NCA ECC
Gap assessment and remediation against the National Cybersecurity Authority Essential Cybersecurity Controls, the mandatory baseline for most Saudi organizations.
Learn moreAssess your cloud environment against the National Cybersecurity Authority's Cloud Cybersecurity Controls, clarify what falls to the cloud service provider and what falls to you as a tenant, and follow a remediation roadmap that extends your ECC posture into the cloud.
The Cloud Cybersecurity Controls (CCC) are the National Cybersecurity Authority's controls for cloud computing in the Kingdom. They extend the Essential Cybersecurity Controls into the cloud, addressing the risks and responsibilities that arise once data and workloads move out of an organization's own data centre. The current version, CCC-2:2024, was updated to reflect changes related to data localization.
A defining feature of the CCC is that it separates obligations between two roles. Cloud service providers are responsible for the security of the cloud platform and the controls they offer. Cloud tenants are responsible for how they configure and use those services, the data they place in them, and the controls on their side of the shared-responsibility line.
Every engagement follows the Cyber Shields rhythm: Assess, Protect, Monitor. For this engagement, that translates into the following steps.
Findings are anchored to recognized frameworks so they are defensible and cross-mappable.
The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.
Every engagement is scoped individually. Pricing depends on the size and complexity of your environment, the systems or controls in scope, and the timeline you need to work to. Rather than publish figures that rarely fit a specific situation, we prepare a written proposal with a clear fee and schedule once your scope is understood.
Tell us about your organization and the deadline you are working toward, and we will return a tailored proposal within five business days, following a signed Non-Disclosure Agreement.
The CCC are the National Cybersecurity Authority's controls for securing data and workloads in cloud computing in Saudi Arabia. They set requirements for both cloud service providers and cloud tenants, extending the Essential Cybersecurity Controls into shared, externally managed infrastructure.
A provider operates the cloud platform and secures it. A tenant uses those services and is responsible for how they are configured and used, the data placed in them, and the controls on the customer side. The CCC defines obligations for both.
The CCC builds on the Essential Cybersecurity Controls and extends them into the cloud. Many organizations assess against both, and we cross-map findings so the two views stay consistent.
Yes. Reports, the executive summary, and the readout session are available in both Arabic and English at no additional cost.
Gap assessment and remediation against the National Cybersecurity Authority Essential Cybersecurity Controls, the mandatory baseline for most Saudi organizations.
Learn moreCloud security and cloud privacy controls on top of ISO/IEC 27001.
Learn moreHardening, segmentation, secure baselines and architecture review for production environments.
Learn moreWho the CCC applies to, what changed in 2024, and how cloud tenants and providers prepare.
Read the articleTell us about your cloud environment and we will return a written proposal within five business days. NDA first, always.