The NCA Cloud Cybersecurity Controls Framework (NCA CCCC), published by the National Cybersecurity Authority in late 2023, establishes mandatory and recommended cybersecurity controls for cloud computing environments in the Kingdom of Saudi Arabia. Despite its publication, many Saudi organizations remain uncertain whether the framework applies to their Office 365 tenant, their payment-gateway infrastructure-as-a-service deployment, or only to entities licensed as cloud service providers. This uncertainty stems from the framework's dual scope: it governs both organizations that provide cloud services and those that consume them, creating compliance obligations that extend far beyond traditional data-center operators.
Understanding the NCA cloud cybersecurity controls framework is essential for CISOs, cloud architects, and compliance managers who must determine whether their organization falls within scope, which controls apply, and how to demonstrate conformity during regulatory assessments or audits.
What the NCA Cloud Cybersecurity Controls Framework Covers
The NCA CCCC establishes cybersecurity requirements across five domains that mirror and extend the National Cybersecurity Authority's Essential Cybersecurity Controls (ECC). The framework applies to two distinct categories of entities: cloud service providers that offer infrastructure, platform, or software services to customers in the Kingdom, and cloud consumers that deploy workloads, store data, or process transactions using cloud infrastructure.
The five domains are:
Cybersecurity Governance addresses organizational structures, policies, risk management, and third-party oversight specific to cloud environments. This domain requires cloud consumers to establish accountability for data classification, residency decisions, and vendor management, while cloud providers must demonstrate governance over multi-tenant architectures and customer data segregation.
Cybersecurity Defense covers protective technologies including network segmentation, encryption, access controls, and vulnerability management. For cloud consumers, this domain focuses on configuration management, identity and access management for cloud resources, and encryption of data at rest and in transit. For cloud providers, it extends to hypervisor security, API protection, and infrastructure hardening.
Cybersecurity Resilience establishes requirements for business continuity, disaster recovery, backup strategies, and incident response in cloud contexts. Cloud consumers must ensure recovery-time objectives can be met using cloud-native or hybrid architectures, while cloud providers must demonstrate redundancy, failover capabilities, and customer data recovery mechanisms.
Third-Party and Cloud Computing Cybersecurity addresses the unique risks of cloud supply chains, including subprocessor management, portability, and vendor lock-in. This domain requires both consumers and providers to maintain inventories of cloud dependencies, assess concentration risk, and establish exit strategies.
Cybersecurity Operations covers logging, monitoring, threat detection, and security operations center capabilities. Cloud consumers must ensure visibility into cloud workloads and integration with enterprise SIEM platforms, while cloud providers must offer audit logs, alerting mechanisms, and support for customer security operations.
Essential Controls Versus Proactive Controls
The NCA CCCC distinguishes between two tiers of controls. Essential controls are mandatory for all entities within scope and represent the minimum acceptable cybersecurity posture. Proactive controls are recommended for organizations handling sensitive data, operating critical infrastructure, or seeking to exceed baseline requirements.
Essential controls typically address foundational security practices: multi-factor authentication for administrative access, encryption of sensitive data, logging of security events, and documented incident-response procedures. Proactive controls extend these baselines with advanced capabilities such as automated threat hunting, zero-trust architectures, continuous compliance monitoring, and advanced data-loss prevention.
The distinction matters because regulatory assessments and audits conducted by the NCA or sector regulators such as SAMA focus first on essential controls. Organizations that cannot demonstrate conformity with essential controls face enforcement actions, while proactive controls serve as evidence of cybersecurity maturity during risk-based examinations.
When the Framework Applies to Your Organization
Three factors determine whether the NCA CCCC applies to a specific cloud deployment: the classification of data processed or stored, the location of infrastructure, and the entity type.
Data Classification
The framework applies when cloud environments process or store data classified as sensitive or critical under the NCA Data Classification Framework. Sensitive data includes personally identifiable information, financial records, health information, and confidential business data. Critical data includes national security information, critical infrastructure data, and data whose compromise would cause severe harm to national interests.
Organizations that use cloud services exclusively for public information or non-sensitive internal communications may fall outside the framework's scope, though sector-specific regulations from SAMA, CITC, or other authorities may impose parallel requirements.
Infrastructure Location
The NCA CCCC applies differently based on whether cloud infrastructure resides within the Kingdom or abroad. For infrastructure located in Saudi Arabia, the framework applies in full to both providers and consumers. For infrastructure located outside the Kingdom, the framework applies to Saudi entities that consume those services when processing sensitive or critical data, though certain controls related to physical security and data residency may be satisfied through contractual commitments rather than direct implementation.
Cloud consumers must assess whether their chosen deployment model—public cloud, private cloud, hybrid, or multi-cloud—affects the applicability and implementation approach for specific controls.
