Saudi Arabia · Regulation guide
NCA Cloud Cybersecurity Controls (CCC)
Issued by National Cybersecurity Authority (NCA)
Applies to: Cloud service providers serving organisations in Saudi Arabia, and organisations in scope of the ECC that use cloud services.
The Cloud Cybersecurity Controls extend the ECC with requirements specific to cloud computing. They set separate obligations for cloud service providers and for the organisations that use their services.
Topics include cloud security governance, data and hosting location, identity and access, encryption, logging and monitoring, and the shared responsibilities between provider and customer.
General guidance, not legal advice. Always confirm scope and current requirements with the issuing authority.
Discuss NCA CCC with us
Gap assessment, control mapping or evidence tracking.
How we help
- ✓Applicability review for providers and cloud customers
- ✓Gap assessment against the CCC alongside the ECC
- ✓Shared-responsibility mapping with your cloud providers
- ✓Policies and evidence tracking
NCA CCC questions
Is this legal advice?+
No. This is a general overview. Confirm scope, the current edition and your obligations with the issuing authority and your legal or compliance advisers.
Next step
Where does your programme stand?
The GRC maturity check takes three minutes and shows which areas to fix first.