CCC

The Cloud Cybersecurity Controls (CCC-1:2020) are Saudi Arabia's National Cybersecurity Authority requirements for cloud computing, written as an extension to the Essential Cybersecurity Controls (ECC).

They address two audiences at once: cloud service providers (CSPs) that host in-scope services, and cloud service tenants (CSTs), meaning the government bodies and critical infrastructure operators that consume them.

The controls sit in the same four domains as the ECC (governance, defense, resilience, third-party and cloud) and are tiered into levels that track the classification of the data a service handles, so a provider hosting more sensitive government workloads must meet more controls.

The NCA has issued a revised edition, CCC-2 (verify the publication date and transition timing on the NCA controls page). Anyone subject to the ECC who uses cloud must also comply with the CCC; the CCC does not replace the ECC.

In writing, a tenant needs a cloud policy and risk assessment, a data classification that drives which CCC level applies, contracts with providers that carry the NCA obligations, and monitoring records.

A provider needs a cybersecurity strategy and organization, documented controls for each CCC requirement at the level offered, data residency and segregation evidence for Saudi data, incident reporting procedures aligned to NCA timelines, and a compliance self-assessment. Both file compliance results with the NCA through its assessment tooling.