Entity Type
The framework explicitly applies to government entities, critical infrastructure operators, and entities regulated by SAMA, CITC, or other sector authorities. It also applies to any organization that provides cloud services to customers in the Kingdom, regardless of the provider's own domicile.
Commercial entities not subject to sector regulation must evaluate applicability based on data classification and infrastructure location. A Saudi retailer using a SaaS platform for customer relationship management that processes customer contact information would likely fall within scope for controls related to access management, encryption, and vendor oversight, even if the retailer itself is not a regulated financial institution.
How the Framework Relates to NCA ECC
The NCA CCCC does not replace the Essential Cybersecurity Controls; rather, it extends and tailors ECC requirements for cloud contexts. Organizations subject to both frameworks must implement ECC as the foundation and apply CCCC controls as cloud-specific overlays.
For example, ECC requires organizations to implement access controls and maintain audit logs. The CCCC extends these requirements by specifying that cloud administrative interfaces must enforce multi-factor authentication, that logs must capture API calls and configuration changes, and that cloud consumers must ensure logging capabilities are enabled and integrated with enterprise monitoring systems.
This relationship means that compliance assessments for cloud environments typically evaluate both frameworks in parallel, examining whether general cybersecurity controls from ECC are properly implemented and whether cloud-specific extensions from CCCC are addressed.
Common Misunderstandings About Scope
Several misconceptions persist about when the NCA CCCC applies:
"It only applies to cloud service providers." The framework explicitly covers cloud consumers, and many controls are written specifically for organizations that use rather than provide cloud services. A bank using IaaS for its mobile banking application is a cloud consumer subject to CCCC requirements for that deployment.
"SaaS applications are exempt." Cloud consumers using SaaS platforms remain responsible for controls they can influence, including user access management, data classification, encryption in transit, and vendor risk assessment. The framework recognizes the shared responsibility model but does not exempt consumers from all obligations.
"Our cloud provider's compliance certificates cover our obligations." A cloud provider's ISO 27001 certification or SOC 2 report addresses the provider's controls, not the consumer's configuration choices, access policies, or data-handling practices. Cloud consumers must implement their portion of the shared responsibility model regardless of provider certifications.
"We can ignore it if our data is encrypted." Encryption is one control among many. Organizations must still address governance, access management, resilience, monitoring, and third-party risk even when data is encrypted.
Determining Applicability: Three Decision Criteria
Organizations uncertain about applicability should evaluate three questions:
First, does your cloud deployment process or store data classified as sensitive or critical under NCA guidance? If yes, the framework applies to controls within your sphere of responsibility under the shared responsibility model.
Second, are you subject to sector regulation from SAMA, CITC, or another authority that references NCA frameworks? If yes, your regulator likely expects conformity with CCCC for cloud deployments, and this expectation may appear in examination procedures or supervisory guidance.
Third, do you provide cloud services—infrastructure, platform, or software—to customers in the Kingdom? If yes, you are a cloud service provider under the framework and must implement both provider-specific and general controls.
Organizations that answer yes to any of these questions should conduct a formal applicability assessment and gap analysis against the framework's essential controls.
Practical Steps for Organizations Within Scope
Once applicability is confirmed, organizations should map their current cloud architecture to the framework's five domains, identifying which controls fall within their responsibility under the shared responsibility model. For IaaS deployments, consumers typically own most controls above the hypervisor layer. For SaaS deployments, consumers own access management, data classification, and acceptable-use policies, while the provider owns infrastructure and platform controls.
Next, organizations should inventory all cloud deployments, including shadow IT and departmental SaaS subscriptions that may not appear in enterprise architecture documentation. Many organizations discover during this inventory that their actual cloud footprint exceeds what IT leadership believed was in production.
Organizations should then assess conformity with essential controls, documenting evidence of implementation and identifying gaps. This assessment should consider not only technical controls but also governance, policy, and procedural requirements that the framework mandates.
Finally, organizations should establish ongoing monitoring and periodic reassessment processes, because cloud environments change frequently through configuration updates, new service adoption, and infrastructure scaling.
How We Support Cloud Compliance Assessments
Organizations that determine they fall within the NCA Cloud Cybersecurity Controls Framework's scope often require specialized support to interpret requirements, assess current posture, and plan remediation.
Our Regulatory Updates service helps organizations stay ahead of changes to NCA, SAMA, and other regulatory frameworks, providing timely intelligence, impact analysis, and practical implementation guidance. This service supports compliance teams in understanding how new or updated frameworks such as the NCA CCCC affect their existing obligations and what actions they must take to maintain conformity.
When you need clarity on whether the NCA Cloud Cybersecurity Controls Framework applies to your cloud deployments, how its requirements map to your architecture, or what steps will demonstrate conformity during regulatory examinations, we provide the analysis and documentation that turns regulatory uncertainty into actionable compliance plans.
