GCC
NCA CCC-2
NCA Cloud Cybersecurity Controls (CCC-2:2024)
CCC-2:2024
55 controls · 24 domains · 120 sub-controls
Mandatory for: Mandatory for cloud computing used by Saudi government entities and CNI (providers and tenants). Extends NCA ECC.
Cross-framework coverage
Controls in NCA CCC-2 also cover:
NIST SP 800-53 22 shared
NCA ECC-2 21 shared
Dubai ISR 20 shared
SOC 2 readiness 20 shared
Qatar NIA 20 shared
See how NCA CCC-2 connects to the rest → the Compliance & Control Galaxy
Control domains
1-1 · Cybersecurity roles and responsibilities 2
1-1-P-1
Provider: cloud security roles approved by the Authorizing Official
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
1 sub-control
- 1-1-P-1-1 Approved RACI chart for cloud security roles A signed RACI covering every cloud stakeholder (provider teams, tenants, third parties) and the Authorizing Official's own duties.
1-1-T-1
Tenant: cloud security roles approved by the Authorizing Official
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
1 sub-control
- 1-1-T-1-1 Approved RACI chart for the cloud services used A signed RACI naming who is responsible, accountable, consulted and informed for each cloud service, including the provider's share.
1-2 · Cybersecurity risk management 2
1-2-P-1
Provider: cloud items in the risk management method
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
3 sub-controls
- 1-2-P-1-1 Acceptable risk levels set per service and shared with tenants Documented risk appetite per service; tenant-facing statement of residual risk where relevant.
- 1-2-P-1-2 Data classification considered in risk assessment Risk scoring uses the classification level of the data each service handles.
- 1-2-P-1-3 Cloud risk register kept and reviewed A live register for cloud services with owners, treatment and dated reviews driven by risk level.
1-2-T-1
Tenant: cloud items in the risk management method
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
3 sub-controls
- 1-2-T-1-1 Acceptable risk levels set for cloud services used Documented risk appetite per cloud service, approved by management.
- 1-2-T-1-2 Own data classification used in cloud risk assessment Risk scoring uses the classification scheme your organisation has adopted.
- 1-2-T-1-3 Cloud risk register kept and reviewed A live register of cloud risks with owners, treatment and dated reviews.
1-3 · Compliance with cybersecurity standards, laws and regulations 2
1-3-P-1
Provider: extra legal and regulatory compliance duties
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
1 sub-control
- 1-3-P-1-1 Continuous compliance with Saudi cyber laws and NCA mandates A maintained obligations register with owners; evidence that compliance is monitored, not checked once.
1-3-T-1
Tenant: extra legal and regulatory compliance duties
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
1 sub-control
- 1-3-T-1-1 Ongoing monitoring of the provider's legal and contract compliance Provider compliance reports, attestations or dashboards reviewed on a schedule; contract clauses mapped to evidence.
1-4 · Cybersecurity in human resources 3
1-4-P-1
Provider: extra pre-employment and in-employment checks
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
3 sub-controls
- 1-4-P-1-1 Qualified Saudi nationals in data centre security posts Org chart and HR records show Saudi nationals in all data-centre cyber security roles in the Kingdom.
- 1-4-P-1-2 Periodic vetting of staff with stack access in the Kingdom Background checks before access and re-checks on a defined cycle.
- 1-4-P-1-3 Policy sign-off before stack access is granted Signed acknowledgement on file before access is granted.
1-4-P-2
Provider: extra controls when staff leave
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
1 sub-control
- 1-4-P-2-1 All organisation assets returned at exit Leaver checklist with asset return sign-off, including tokens, keys and devices.
1-4-T-1
Tenant: extra pre-employment checks
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
1 sub-control
- 1-4-T-1-1 Vetting for staff in sensitive cloud roles Background checks completed before granting those roles.
1-5 · Cybersecurity in change management 4
1-5-P-1
Provider: change management security requirements defined
The requirement is identified, documented, approved and demonstrably applied.
1-5-P-2
Provider: change management security requirements applied
The requirement is identified, documented, approved and demonstrably applied.
