Saudi Arabia. Cybersecurity. Regulatory controls
CCCNCA Cloud Cybersecurity Controls (CCC)
In force
Partly verified
Low confidence.Not verified this session beyond NCA site structure.
§1Summary
- Synopsis
Extends the ECC with controls specific to cloud service providers and cloud service tenants serving government and CNI organisations.
- Key themes
- Unique features
Separate control sets for CSPs and CSTs; data classification drives where data may be hosted.
- SaaS relevance
Cloud SaaS providers serving Saudi government/CNI must comply and may need NCA assessment.
§2Obligations
- Extraterritorial
- Limited
- Cross-border transfers
- In-Kingdom hosting for higher classifications
§3Dates
- Key dates
- Adopted
- In force
- CCC-1:2020; updated edition reported 2024
§4Text and authority
- Text
- Authoritative text nca.gov.sa
- Authority
- National Cybersecurity Authority (NCA)
§5Where it applies
- Domestic law of
- Saudi Arabia
§6Sources and verification
- Sources consulted
- Verification
Low confidence.
Partly verified
Low confidence.Not verified this session beyond NCA site structure.