NCA CCC
Cloud Cybersecurity Controls for cloud service providers and tenants, extending your ECC posture into the cloud.
Learn moreShow customers that your cloud services are secure and respect their personal data. We help cloud providers and cloud users apply ISO/IEC 27017 and ISO/IEC 27018 on top of ISO/IEC 27001.
ISO/IEC 27017 is a code of practice for information security controls in cloud services. It adds cloud-specific guidance to the ISO/IEC 27002 controls and clarifies the shared responsibilities of cloud service providers and cloud customers.
ISO/IEC 27018 is a code of practice for protecting personally identifiable information in public clouds where the provider acts as a processor. Both are usually applied as extensions of an ISO/IEC 27001 management system, and certificates commonly reference them within the 27001 scope.
Every engagement follows the Cyber Shields rhythm: Assess, Protect, Monitor. For this engagement, that translates into the following steps.
Findings are anchored to recognized frameworks so they are defensible and cross-mappable.
The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.
Every engagement is scoped individually. Pricing depends on the size and complexity of your environment, the systems or controls in scope, and the timeline you need to work to. Rather than publish figures that rarely fit a specific situation, we prepare a written proposal with a clear fee and schedule once your scope is understood.
Tell us about your organization and the deadline you are working toward, and we will return a tailored proposal within five business days, following a signed Non-Disclosure Agreement.
Usually yes. ISO/IEC 27017 and 27018 are applied as extensions of an ISO/IEC 27001 management system.
27017 covers cloud security for providers and customers; 27018 covers personal data in public clouds where you act as a processor. Many providers adopt both.
No. Certificates are issued by accredited certification bodies. We prepare you so that the certification audit goes smoothly, and we can help you choose a certification body.
Yes. Reports, the executive summary, and the readout session are available in both Arabic and English at no additional cost.
Cloud Cybersecurity Controls for cloud service providers and tenants, extending your ECC posture into the cloud.
Learn moreImplementation and certification readiness for an Information Security Management System recognised by partners and clients worldwide.
Learn moreCloud security assurance customers recognize, through the CSA STAR programme.
Learn moreWho the CCC applies to, what changed in 2024, and how cloud tenants and providers prepare.
Read the articleTell us about your cloud services and we will return a written proposal within five business days. NDA first, always.