1-5-P-3
Provider: minimum content of change management requirements
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
2 sub-controls
- 1-5-P-3-1 Secure release of planned changes, security fixes first A change process with security review, testing and approval; security observations block or reprioritise the change.
- 1-5-P-3-2 Procedure for emergency changes An emergency-change route with retrospective review and approval.
1-5-P-4
Provider: change management requirements reviewed
The requirement is identified, documented, approved and demonstrably applied.
2-1 · Asset management 2
2-1-P-1
Provider: extra asset management controls
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
2 sub-controls
- 2-1-P-1-1 Inventory of information and technology assets (CMDB) A single inventory (for example a CMDB) covering all technical assets, kept current.
- 2-1-P-1-2 Named owner for every asset across its life cycle Owner field populated for every asset; owners sign off on changes and decommissioning.
2-1-T-1
Tenant: extra asset management controls
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
1 sub-control
- 2-1-T-1-1 Inventory of cloud services and connected assets A current list of cloud services, accounts, integrations and related assets with owners.
2-2 · Identity and access management 2
2-2-P-1
Provider: extra identity and access controls
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
12 sub-controls
- 2-2-P-1-1 Shared and generic accounts traceable to a person Generic accounts are minimised, individually checked out or otherwise attributable.
- 2-2-P-1-2 Session authenticity checks, lockout and time-out Session tokens protected; idle and absolute time-outs; lockout after failed attempts.
- 2-2-P-1-3 MFA for privileged users and stack access MFA is mandatory, with no exceptions, for privileged and stack-level access.
- 2-2-P-1-4 Detection and blocking of unauthorised access attempts Lockout thresholds and alerts configured and monitored.
- 2-2-P-1-5 Passwords stored with secure methods No reversible password storage; modern hashing in use.
- 2-2-P-1-6 Secure life cycle for third-party staff accounts Sponsor, expiry, review and prompt removal for every third-party account.
- 2-2-P-1-7 Restricted access to management consoles Admin consoles reachable only from controlled networks and identities.
- 2-2-P-1-8 Authentication inputs masked on screen Password fields masked in every interface, including admin tools.
- 2-2-P-1-9 Tenant approval before accessing tenant assets A documented approval step before any provider access to tenant data or systems.
- 2-2-P-1-10 Ability to end remote sessions and block users at once Demonstrable kill-switch and disable capability for any user.
- 2-2-P-1-11 MFA offered to tenants for privileged users MFA available (and encouraged) for tenant privileged accounts.
- 2-2-P-1-12 Controlled access to storage systems Storage-layer access limited to named roles with logging.
2-2-T-1
Tenant: extra identity and access controls
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
5 sub-controls
- 2-2-T-1-1 Full life cycle management of cloud credentials Joiner, mover and leaver steps cover cloud accounts; periodic access reviews.
- 2-2-T-1-2 Cloud identities and credentials kept confidential Policy and training require secrecy; access-rights records are restricted.
- 2-2-T-1-3 Session authenticity checks, lockout and time-out Session controls configured in each cloud service.
- 2-2-T-1-4 MFA for privileged cloud users MFA mandatory on every privileged cloud account.
- 2-2-T-1-5 Detection and blocking of unauthorised cloud access Lockout thresholds and alerts on cloud accounts.
2-3 · Information system and processing facilities protection 2
2-3-P-1
Provider: extra system and facility protection
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
10 sub-controls
- 2-3-P-1-1 Configurations applied to security standards Hardening baselines exist and compliance is checked.
- 2-3-P-1-2 Tenant separation and isolation Tenant isolation is designed, tested and documented.
- 2-3-P-1-3 Minimum functionality configured Unneeded services, ports and features disabled by baseline.
- 2-3-P-1-4 Secure input validation and error handling in the stack Fail-secure behaviour and input validation demonstrated.
- 2-3-P-1-5 Security functions isolated from other functions Security tooling runs in separated environments with separate access.
- 2-3-P-1-6 Security features available to tenants are disclosed A published tenant security guide or shared-responsibility matrix.
- 2-3-P-1-7 Unauthorised software and system changes detected and blocked Integrity monitoring or equivalent with alerting.
