Cybersecurity Management

The Cloud Computing Cybersecurity Controls (CCC-2:2024) document, issued by the National Cybersecurity Authority, is a regulatory framework that supplements the Essential Cybersecurity Controls (ECC-2:2024). Its primary objective is to enhance national readiness and protect the vital interests of the Kingdom in cyberspace.

The update of these controls comes in response to the accelerated expansion in the adoption of cloud computing technologies locally and globally, and the accompanying new security challenges and threats that require precise standards to reduce potential cybersecurity risks for both service providers and subscribers.

These controls are formulated based on an in-depth study of global best practices and reputable international standards, focusing on three fundamental principles to ensure data and information security: confidentiality, integrity, and availability. The controls also cover four complementary pillars including: strategy, people, processes, and technology, to ensure a comprehensive approach to cloud cybersecurity management.

Cybersecurity controls are divided into four essential components: cybersecurity governance, cybersecurity enhancement, cybersecurity resilience, and external cybersecurity and cloud computing.

Operationally, the document differentiates in its requirements between service providers and subscribers; it includes 37 fundamental regulations and 94 sub-regulations for service providers, while allocating 18 fundamental regulations and 26 sub-regulations for subscribers.

This allocation aims to enable all parties to accurately define security requirements and work towards their continuous compliance, contributing to the establishment of a secure and reliable cloud environment that supports digital transformation in the Kingdom and aligns with national regulatory and legislative requirements.