The NCA's Cloud Cybersecurity Controls add cloud-specific duties on top of its Essential Cybersecurity Controls (ECC). They are split into controls for cloud service providers (CSP, marked P) and for cloud tenants, the customers (CST, marked T), across four domains and 24 subdomains.
Free account needed to download. You come straight back to the file.
Who it is for. Cloud service providers that serve government bodies or entities that own, operate or host Saudi critical national infrastructure, and those customers themselves: government agencies, inside or outside the Kingdom, and private entities running critical national infrastructure that use or plan to use cloud services. The NCA encourages everyone else to adopt them as good practice.
What this list covers. CCC-2:2024, the English text published by the National Cybersecurity Authority (NCA), which replaces CCC-1:2020. Read November 2026. The NCA says the Arabic version governs and that its website holds the latest version, so check there for later changes: 175 controls. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it requires |
|---|---|---|
| 1-1-P-1 | CSP: Cloud security roles and RACI, main control | CSP: on top of ECC 1-4-1, cover at least the extra points on cloud security roles and RACI listed in 1-1-P-1-1. |
| 1-1-P-1-1 | CSP: cloud security roles and RACI | CSP: on top of ECC 1-4-1, the Authorizing Official (head of the provider or their delegate) defines, documents and approves cyber roles and a RACI for everyone involved in the cloud services, including that official's own. |
| 1-1-T-1 | CST: Cloud security roles and RACI, main control | CST: on top of ECC 1-4-1, cover at least the extra points on cloud security roles and RACI listed in 1-1-T-1-1. |
| 1-1-T-1-1 | CST: cloud security roles and RACI | CST: on top of ECC 1-4-1, the Authorizing Official (head of the tenant or their delegate) defines, documents and approves cyber roles and a RACI for everyone involved in the cloud services, including that official's own. |
| Ref | Control | What it requires |
|---|---|---|
| 1-2-P-1 | CSP: Cloud risk management, main control | CSP: on top of the ECC risk method in subdomain 1-5, cover at least the extra points on cloud risk management listed in 1-2-P-1-1 to 1-2-P-1-3. |
| 1-2-P-1-1 | CSP: acceptable risk levels for cloud services | CSP: extend the ECC risk method by setting acceptable risk levels for the cloud services, and tell tenants about any that touch them. |
| 1-2-P-1-2 | CSP: data classification in risk management | CSP: build data and information classification into the cyber risk management method. |
| 1-2-P-1-3 | CSP: cloud risk register | CSP: keep a cyber risk register for the cloud services and review it regularly in line with the risks. |
| 1-2-T-1 | CST: Cloud risk management, main control | CST: on top of the ECC risk method in subdomain 1-5, cover at least the extra points on cloud risk management listed in 1-2-T-1-1 to 1-2-T-1-3. |
| 1-2-T-1-1 | CST: acceptable risk levels for cloud services | CST: extend the ECC risk method by setting acceptable risk levels for the cloud services you use. |
| 1-2-T-1-2 | CST: your data classification in risk management | CST: build the data and information classification you have adopted into the cyber risk management method. |
| 1-2-T-1-3 | CST: cloud risk register | CST: keep a cyber risk register for the cloud services you use and review it regularly in line with the risks. |
| Ref | Control | What it requires |
|---|---|---|
| 1-3-P-1 | CSP: Legal and regulatory compliance, main control | CSP: on top of ECC 1-7-1, cover at least the extra points on legal and regulatory compliance listed in 1-3-P-1-1. |
| 1-3-P-1-1 | CSP: continuous legal and regulatory compliance | CSP: on top of ECC 1-7-1, keep complying, without gaps, with every Saudi law, regulation, decision, framework and mandate that deals with cybersecurity. |
| 1-3-T-1 | CST: Legal and regulatory compliance, main control | CST: on top of ECC 1-7-1, cover at least the extra points on legal and regulatory compliance listed in 1-3-T-1-1. |
| 1-3-T-1-1 | CST: watch the provider's compliance | CST: on top of ECC 1-7-1, monitor on a continuous or real-time basis whether your cloud provider is meeting the relevant cyber legislation and the clauses of your contract. |