- 2-3-P-1-8 Guest environments isolated from each other Hypervisor and container isolation controls in place and tested.
- 2-3-P-1-9 Government and CNI community cloud isolated from other offerings Physically or logically separate environment for in-scope tenants.
- 2-3-P-1-10 Endpoint detection and response for rapid incident handling EDR or equivalent deployed across the processing estate.
2-3-T-1
Tenant: extra system protection
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
1 sub-control
- 2-3-T-1-1 Community cloud isolation confirmed with the provider Provider evidence (architecture description, attestation) reviewed and kept.
2-4 · Networks security management 2
2-4-P-1
Provider: extra network security controls
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
6 sub-controls
- 2-4-P-1-1 Monitoring of internal and external traffic for anomalies Network monitoring with alerting covering both perimeters and internal segments.
- 2-4-P-1-2 Stack network isolated from other networks Segmentation and filtering between the stack and everything else.
- 2-4-P-1-3 Denial-of-service protection DDoS mitigation service or capability in place and tested.
- 2-4-P-1-4 Encrypted management traffic Admin channels use approved cryptography end to end.
- 2-4-P-1-5 Access control between network segments Rules between segments are documented, least-privilege and reviewed.
- 2-4-P-1-6 Service, management and corporate networks kept apart Three separate networks with controlled interconnects.
2-4-T-1
Tenant: extra network security controls
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
1 sub-control
- 2-4-T-1-1 Protected connection to the provider Encrypted, authenticated links (VPN, private connection or TLS) for all provider connectivity.
2-5 · Mobile devices security 2
2-5-P-1
Provider: extra mobile and end-user device controls
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
4 sub-controls
- 2-5-P-1-1 Inventory of end-user and mobile devices Complete device inventory kept current.
- 2-5-P-1-2 Central management of mobile device security MDM or equivalent enforcing policy on every device.
- 2-5-P-1-3 Screen locking enforced Automatic lock with short time-out enforced centrally.
- 2-5-P-1-4 Secure wiping and disposal of end-user devices Documented sanitisation and disposal records.
2-5-T-1
Tenant: extra mobile and end-user device controls
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
1 sub-control
- 2-5-T-1-1 Secure wiping and disposal of devices that reach cloud services Documented sanitisation and disposal records.
2-6 · Data and information protection 2
2-6-P-1
Provider: extra data protection controls
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
5 sub-controls
- 2-6-P-1-1 No unmasked production data outside production Policy plus technical masking; test data never contains raw production data.
- 2-6-P-1-2 Lawful, secure storage options for tenants Documented storage options (encryption, residency, retention) offered to tenants.
- 2-6-P-1-3 Secure disposal of tenant data at contract end Contractual and technical deletion with confirmation to the tenant.
- 2-6-P-1-4 Tenant data kept confidential as the law requires Confidentiality clauses in contracts and matching internal controls.
- 2-6-P-1-5 Secure export of tenant data and virtual infrastructure Export tools and documented, encrypted transfer routes.
2-6-T-1
Tenant: extra protection for data held in the cloud
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
2 sub-controls
- 2-6-T-1-1 Exit strategy with secure deletion at contract end A written exit plan with deletion confirmation and data retrieval steps.
- 2-6-T-1-2 Secure export of data and virtual infrastructure Encrypted, authenticated export and transfer routes.
2-7 · Cryptography 2
2-7-P-1
Provider: extra cryptography controls
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
2 sub-controls
- 2-7-P-1-1 Encryption at the advanced level of NCS-1:2020 Algorithms, key lengths and protocols mapped to NCS-1:2020 advanced level.
- 2-7-P-1-2 Secure or trusted certificate authority Certificate lifecycle managed; CA keys protected.
2-7-T-1
Tenant: extra cryptography controls
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
2 sub-controls
- 2-7-T-1-1 Encryption at the advanced level of NCS-1:2020 Algorithms, key lengths and protocols mapped to NCS-1:2020 advanced level.
- 2-7-T-1-2 Encryption of data moving in and out of the cloud Encryption in transit enforced for all cloud data flows.
