The NCA cloud cybersecurity controls (CCC) are the National Cybersecurity Authority’s minimum cybersecurity requirements for cloud computing, written for cloud service providers and for the customers, called tenants, that use them. The current version is CCC-2:2024. It extends the NCA’s Essential Cybersecurity Controls (ECC) and is separate from the registration of cloud providers with the Communications, Space and Technology Commission (CST).
This is general information, not compliance advice. Confirm how the controls apply to your organisation with the NCA, your sector regulator or a qualified adviser.
Four documents, four different questions
Buyers often treat “NCA compliant” and “CST registered” as one assurance. The NCA cloud cybersecurity controls and CST registration answer different questions and come from different bodies.
| Document | Issued by | Question it answers |
|---|---|---|
| Essential Cybersecurity Controls (ECC-2:2024) | NCA | What baseline cybersecurity does an in-scope organisation need, including when it uses cloud services? |
| Cloud Cybersecurity Controls (CCC-2:2024) | NCA | Which further controls apply to a cloud provider and to a tenant using its service? |
| Cloud Computing Services Provisioning Regulations (version 4) | CST | May this provider offer cloud services in the Kingdom, and in which registration category? |
| Data localisation requirements | National Data Management Office (NDMO) at SDAIA | Where may particular data be hosted? The NCA says its own localisation controls were transferred to NDMO. |
Personal data raises a further question under the Personal Data Protection Law. Our guide to data residency in Saudi Arabia covers how the pieces fit for hosting decisions.
What are the NCA cloud cybersecurity controls?
The NCA cloud cybersecurity controls are a set of minimum requirements for cloud computing issued by the NCA, which describes itself as the national authority in charge of cybersecurity in the Kingdom. The NCA’s website lists CCC-2:2024 as the current version. It updates CCC-1:2020.
The controls sit in four domains: cybersecurity governance, cybersecurity defence, cybersecurity resilience and third-party cybersecurity. For providers the document counts 24 subdomains, 37 main controls and 94 subcontrols. Tenants have a shorter set over the same domains, with 18 main controls and 26 subcontrols. The third part of each control number shows who must act, with P for the provider and T for the tenant. Control 3-1-P-1-1 is a provider control and 3-1-T-1-1 a tenant control.
Requirements in the NCA cloud cybersecurity controls are graded in four levels that follow the classification of the data involved: Level 1 for top secret, Level 2 for secret, Level 3 for confidential and Level 4 for public. Some controls are optional at Level 4. Where a set of data mixes classifications, the document says to adopt the highest level.
Who must comply with the NCA cloud cybersecurity controls?
The CCC applies to cloud service providers (CSPs) that serve in-scope customers, and to those customers. The document defines in-scope tenants as government agencies in the Kingdom, inside or outside it, including ministries, authorities, establishments and their companies and sub-entities, together with private-sector entities that own, operate or host critical national infrastructure (CNI) and use or plan to use a cloud service.
It names two kinds of provider as outside its scope. One serves non-Saudi entities outside the Kingdom and has no in-scope tenants. The other serves only individuals and private-sector entities that do not own, operate or host CNI, again with no in-scope tenants. The test is therefore who the provider serves, and a provider with any in-scope tenant is itself in scope.
Compliance with the NCA cloud cybersecurity controls is evaluated by the NCA through self-assessment by entities, periodic reports from a compliance tool or on-site audits. The document states that its Arabic text is the binding version for interpretation.
NCA ECC and NCA CCC: how the two fit together
The NCA cloud cybersecurity controls do not replace the ECC. They add to it. The ECC applies to government agencies and their affiliated companies and entities, and to private-sector owners, operators or hosts of CNI. The NCA strongly encourages every other entity in the Kingdom to use it as good practice.
- For a tenant. ECC subdomain 4-2 (cloud computing and hosting cybersecurity) asks the entity to identify, document, approve and implement its cybersecurity requirements for cloud and hosting services. Control 4-2-3 sets a minimum: protect the entity’s data according to its classification, return it in a usable format when the service ends, and keep the entity’s virtual environments separate from other customers’. The CCC’s tenant controls extend this.
- For a provider. The CCC states that providers, whether or not they fall within the ECC’s own scope, must keep up continuous compliance with both the ECC and the CCC.
