The Saudi National Cybersecurity Authority Essential Cybersecurity Controls (ECC) are mandatory for government entities and critical infrastructure operators. The Cloud Cybersecurity Controls (CCC) supplement adds cloud-specific requirements. We implement both on AWS.
NCA expects structured evidence.
The Saudi NCA Essential Cybersecurity Controls (ECC-1:2018) are mandatory for all government entities and operators of critical infrastructure. The framework groups 114 controls across five main domains: Cybersecurity Governance, Cybersecurity Defence, Cybersecurity Resilience, Third-Party Cybersecurity, and Industrial Control Systems Cybersecurity.
For cloud workloads, NCA published the Cloud Cybersecurity Controls (CCC) supplement. CCC adds cloud-specific obligations, including requirements for cloud service provider selection, multi-tenancy controls, encryption of data at rest and in transit, and incident response coordination with cloud providers.
The Critical Systems Cybersecurity Controls (CSCC) apply additional requirements to systems classified as critical. SaaS scale-ups selling to Saudi government typically need ECC + CCC. Critical infrastructure operators need ECC + CCC + CSCC.
AWS Organizations + AWS Control Tower for policy enforcement. AWS Config for governance evidence.
AWS WAF, AWS Shield, GuardDuty, Inspector. Identity at IAM Identity Center. Encryption via KMS.
AWS Backup, multi-AZ deployment, disaster recovery patterns. Business continuity testing automated.
AWS Artifact for AWS attestations. Third-party risk register entries. AWS as CSP documented per CCC.
For critical infrastructure operators. Network segmentation, OT/IT boundary controls, AWS for non-OT workloads.
Current state mapped to ECC + CCC. Gap analysis. Roadmap with cost estimates.
10 to 16 weeks. AWS architecture changes. Control implementations across all five domains.
NCA-defensible evidence assembled. Documentation, configurations, control mappings.
The AWS-certified specialist on your discovery call leads the implementation team on your engagement. No bait-and-switch. No junior-led delivery. Six touchpoints I personally own: discovery call, architecture sign-off, weekly review, every material decision, every deliverable sign-off, and 30 days post-handoff.
30-minute call. Direct with the founder. One specific recommendation about your NCA ECC + CCC posture on AWS.
★ AWS Advanced Tier Services Partner · ISO 27001:2022 · ISO 9001:2015 · 5× AWS-Certified Founder
