NCA CCC Cloud Compliance
Secure your cloud workloads under Saudi Arabia's Cloud Cybersecurity Controls: CSP evaluation, shared responsibility mapping, data residency compliance.
Cloud security under NCA
As Saudi organisations accelerate cloud adoption, the NCA's Cloud Cybersecurity Controls (CCC) framework establishes mandatory security requirements for cloud workloads. CCC works alongside NCA ECC, adding cloud-specific controls for data residency, shared responsibility, and cloud provider governance.
Whether you're a Cloud Service Provider (CSP) offering services in Saudi Arabia or a Cloud Service Tenant (CST) consuming cloud resources, NCA CCC defines your security obligations.
CCC control domains
Cloud Governance & Risk Management
Cloud security strategy, risk assessment, roles and responsibilities for cloud workloads.
Cloud Infrastructure Security
Network security, virtualisation security, container security, infrastructure hardening.
Cloud Data Protection
Data classification, encryption, key management, data residency compliance.
Cloud Identity & Access Management
Multi-factor authentication, privileged access, federation, identity lifecycle management.
Cloud Operations & Monitoring
Logging, monitoring, incident response, change management for cloud environments.
Cloud Business Continuity
Disaster recovery, backup strategies, resilience testing for cloud workloads.
Shared responsibility model
Understanding who owns which controls is critical for CCC compliance.
| Security Area | CSP Responsibility | CST Responsibility |
|---|---|---|
| Physical Infrastructure | Full | None |
| Virtualisation / Hypervisor | Full | Shared |
| Network Controls | Shared | Shared |
| Operating System | IaaS: Customer / PaaS: Shared | Full for IaaS |
| Application Security | SaaS: Full / PaaS: Shared | Full for IaaS/PaaS |
| Data Protection | Platform controls | Classification & encryption |
| Identity & Access | Platform IAM | User management & MFA |
| Compliance & Audit | Platform compliance | Workload compliance |
Secure your cloud workloads
Assess your cloud security posture against NCA CCC requirements.
NCA CCC Cloud Compliance FAQ
Find answers to common questions about our services