2-8 · Backup and recovery management 1
2-8-P-1
Provider: extra backup and recovery controls
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
2 sub-controls
- 2-8-P-1-1 Tenant backups and media protected Encrypted backups, restricted access, secure storage and transfer.
- 2-8-P-1-2 Stack backups protected Encrypted, access-controlled stack backups with secure transfer.
2-9 · Vulnerabilities management 2
2-9-P-1
Provider: extra vulnerability management
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
2 sub-controls
- 2-9-P-1-1 Monthly external and quarterly internal vulnerability fixing Scan schedule and remediation records meet the monthly/quarterly cadence.
- 2-9-P-1-2 Tenants told about vulnerabilities that affect them Tenant notification process and examples.
2-9-T-1
Tenant: extra vulnerability management
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
2 sub-controls
- 2-9-T-1-1 Quarterly vulnerability assessment of cloud services Quarterly scans and remediation records.
- 2-9-T-1-2 Action on vulnerabilities the provider reports Provider notices logged, assessed and actioned.
2-10 · Penetration testing 1
2-10-P-1
Provider: extra penetration testing
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
1 sub-control
- 2-10-P-1-1 Six-monthly penetration tests covering the stack Test scope statements and reports every six months.
2-11 · Cybersecurity event logs and monitoring management 2
2-11-P-1
Provider: extra logging and monitoring
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
8 sub-controls
- 2-11-P-1-1 Stack event logs and audit trails enabled and protected Logging enabled across the stack; logs protected from tampering.
- 2-11-P-1-2 Login attempts logged Successful and failed logins collected centrally.
- 2-11-P-1-3 Staff actions at tenant level logged Provider-side tenant-level activity logs retained for forensics.
- 2-11-P-1-4 Logs protected from tampering and disclosure Write-once or integrity-protected storage; restricted access; retention per regulation.
- 2-11-P-1-5 Continuous SIEM monitoring across the stack SIEM ingests the full stack; 24/7 monitoring.
- 2-11-P-1-6 Periodic review of logs and audit trails Dated review records.
- 2-11-P-1-7 Remote sessions logged and monitored automatically Session logging for all remote access.
- 2-11-P-1-8 Personal data in logs handled securely Access to logs restricted; personal data minimised or masked.
2-11-T-1
Tenant: extra logging and monitoring
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
2 sub-controls
- 2-11-T-1-1 Login and security logs collected for cloud assets Cloud audit logging enabled and collected centrally.
- 2-11-T-1-2 Monitoring covers every enabled cloud security log Cloud logs feed your monitoring or SIEM.
2-12 · Cybersecurity incident and threat management 1
2-12-P-1
Provider: extra incident and threat management
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
8 sub-controls
- 2-12-P-1-1 Membership of authorised threat-intelligence groups Membership records and evidence intelligence is used.
- 2-12-P-1-2 Role-based incident response training Role-based incident training records.
- 2-12-P-1-3 Periodic tests of incident response Exercise reports with lessons learned.
- 2-12-P-1-4 Root cause analysis and remediation plans RCA reports and tracked actions.
- 2-12-P-1-5 Forensic support for tenants with chain of custody Forensic support procedure and chain-of-custody records.
- 2-12-P-1-6 Real-time reporting of incidents to affected tenants Notification SLA and examples.
- 2-12-P-1-7 Contracted support for tenant incident handling Contractual support terms and evidence of delivery.
- 2-12-P-1-8 Incident metrics and compliance monitoring Incident KPIs reported to management.
2-13 · Physical security 1
2-13-P-1
Provider: extra physical security
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
3 sub-controls
- 2-13-P-1-1 Continual monitoring of site access CCTV, access logs and guard records.
- 2-13-P-1-2 Stack devices protected from unauthorised physical access Locked racks, cages and access control on data halls.
- 2-13-P-1-3 Lawful, secure disposal of cloud hardware Disposal records with certificates of destruction.
2-14 · Web application security 1
2-14-P-1
Provider: extra web application security
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
1 sub-control
- 2-14-P-1-1 Application transactions protected in transit TLS, integrity checks and transaction controls on external web applications.
2-15 · Key management 8
2-15-P-1
Provider: key management requirements defined
The requirement is identified, documented, approved and demonstrably applied.