| Ref | Control | What it requires |
|---|---|---|
| 1-4-P-1 | CSP: Staff screening and policies, main control | CSP: on top of ECC 1-9-3 and 1-9-4, cover at least the extra points on staff screening and policies listed in 1-4-P-1-1 to 1-4-P-1-3. |
| 1-4-P-1-1 | CSP: Saudi nationals in data-centre security roles | CSP: cyber roles in your data centres inside the Kingdom are filled by suitably qualified Saudi nationals. Applies alongside ECC 1-9-3 and 1-9-4. |
| 1-4-P-1-2 | CSP: periodic screening of staff with stack access | CSP: screen or vet, and re-vet from time to time, staff based inside the Kingdom who can reach the Cloud Technology Stack. |
| 1-4-P-1-3 | CSP: signed policies before stack access | CSP: staff must sign cyber policies, properly approved, before they are given access to the Cloud Technology Stack. |
| 1-4-P-2 | CSP: Asset recovery at leaving, main control | CSP: on top of ECC 1-9-5, cover at least the extra points on asset recovery at leaving listed in 1-4-P-2-1. |
| 1-4-P-2-1 | CSP: recover assets at leaving | CSP: when someone leaves or their engagement ends, make sure assets the entity owns, especially security-sensitive ones, are accounted for and handed back. Applies alongside ECC 1-9-5. |
| 1-4-T-1 | CST: Staff screening, main control | CST: on top of ECC 1-9-3, cover at least the extra points on staff screening listed in 1-4-T-1-1. |
| 1-4-T-1-1 | CST: vet staff in sensitive cloud functions | CST: before they start, screen or vet people who will hold sensitive cloud functions, such as key management, service administration and access control. Applies alongside ECC 1-9-3. |
| Ref | Control | What it requires |
|---|---|---|
| 1-5-P-1 | CSP: define change management requirements | CSP: identify, document and approve the cyber requirements for change management in your own organisation. |
| 1-5-P-2 | CSP: apply change management requirements | CSP: put the approved cyber change management requirements into practice. |
| 1-5-P-3 | CSP: Secure change management, minimum content | CSP: cover at least the change management points listed in 1-5-P-3-1 to 1-5-P-3-2. |
| 1-5-P-3-1 | CSP: secure planned changes | CSP: have processes to roll out planned changes to production systems securely, giving priority to security findings. |
| 1-5-P-3-2 | CSP: secure emergency changes | CSP: have a process for exceptional, urgent changes that still protects security, for example changes made while recovering from an incident. |
| 1-5-P-4 | CSP: review change management | CSP: apply the change management requirements and review them on a regular cycle. |
| Ref | Control | What it requires |
|---|---|---|
| 2-1-P-1 | CSP: Asset inventory and ownership, main control | CSP: on top of ECC 2-1, cover at least the extra points on asset inventory and ownership listed in 2-1-P-1-1 to 2-1-P-1-2. |
| 2-1-P-1-1 | CSP: technical asset inventory | CSP: on top of ECC 2-1, keep an inventory of all information and technology assets using a CMDB or similar tool that lists every technical asset. |
| 2-1-P-1-2 | CSP: asset owners | CSP: name an owner for each asset and involve owners across the asset's life. |
| 2-1-T-1 | CST: Asset inventory and ownership, main control | CST: on top of ECC 2-1, cover at least the extra points on asset inventory and ownership listed in 2-1-T-1-1. |
| 2-1-T-1-1 | CST: inventory of cloud services and related assets | CST: on top of ECC 2-1, keep an inventory of every cloud service you use and of the information and technology assets tied to those services. |
| Ref | Control | What it requires |
|---|---|---|
| 2-2-P-1 | CSP: Identity and access management, main control | CSP: on top of ECC 2-2-3, cover at least the extra points on identity and access management listed in 2-2-P-1-1 to 2-2-P-1-12. |
| 2-2-P-1-1 | CSP: generic account credentials | CSP: manage generic account credentials so that accountability is kept, and no such account is tied to one named person. Extends ECC 2-2-3. |
| 2-2-P-1-2 | CSP: secure session management | CSP: manage sessions securely, covering session authenticity, lockout and timeout. |
| 2-2-P-1-3 | CSP: MFA for privileged users and stack staff | CSP: require multi-factor authentication for privileged users and for personnel who can access the Cloud Technology Stack. |