What the NCA cloud cybersecurity controls say about recovery, exit and data location
Three examples show how the controls divide responsibility between provider and tenant.
Disaster recovery. Provider control 3-1-P-1-1 asks for disaster recovery and business continuity procedures, developed and implemented securely. Tenant control 3-1-T-1-1 asks the tenant for the same, related to its use of cloud computing. A provider’s recovery capability does not remove your own plan, and our disaster recovery plan checklist covers what that plan should hold.
Exit. Tenant control 2-6-T-1-1 requires an exit strategy that ensures the secure disposal of data when the contract with the provider ends or expires.
Data location. Earlier editions went further. ECC-1:2018 sub-control 4-2-3-3 required an entity’s data to be hosted inside the Kingdom, and CCC-1:2020 controls 2-3-P-1-10 and 2-3-P-1-11 required providers to deliver services from inside the Kingdom, including storage, processing, disaster recovery, monitoring and support. ECC-2:2024 and CCC-2:2024 deleted these. The CCC-2:2024 change table says localisation controls were transferred to NDMO and tells entities to refer to NDMO on localisation before taking any action. Evidence that a provider meets the NCA cloud cybersecurity controls speaks to security. It does not settle where your data sits.
CST cloud computing regulatory framework and provider registration
Cloud service provider classification Saudi Arabia: how does it work?
Providers are classified in two separate ways. CST registers cloud computing service providers in one of four categories, Qualification, A, B or C, according to the subscriber data classification the provider qualifies to deal with. The NCA’s CCC then sets control levels 1 to 4 by data classification. These are separate frameworks, so a provider’s CST category does not answer questions about the NCA cloud cybersecurity controls, and the same holds the other way round. Ask about both.
CST’s registration service lists data centre certifications by class. Class A asks for a Tier 2 or higher constructed facility certificate, or ISO/IEC 27001 for the data centres. Classes B and C each list a Tier 3 or higher constructed facility and operational sustainability certificate. Applicants must also meet the service requirements in CST’s cloud computing framework and its guide.
The name has shifted over time. CST’s service pages still refer to the cloud computing regulatory framework, while the current text is the Cloud Computing Services Provisioning Regulations. CST decision 506/1445 of 8 October 2023 approved version 4 with updated guides, and they entered into force on 10 October 2023. The mapping from each category to the data classifications it may serve is set out in CST’s regulatory documents, so read the current text, or ask a provider to state its category and the classifications it covers in writing.
Questions to ask about the NCA cloud cybersecurity controls
- Which versions of the ECC and CCC do you evidence, and at which level, 1 to 4?
- What assessment evidence exists, such as a self-assessment, a compliance tool report or an on-site audit result, and for which scope?
- Which CST registration category do you hold, and which data classifications does it cover for my data?
- Which provider controls do you carry, and which fall to me as tenant, for example recovery and exit?
- Where are production data, backups and recovery copies held, and has localisation been confirmed with NDMO for my data classification?
- How is data returned and securely disposed of when the contract ends?
Turning the answers into an architecture is a design job, and the NCA cloud cybersecurity controls are one of its inputs. WASNA Digital Solutions designs sovereign, hybrid and multi-cloud architectures that put data residency and regulatory alignment first, then build performance and scalability on top.
Map your workloads to the right controls before you choose a provider
Bring a list of your main systems, the classification of the data each holds and any cloud services already in use. A WASNA Digital Solutions consultant will come back with the questions that shape the architecture.
Sources
- Cloud Cybersecurity Controls (CCC-2:2024). National Cybersecurity Authority (NCA). Listing page: nca.gov.sa. Accessed 2 October 2026.
- Essential Cybersecurity Controls (ECC-2:2024). National Cybersecurity Authority (NCA). Accessed 2 October 2026.
- About the NCA. National Cybersecurity Authority (NCA). Accessed 2 October 2026.
- Approval on the Update of the Cloud Computing Service Provisioning Regulations and its Guides (decision 506/1445, 8 October 2023). Communications, Space and Technology Commission (CST). Accessed 2 October 2026.
- Cloud Computing Registration. Communications, Space and Technology Commission (CST). Accessed 2 October 2026.
- Cloud Computing Registration. Saudi national portal (my.gov.sa), service provided by CST. Accessed 2 October 2026.
