NCA DCC Data Cybersecurity Controls

What the NCA DCC Is

The Data Cybersecurity Controls (DCC) are the National Cybersecurity Authority's controls for protecting data in the Kingdom of Saudi Arabia. They build on the Essential Cybersecurity Controls (ECC) and focus on the data itself: how it is identified, handled, stored, shared and finally disposed of, so that its confidentiality, integrity and availability hold throughout its lifecycle.

A defining feature of the DCC is that the required protection follows the classification of the data. The more sensitive the data, the stronger the controls expected around it, in line with the national data classification levels. An assessment therefore starts by knowing what data you hold, where it lives and how it is classified, before it measures the controls around it.

Our Methodology

Every engagement follows the Cyber Shields rhythm: Assess, Protect, Monitor. For a DCC assessment, that translates into the following steps.

1. Scope and data inventory. We agree the entities and systems in writing under a signed Non-Disclosure Agreement, then build an inventory of the data in scope: what it is, where it is stored and who uses it.
2. Classification review. We check how the data is classified against the national classification levels, because the controls that apply depend on that classification.
3. Gap assessment against the DCC. Each applicable control is rated for implementation status, with the supporting evidence recorded against the relevant control reference.
4. Data lifecycle mapping. We follow the data from creation to disposal, including sharing with third parties, and show where protection is missing or weaker than its classification requires.
5. Remediation roadmap. A sequenced plan with timelines, owners and acceptance criteria, starting with the most sensitive data.
6. Re-test and assurance. Once remediation is underway, we validate that closed gaps are genuinely closed before any audit.

Standards & References

Findings are anchored to recognized control frameworks so they are defensible and cross-mappable.

• NCA DCC
• NCA ECC
• National data classification (NDMO)
• PDPL
• ISO/IEC 27001

Frequently Asked Questions

What are the NCA Data Cybersecurity Controls?

The DCC are the National Cybersecurity Authority's controls for protecting data in Saudi Arabia. They build on the Essential Cybersecurity Controls and set requirements for how data is handled, stored, shared and disposed of, with stronger protection for more sensitive data.

Who must comply with the DCC?

The controls apply to government entities and their agencies, and to organizations that own, operate or host critical national infrastructure. Other organizations often adopt them voluntarily as a strong benchmark for data protection. We confirm your position during scoping.

How does the DCC relate to the ECC?

The DCC builds on the Essential Cybersecurity Controls. Where the ECC sets the baseline posture for an organization as a whole, the DCC adds the controls that protect the data itself. Many organizations assess against both, and we cross-map findings so the two views stay consistent.

What is the difference between the DCC and the PDPL?

The PDPL is a law that protects personal data and the rights of the people it describes. The DCC are cybersecurity controls that protect data of all kinds according to its classification. They overlap, so we plan the work to reuse evidence across both.

Will the report be available in Arabic?

Yes. Reports, the executive summary, and the readout session are available in both Arabic and English at no additional cost.