Meet NCA CSCC controls for your critical systems with less effort

NCA CSCC is the Critical Systems Cybersecurity Controls (CSCC-1:2019), published by Saudi Arabia's National Cybersecurity Authority. It sets minimum cybersecurity requirements for national critical systems as an extension of the Essential Cybersecurity Controls (ECC). It contains 4 main domains, 21 subdomains, 32 main controls and 73 subcontrols covering governance, defence, resilience, and third-party and cloud computing cybersecurity.

Organisations that own or operate critical systems must comply with CSCC. This covers government organisations in Saudi Arabia or abroad, such as ministries, authorities and embassies, plus their subsidiaries and private organisations. A system is critical if its failure or compromise could cause national security, economic, financial or social harm, using criteria such as losses above 0.01% of GDP or impact on more than 5% of the population.

CSCC builds directly on the Essential Cybersecurity Controls. Compliance with ECC is a prerequisite, and organisations must keep complying with ECC to be fully compliant with CSCC. Most CSCC controls start with "In addition to" or "With reference to" a named ECC control, then add stricter requirements for critical systems, such as shorter review cycles, wider scope or extra technical measures.

The four CSCC domains are Cybersecurity Governance, Cybersecurity Defense, Cybersecurity Resilience, and Third-Party and Cloud Computing Cybersecurity. Defense is the largest, with 13 subdomains covering areas such as identity and access management, network security, cryptography, vulnerability management, penetration testing, event logging and application security. Resilience focuses on the cybersecurity aspects of business continuity, including a disaster recovery centre for critical systems.

The NCA evaluates compliance through self-assessments carried out by organisations and/or on-site audits, using mechanisms it deems appropriate. Organisations must first identify their critical systems, then implement the controls within the compliance period the NCA defines while managing risk in the meantime, and stay compliant afterwards. CSCC also requires an annual internal review and an independent review at least every three years.

CSCC sets specific frequencies and limits for critical systems. Examples include annual risk assessments with a monthly risk register review, access reviews every three months, vulnerability assessments every month, penetration tests every six months, backup recovery tests every three months and event log retention of at least 18 months. It also prohibits remote access to critical systems from outside Saudi Arabia.

CSCC is a mandatory Saudi regulatory control set, while ISO 27001 is a voluntary international certification standard for an information security management system. Many CSCC topics overlap with ISO 27001 Annex A, such as access control, cryptography, logging and supplier security. However, CSCC adds national requirements, such as data and hosting locality and staffing rules, so ISO 27001 certification alone does not demonstrate CSCC compliance.

Yes, on request. NCA CSCC is mapped in OneClickComply's control library and is available on request rather than enabled for every account by default. Once enabled, you can reuse evidence from ECC, ISO 27001 and other frameworks, collect evidence from connected tools, monitor controls for drift and get guidance from our in-house audit team. OneClickComply does not issue NCA approvals or certifications.