Saudi Arabia · Regulation guide
NCA Critical Systems Cybersecurity Controls (CSCC)
Issued by National Cybersecurity Authority (NCA)
Applies to: Organisations in scope of the ECC that own or operate systems classified as critical.
The CSCC add stricter controls on top of the ECC for critical systems, those whose disruption would seriously affect national security, the economy or essential services.
They raise expectations in areas such as monitoring, vulnerability management, access control, backup and recovery for those systems.
General guidance, not legal advice. Always confirm scope and current requirements with the issuing authority.
Discuss NCA CSCC with us
Gap assessment, control mapping or evidence tracking.
How we help
- ✓Identifying and scoping critical systems
- ✓Gap assessment against CSCC and ECC together
- ✓Remediation roadmap and evidence tracking
Related ISO standards
NCA CSCC questions
Is this legal advice?+
No. This is a general overview. Confirm scope, the current edition and your obligations with the issuing authority and your legal or compliance advisers.
Next step
Where does your programme stand?
The GRC maturity check takes three minutes and shows which areas to fix first.