| 2-2-P-1-4 | CSP: detect and block unauthorised access | CSP: run a formal process to detect and stop unauthorised access, for example a limit on failed login attempts. |
| 2-2-P-1-5 | CSP: secure password storage | CSP: store and process passwords using secure methods and algorithms, such as secure hashing. |
| 2-2-P-1-6 | CSP: third-party staff accounts | CSP: manage accounts used by third-party personnel securely. |
| 2-2-P-1-7 | CSP: protect admin consoles | CSP: enforce access control on management systems and administrative consoles. |
| 2-2-P-1-8 | CSP: mask authentication inputs | CSP: mask what is typed or shown during authentication, passwords especially, so it cannot be read over a shoulder. |
| 2-2-P-1-9 | CSP: tenant approval before touching tenant assets | CSP: get the tenant's approval before you or your third parties access any asset that belongs to that tenant. |
| 2-2-P-1-10 | CSP: cut off remote sessions at once | CSP: be able to end a remote access session immediately and block that user from any later access. |
| 2-2-P-1-11 | CSP: offer MFA to tenants | CSP: give tenants multi-factor authentication services for their privileged cloud users. |
| 2-2-P-1-12 | CSP: control access to storage systems | CSP: make sure access to storage systems and storage means, such as a SAN, is restricted and controlled. |
| 2-2-T-1 | CST: Identity and access management, main control | CST: on top of ECC 2-2-3, cover at least the extra points on identity and access management listed in 2-2-T-1-1 to 2-2-T-1-5. |
| 2-2-T-1-1 | CST: cloud credentials through their life | CST: on top of ECC 2-2-3, manage every cloud credential through its whole lifecycle. |
| 2-2-T-1-2 | CST: keep cloud identities and rights confidential | CST: keep cloud user identities, credentials and access rights confidential, and require employees, third parties and tenant personnel to keep them private. |
| 2-2-T-1-3 | CST: secure cloud session management | CST: manage cloud sessions securely, covering session authenticity, lockout and timeout. |
| 2-2-T-1-4 | CST: MFA for privileged cloud users | CST: require multi-factor authentication for privileged users of the cloud services. |
| 2-2-T-1-5 | CST: detect and block unauthorised cloud access | CST: run a formal process to detect and stop unauthorised access to the cloud, for example a limit on failed login attempts. |
| Ref | Control | What it requires |
|---|---|---|
| 2-3-P-1 | CSP: System and processing facility protection, main control | CSP: on top of ECC 2-3-3, cover at least the extra points on system and processing facility protection listed in 2-3-P-1-1 to 2-3-P-1-10. |
| 2-3-P-1-1 | CSP: configurations follow your standards | CSP: on top of ECC 2-3-3, make sure every configuration is applied in line with your own cyber standards. |
| 2-3-P-1-2 | CSP: separation between tenants | CSP: separate and isolate data, environments and systems across tenants so that tenant data never mixes. |
| 2-3-P-1-3 | CSP: minimum functionality in configurations | CSP: configure systems on the principle of minimum functionality. |
| 2-3-P-1-4 | CSP: handle bad input and failures safely | CSP: the Cloud Technology Stack must cope securely with input validation, exceptions and failures. |
| 2-3-P-1-5 | CSP: isolate security functions | CSP: fully isolate security functions and applications from other functions and applications in the Cloud Technology Stack. |
| 2-3-P-1-6 | CSP: tell tenants the security requirements they can use | CSP: notify tenants of the cyber requirements you provide that tenants are able to use. |
| 2-3-P-1-7 | CSP: detect and block unauthorised changes | CSP: detect and prevent unauthorised changes to software programs and systems. |
| 2-3-P-1-8 | CSP: isolate guest environments | CSP: completely isolate and protect multiple guest environments from one another. |
| 2-3-P-1-9 | CSP: isolate community cloud from out-of-scope clouds | CSP: keep community cloud services for government and critical-infrastructure tenants isolated from cloud services offered to entities outside the CCC's scope. |
| 2-3-P-1-10 | CSP: modern endpoint detection and response | CSP: use modern technology such as EDR on servers and devices so the provider's processing systems can respond quickly to incidents. |
