC itself, so cloud decisions involving location need input from both your cybersecurity and your data governance functions.

How compliance is assessed #

The Authority evaluates compliance through several means, including self-assessments by the entities, periodic reports from its compliance tool, and on-site audits. Its CCC assessment and compliance tool organizes the evaluation and measurement. Expect to be asked for evidence as well as policies.

How to prepare as a tenant #

  1. Map your cloud estate. List every cloud service you use, including software as a service, with its owner and the data it holds.
  2. Classify the data. Your obligations depend on what the data is, so connect your cloud inventory to your data classification.
  3. Check data location decisions against the current national data management requirements, not the old CCC wording.
  4. Review your providers. Confirm that each provider serving you meets its CCC obligations, and write the security expectations into contracts.
  5. Run a gap assessment against the tenant controls on top of your ECC baseline.
  6. Fix and evidence. Prioritize identity and access, logging and monitoring, backup and recovery, and encryption and key management, then keep evidence that shows the controls work.

How to prepare as a provider #

Providers carry the heavier load. Start with a gap assessment against the provider controls, pay particular attention to identity and access for your cloud technology stack, monitoring, incident management and key management, and prepare for assessment by tenants and by the Authority.

Where international standards fit #

Many organizations also align with ISO/IEC 27017 and ISO/IEC 27018 for cloud security and privacy, or with the CSA STAR programme. These do not replace the CCC for in-scope entities, but evidence collected for one can often support the others.

Learn more about our NCA CCC assessment and ISO/IEC 27017 and 27018.

Frequently asked #

Who must comply with the NCA CCC?

Cloud service providers serving in-scope tenants, and tenants that are government entities or private entities owning, operating or hosting Critical National Infrastructure that use or plan to use cloud services. Other entities are encouraged to use the controls as best practice.

What changed in CCC-2:2024?

Two provider subcontrols requiring cloud services to be provided from within the Kingdom were deleted, because controls related to data localization moved to the National Data Management Office at SDAIA. Entities must refer to that office on data localization before acting.

Does the CCC replace the ECC?

No. Tenant and provider controls in the CCC extend and complement the ECC, so in-scope organizations must comply with both.

How does the NCA assess CCC compliance?

Through self-assessments by entities, periodic reports from the compliance tool and on-site audits.

Official Sources and References #

The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.