2-15-P-2
Provider: key management requirements applied
The requirement is identified, documented, approved and demonstrably applied.
2-15-P-3
Provider: minimum content of key management requirements
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
3 sub-controls
- 2-15-P-3-1 Owner assigned to every key Key inventory with owners.
- 2-15-P-3-2 Secure recovery of lost keys Key backup and recovery procedure, tested.
- 2-15-P-3-3 Key audit trails enabled and monitored Key-use logs feed monitoring.
2-15-P-4
Provider: key management requirements reviewed
The requirement is identified, documented, approved and demonstrably applied.
2-15-T-1
Tenant: key management requirements defined
The requirement is identified, documented, approved and demonstrably applied.
2-15-T-2
Tenant: key management requirements applied
The requirement is identified, documented, approved and demonstrably applied.
2-15-T-3
Tenant: minimum content of key management requirements
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
2 sub-controls
- 2-15-T-3-1 Owner assigned to every key you control Key inventory with owners.
- 2-15-T-3-2 Data recovery if a key is lost Key backup and recovery procedure, tested.
2-15-T-4
Tenant: key management requirements reviewed
The requirement is identified, documented, approved and demonstrably applied.
2-16 · System development security 4
2-16-P-1
Provider: system development security requirements defined
The requirement is identified, documented, approved and demonstrably applied.
2-16-P-2
Provider: system development security requirements applied
The requirement is identified, documented, approved and demonstrably applied.
2-16-P-3
Provider: life cycle content of development requirements
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
2 sub-controls
- 2-16-P-3-1 Stack security built into service design Security requirements in design reviews and acceptance criteria.
- 2-16-P-3-2 Development, test and integration environments protected Separate, access-controlled environments; test data controls.
2-16-P-4
Provider: system development requirements reviewed
The requirement is identified, documented, approved and demonstrably applied.
2-17 · Storage media security 4
2-17-P-1
Provider: storage media security requirements defined
The requirement is identified, documented, approved and demonstrably applied.
2-17-P-2
Provider: storage media security requirements applied
The requirement is identified, documented, approved and demonstrably applied.
2-17-P-3
Provider: minimum content of media requirements
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
6 sub-controls
- 2-17-P-3-1 Media sanitised before reuse or disposal Sanitisation procedure and records.
- 2-17-P-3-2 Secure disposal of media Approved disposal method with records.
- 2-17-P-3-3 Removable media data kept confidential and intact Encryption and integrity controls on removable media.
- 2-17-P-3-4 Media labelled with its classification Labelling standard applied.
- 2-17-P-3-5 Controlled, physically secure media storage Media register and locked storage.
- 2-17-P-3-6 Portable media restricted in the stack Port controls and exception process.
2-17-P-4
Provider: media requirements reviewed
The requirement is identified, documented, approved and demonstrably applied.
3-1 · Cybersecurity resilience in business continuity management 2
3-1-P-1
Provider: extra continuity and resilience controls
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
2 sub-controls
- 3-1-P-1-1 Secure disaster recovery and continuity procedures DR/BC procedures with security built in and tested.
- 3-1-P-1-2 Resilience of the security systems protecting the stack Resilience plans for security tooling (SIEM, IAM, EDR).
3-1-T-1
Tenant: extra continuity and resilience controls
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
1 sub-control
- 3-1-T-1-1 Secure disaster recovery and continuity for cloud use Cloud-specific DR/BC procedures, tested.
4-1 · Supply chain and third-party cybersecurity 1
4-1-P-1
Provider: extra third-party security controls
The requirement is identified, documented, approved and demonstrably applied through the sub-controls listed under it.
4 sub-controls
- 4-1-P-1-1 Marketplace items removed when NCA flags them as a threat Documented commitment and process.
- 4-1-P-1-2 Security documentation required from suppliers Security documentation held for each supplier product.
- 4-1-P-1-3 Third parties comply with the laws for their scope Supplier compliance evidence on file.
- 4-1-P-1-4 Third parties within risk management and governance Supplier risks in the risk register with owners.
Ready to assess against NCA CCC-2?
Book your onboarding →