| 2-3-T-1 | CST: System and processing facility protection, main control | CST: on top of ECC 2-3-3, cover at least the extra points on system and processing facility protection listed in 2-3-T-1-1. |
| 2-3-T-1-1 | CST: check the provider isolates community cloud | CST: on top of ECC 2-3-3, check that your provider keeps community cloud services for government and critical-infrastructure tenants isolated from services for entities outside scope. |
| Ref | Control | What it requires |
|---|---|---|
| 2-4-P-1 | CSP: Network security, main control | CSP: on top of ECC 2-5-3, cover at least the extra points on network security listed in 2-4-P-1-1 to 2-4-P-1-6. |
| 2-4-P-1-1 | CSP: watch network traffic for anomalies | CSP: on top of ECC 2-5-3, monitor traffic on external and internal networks to spot anomalies. |
| 2-4-P-1-2 | CSP: isolate the stack network | CSP: isolate and protect the Cloud Technology Stack network from other internal and external networks. |
| 2-4-P-1-3 | CSP: denial-of-service protection | CSP: protect against denial-of-service attacks, including distributed ones. |
| 2-4-P-1-4 | CSP: encrypt management traffic to and from the stack | CSP: protect data crossing the network to and from the Cloud Technology Stack network with cryptography, including management and administrative access. |
| 2-4-P-1-5 | CSP: control access between segments | CSP: control access between different network segments. |
| 2-4-P-1-6 | CSP: separate delivery, management and enterprise networks | CSP: keep the cloud service delivery network, the cloud management network and the provider's own enterprise network isolated from one another. |
| 2-4-T-1 | CST: Network security, main control | CST: on top of ECC 2-5-3, cover at least the extra points on network security listed in 2-4-T-1-1. |
| 2-4-T-1-1 | CST: protect the link to the provider | CST: on top of ECC 2-5-3, protect the connection channel between your organisation and the cloud provider. |
| Ref | Control | What it requires |
|---|---|---|
| 2-5-P-1 | CSP: Mobile device security, main control | CSP: on top of ECC 2-6-3, cover at least the extra points on mobile device security listed in 2-5-P-1-1 to 2-5-P-1-4. |
| 2-5-P-1-1 | CSP: inventory of end-user and mobile devices | CSP: on top of ECC 2-6-3, keep an inventory of all end-user and mobile devices. |
| 2-5-P-1-2 | CSP: central mobile device management | CSP: manage mobile device security from a central point. |
| 2-5-P-1-3 | CSP: screen lock on end-user devices | CSP: lock the screens of end-user devices when they are idle. |
| 2-5-P-1-4 | CSP: wipe and dispose of end-user devices | CSP: sanitise data on end-user devices and dispose of them securely, above all those that can reach the Cloud Technology Stack. |
| 2-5-T-1 | CST: Mobile device security, main control | CST: on top of ECC 2-6-3, cover at least the extra points on mobile device security listed in 2-5-T-1-1. |
| 2-5-T-1-1 | CST: wipe and dispose of devices with cloud access | CST: on top of ECC 2-6-3, sanitise data on end-user devices that can access the cloud services and dispose of them securely. |
| Ref | Control | What it requires |
|---|---|---|
| 2-6-P-1 | CSP: Data and information protection, main control | CSP: on top of ECC 2-7-3, cover at least the extra points on data and information protection listed in 2-6-P-1-1 to 2-6-P-1-5. |
| 2-6-P-1-1 | CSP: no stack data outside production without protection | CSP: on top of ECC 2-7-3, do not use Cloud Technology Stack data outside production unless strict protection such as masking or scrambling is applied first. |
| 2-6-P-1-2 | CSP: secure storage for tenants | CSP: give tenants secure data storage processes, procedures and technology that help them meet legal and regulatory requirements. |
| 2-6-P-1-3 | CSP: secure disposal of tenant data at exit | CSP: dispose of a tenant's data securely when the contract ends or expires. |
| 2-6-P-1-4 | CSP: keep tenant data confidential | CSP: commit to keeping tenant data and information confidential, as the law and regulations require. |
| 2-6-P-1-5 | CSP: secure export and transfer for tenants | CSP: give tenants secure ways to export and transfer their data and virtual infrastructure. |
| 2-6-T-1 | CST: Data and information protection, main control | CST: on top of ECC 2-7-3, cover at least the extra points on data and information protection listed in 2-6-T-1-1 to 2-6-T-1-2. |
| 2-6-T-1-1 | CST: exit strategy and secure disposal | CST: on top of ECC 2-7-3, have an exit strategy that ensures your data is disposed of securely when the contract with the provider ends or expires. |
| 2-6-T-1-2 | CST: secure export and transfer | CST: use secure means to export and transfer your data and virtual infrastructure. |
| Ref | Control | What it requires |
|---|---|---|
| 2-7-P-1 | CSP: Cryptography, main control | CSP: on top of ECC 2-8-3, cover at least the extra points on cryptography listed in 2-7-P-1-1 to 2-7-P-1-2. |
| 2-7-P-1-1 | CSP: strong encryption to the NCS advanced level | CSP: on top of ECC 2-8-3, use strong encryption mechanisms and primitives that meet the advanced level of the National Cryptographic Standards (NCS-1:2020). |
| 2-7-P-1-2 | CSP: certificate authority or trusted certificates | CSP: either run a certification authority and issue certificates securely, or use certificates from a trusted certification authority. |
| 2-7-T-1 | CST: Cryptography, main control | CST: on top of ECC 2-8-3, cover at least the extra points on cryptography listed in 2-7-T-1-1 to 2-7-T-1-2. |
| 2-7-T-1-1 | CST: strong encryption to the NCS advanced level | CST: on top of ECC 2-8-3, use strong encryption mechanisms and primitives that meet the advanced level of the National Cryptographic Standards (NCS-1:2020). |
| 2-7-T-1-2 | CST: encrypt data moving to and from the cloud | CST: encrypt information sent to or from the cloud as the relevant law and regulations require. |
| Ref | Control | What it requires |
|---|---|---|
| 2-8-P-1 | CSP: Backup and recovery, main control | CSP: on top of ECC 2-9-3, cover at least the extra points on backup and recovery listed in 2-8-P-1-1 to 2-8-P-1-2. |
| 2-8-P-1-1 | CSP: protect tenant data backups | CSP: on top of ECC 2-9-3, secure access to, storage and transfer of tenant data backups and their media, guarding them from damage, alteration and unauthorised access. |
| 2-8-P-1-2 | CSP: protect stack backups | CSP: on top of ECC 2-9-3, secure access to, storage and transfer of Cloud Technology Stack backups and their media, guarding them from damage, alteration and unauthorised access. |
| Ref | Control | What it requires |
|---|---|---|
| 2-9-P-1 | CSP: Vulnerability management, main control | CSP: on top of ECC 2-10-3, cover at least the extra points on vulnerability management listed in 2-9-P-1-1 to 2-9-P-1-2. |
| 2-9-P-1-1 | CSP: assess and fix vulnerabilities on a fixed cycle | CSP: on top of ECC 2-10-3, assess and fix vulnerabilities in external parts of the Cloud Technology Stack at least monthly, and in internal parts at least every three months. |
| 2-9-P-1-2 | CSP: tell tenants about vulnerabilities that affect them | CSP: notify tenants of identified vulnerabilities that may affect them, and of the safeguards in place. |
| 2-9-T-1 | CST: Vulnerability management, main control | CST: on top of ECC 2-10-3, cover at least the extra points on vulnerability management listed in 2-9-T-1-1 to 2-9-T-1-2. |
| 2-9-T-1-1 | CST: assess and fix cloud vulnerabilities quarterly | CST: on top of ECC 2-10-3, assess and fix vulnerabilities in your cloud services at least every three months. |
| 2-9-T-1-2 | CST: act on provider vulnerability notices | CST: manage the vulnerabilities your provider notifies you about, and the safeguards in place against them. |
| Ref | Control | What it requires |
|---|---|---|
| 2-10-P-1 | CSP: Penetration testing, main control | CSP: on top of ECC 2-11-3, cover at least the extra points on penetration testing listed in 2-10-P-1-1. |
| 2-10-P-1-1 | CSP: penetration tests of the stack every six months | CSP: on top of ECC 2-11-3, run penetration tests that cover the Cloud Technology Stack at least once every six months. |
| Ref | Control | What it requires |
|---|---|---|
| 2-11-P-1 | CSP: Event logs and monitoring, main control | CSP: on top of ECC 2-12-3, cover at least the extra points on event logs and monitoring listed in 2-11-P-1-1 to 2-11-P-1-8. |
| 2-11-P-1-1 | CSP: enable and protect stack logs and audit trails | CSP: on top of ECC 2-12-3, switch on and protect event logs and audit trails across the Cloud Technology Stack. |
| 2-11-P-1-2 | CSP: collect login attempt history | CSP: switch on and collect the history of login attempts. |
| 2-11-P-1-3 | CSP: log your actions on tenant environments | CSP: switch on and protect event logs of everything you do at tenant level, so forensic analysis is possible. |
| 2-11-P-1-4 | CSP: protect logs from tampering and leaks | CSP: protect event logs from alteration, disclosure, destruction, unauthorised access and unauthorised release, as law and regulation require. |
| 2-11-P-1-5 | CSP: continuous SIEM monitoring of the whole stack | CSP: monitor cyber events continuously with a SIEM technique that covers the full Cloud Technology Stack. |
| 2-11-P-1-6 | CSP: periodic review of logs and audit trails | CSP: review event logs and audit trails regularly, covering provider events in the Cloud Technology Stack. |
| 2-11-P-1-7 | CSP: automated logging of remote sessions | CSP: monitor and log remote access sessions automatically. |
| 2-11-P-1-8 | CSP: handle user data in logs securely | CSP: handle user-related data found in audit trails and event logs securely. |
| 2-11-T-1 | CST: Event logs and monitoring, main control | CST: on top of ECC 2-12-3, cover at least the extra points on event logs and monitoring listed in 2-11-T-1-1 to 2-11-T-1-2. |
| 2-11-T-1-1 | CST: collect login and security logs for cloud assets | CST: on top of ECC 2-12-3, switch on and collect login logs and cyber event logs on the assets tied to your cloud services. |
| 2-11-T-1-2 | CST: monitor all enabled cloud logs | CST: make sure monitoring covers every cyber log you have switched on for your cloud services. |
| Ref | Control | What it requires |
|---|---|---|
| 2-12-P-1 | CSP: Incident and threat management, main control | CSP: on top of ECC 2-13-3, cover at least the extra points on incident and threat management listed in 2-12-P-1-1 to 2-12-P-1-8. |
| 2-12-P-1-1 | CSP: subscribe to threat intelligence sources | CSP: on top of ECC 2-13-3, subscribe to authorised, specialist bodies and groups to stay current on threats, good practice and know-how. |
| 2-12-P-1-2 | CSP: incident response training | CSP: train employees and third-party personnel to respond to incidents, matched to their roles. |
| 2-12-P-1-3 | CSP: test incident response | CSP: test your incident response capability regularly. |
| 2-12-P-1-4 | CSP: root cause analysis | CSP: find the root cause of cyber incidents and plan how to fix it. |
| 2-12-P-1-5 | CSP: support tenants in legal cases and forensics | CSP: help tenants with legal proceedings and forensics, and protect the chain of custody for what you manage, in line with law and regulation. |
| 2-12-P-1-6 | CSP: report incidents to affected tenants in real time | CSP: report to a tenant, in real time, any incident that may affect it once the incident is found. |
| 2-12-P-1-7 | CSP: help tenants handle incidents | CSP: support tenants in handling security incidents as agreed between you and them. |
| 2-12-P-1-8 | CSP: incident metrics and compliance | CSP: measure and monitor incident metrics, and monitor compliance with contracts and legislative requirements. |
| Ref | Control | What it requires |
|---|---|---|
| 2-13-P-1 | CSP: Physical security, main control | CSP: on top of ECC 2-14-3, cover at least the extra points on physical security listed in 2-13-P-1-1 to 2-13-P-1-3. |
| 2-13-P-1-1 | CSP: monitor access to sites and buildings | CSP: on top of ECC 2-14-3, continually monitor access to your sites and buildings. |
| 2-13-P-1-2 | CSP: stop physical access to stack devices | CSP: prevent unauthorised access to devices in the Cloud Technology Stack. |
| 2-13-P-1-3 | CSP: dispose of cloud hardware properly | CSP: dispose of cloud infrastructure hardware, storage equipment above all, following the relevant legislation and good practice. |
| Ref | Control | What it requires |
|---|---|---|
| 2-14-P-1 | CSP: Web application security, main control | CSP: on top of ECC 2-15-3, cover at least the extra points on web application security listed in 2-14-P-1-1. |
| 2-14-P-1-1 | CSP: protect transaction information | CSP: on top of ECC 2-15-3, protect information in application service transactions from risks such as incomplete transmission, mis-routing, alteration and disclosure. |
| Ref | Control | What it requires |
|---|---|---|
| 2-15-P-1 | CSP: define key management requirements | CSP: identify, document and approve the cyber requirements for managing cryptographic keys in your organisation. |
| 2-15-P-2 | CSP: apply key management requirements | CSP: put the approved key management requirements into practice. |
| 2-15-P-3 | CSP: Key management, main control | CSP: on top of ECC 2-8-3-2, cover at least the extra points on key management listed in 2-15-P-3-1 to 2-15-P-3-3. |
| 2-15-P-3-1 | CSP: clear ownership of keys | CSP: on top of ECC 2-8-3-2, give every cryptographic key a clearly defined owner. |
| 2-15-P-3-2 | CSP: recover lost keys securely | CSP: have a secure way to retrieve a lost cryptographic key, such as key backup and trusted key storage held strictly outside the cloud. |
| 2-15-P-3-3 | CSP: audit trails for keys | CSP: switch on and monitor all audit trails of keys. |
| 2-15-P-4 | CSP: review key management | CSP: apply the key management requirements and review them on a regular cycle. |
| 2-15-T-1 | CST: define key management requirements | CST: identify, document and approve the cyber requirements for managing cryptographic keys in your organisation. |
| 2-15-T-2 | CST: apply key management requirements | CST: put the approved key management requirements into practice. |
| 2-15-T-3 | CST: Key management, main control | CST: on top of ECC 2-8-3-2, cover at least the extra points on key management listed in 2-15-T-3-1 to 2-15-T-3-2. |
| 2-15-T-3-1 | CST: clear ownership of keys | CST: on top of ECC 2-8-3-2, give every cryptographic key a clearly defined owner. |
| 2-15-T-3-2 | CST: recover data if an encryption key is lost | CST: have a secure way to get data back if an encryption key is lost, such as key backup and trusted key storage held strictly outside the cloud. |
| 2-15-T-4 | CST: review key management | CST: apply the key management requirements and review them on a regular cycle. |
| Ref | Control | What it requires |
|---|---|---|
| 2-16-P-1 | CSP: define secure development requirements | CSP: identify, document and approve the cyber requirements for system development in your organisation. |
| 2-16-P-2 | CSP: apply secure development requirements | CSP: put the approved system development requirements into practice. |
| 2-16-P-3 | CSP: System development security, main control | CSP: on top of ECC None, cover at least the extra points on system development security listed in 2-16-P-3-1 to 2-16-P-3-2. |
| 2-16-P-3-1 | CSP: security in design and build of cloud services | CSP: across the development lifecycle, take the cyber needs of the Cloud Technology Stack and related systems into account when designing and building the cloud services. |
| 2-16-P-3-2 | CSP: protect development and test environments | CSP: across the development lifecycle, protect development environments, test environments (including test data) and integration platforms. |
| 2-16-P-4 | CSP: review secure development | CSP: apply the system development requirements and review them on a regular cycle. |
| Ref | Control | What it requires |
|---|---|---|
| 2-17-P-1 | CSP: define storage media requirements | CSP: identify, document and approve the cyber requirements for using information and data media in your organisation. |
| 2-17-P-2 | CSP: apply storage media requirements | CSP: put the approved storage media requirements into practice. |
| 2-17-P-3 | CSP: Storage media security, main control | CSP: on top of ECC None, cover at least the extra points on storage media security listed in 2-17-P-3-1 to 2-17-P-3-6. |
| 2-17-P-3-1 | CSP: sanitise media before disposal or reuse | CSP: enforce sanitisation of media before it is disposed of or reused. |
| 2-17-P-3-2 | CSP: dispose of media securely | CSP: use secure means when disposing of media. |
| 2-17-P-3-3 | CSP: protect data on removable media | CSP: keep data on removable media confidential and intact. |
| 2-17-P-3-4 | CSP: label media by classification | CSP: label media in human-readable form to show its classification and the sensitivity of what it holds. |
| 2-17-P-3-5 | CSP: store removable media securely | CSP: keep removable media in controlled, physically secure storage. |
| 2-17-P-3-6 | CSP: restrict portable media in the stack | CSP: restrict and control the use of portable media inside the Cloud Technology Stack. |
| 2-17-P-4 | CSP: review storage media security | CSP: apply the storage media requirements and review them on a regular cycle. |
| Ref | Control | What it requires |
|---|---|---|
| 3-1-P-1 | CSP: Resilience in business continuity, main control | CSP: on top of ECC 3-1-3, cover at least the extra points on resilience in business continuity listed in 3-1-P-1-1 to 3-1-P-1-2. |
| 3-1-P-1-1 | CSP: secure DR and continuity procedures | CSP: on top of ECC 3-1-3, develop and put in place disaster recovery and business continuity procedures in a secure way. |
| 3-1-P-1-2 | CSP: keep stack security systems resilient | CSP: develop and put in place procedures that keep the security systems protecting the Cloud Technology Stack resilient and running. |
| 3-1-T-1 | CST: Resilience in business continuity, main control | CST: on top of ECC 3-1-3, cover at least the extra points on resilience in business continuity listed in 3-1-T-1-1. |
| 3-1-T-1-1 | CST: secure DR and continuity for cloud use | CST: on top of ECC 3-1-3, develop and put in place disaster recovery and business continuity procedures that cover cloud computing, in a secure way. |
| Ref | Control | What it requires |
|---|---|---|
| 4-1-P-1 | CSP: Third-party cybersecurity, main control | CSP: on top of ECC 4-1-2 and 4-1-3, cover at least the extra points on third-party cybersecurity listed in 4-1-P-1-1 to 4-1-P-1-4. |
| 4-1-P-1-1 | CSP: remove risky marketplace offerings when NCA asks | CSP: on top of ECC 4-1-2 and 4-1-3, act on NCA requests to take software or services from third-party providers off the marketplace offered to tenants where they threaten national entities. |
| 4-1-P-1-2 | CSP: security documentation from suppliers | CSP: require security documentation for any equipment or services from suppliers and third-party providers. |
| 4-1-P-1-3 | CSP: third parties follow the law for their scope | CSP: make sure third-party providers comply with the laws and regulations relevant to what they do for you. |
| 4-1-P-1-4 | CSP: third-party risk and governance | CSP: manage the risk of third-party providers, and govern their security, as part of your general cyber risk management and governance. |
Alongside the list above, SecureXcel keeps a unified set of practical controls. For each control the workbook gives the risk it addresses, the objective, a description, whether it is preventive or detective, how often to run it, the design and operating test procedures, and the evidence to collect, with the references it covers in this framework. There is one workbook per framework, supplied as it is, with a Version History sheet for document control. Free account needed; you come straight back to the file.
P marks a control for the cloud service provider (CSP) and T a control for the cloud tenant (CST), the customer. The numbers are domain, subdomain, P or T, main control and subcontrol. Each entry here begins with CSP or CST so you can filter for your side.
No. The CCC extend the Essential Cybersecurity Controls. A tenant must keep meeting both the ECC and the CCC, and a provider must meet both as well, whether or not it is inside the ECC's own scope. Many entries here say they apply on top of a named ECC control.
It depends on the data classification level. Annex A of the CCC sets four levels, from level 1 for the most sensitive data to level 4 for public data, and marks each control mandatory or optional at each level. A set of data with mixed levels takes the highest one. Check Annex A for your level.
This list follows CCC-2:2024. The NCA's own table of changes shows that two data-localisation subcontrols from CCC-1 were deleted, as that topic moved to the National Data Management Office. Numbers in CCC-1 may not match, so check any older mapping against the current text.
No. It is a plain-English summary in our own words and omits the objectives, the levels in Annex A and the definitions. Main controls that only introduce subcontrols are listed as short umbrella entries. The NCA's text, with its Arabic version, is the authority.