# NCA CSCC: NCA Critical Systems Cybersecurity Controls

> Additional cybersecurity controls for critical systems inside national critical entities in Saudi Arabia, building on the ECC.

URL: https://securei3.com/standards/nca-cscc/
Category: GCC regulations: Law or regulation
Provider: Secure iQube (independent consultancy; ISO certificates are issued by accredited certification bodies; SOC and ISAE reports by licensed CPA and audit firms, which Secure iQube can arrange through partner firms)


The National Cybersecurity Authority's Critical Systems Cybersecurity Controls (CSCC) extend the Essential Cybersecurity Controls for systems whose disruption would seriously affect national security, the economy or essential services. They raise the bar on governance, protection, monitoring and resilience for those systems.

We help you identify and document critical systems, assess them against CSCC, close gaps and keep evidence ready for NCA assessments, as part of a single programme with ECC.

## Who it is for

- Government entities and their affiliates
- Owners and operators of critical national infrastructure
- Service providers that run or support critical systems

## Benefits

- Clear identification of which systems are critical
- Stronger protection where an outage or breach would hurt most
- One programme with NCA ECC rather than two

## How Secure iQube helps

1. **Applicability and scoping**: Confirm whether and how the law applies to you, entities, data, systems, roles and territories.
2. **Data and process mapping**: Build a record of processing or control inventory so obligations can be tied to real systems and owners.
3. **Gap assessment**: Measure current practice against each obligation and rank the gaps by legal and business risk.
4. **Remediation roadmap**: Policies, notices, contracts, technical controls and governance, sequenced so the highest risks close first.
5. **Evidence and ongoing monitoring**: A compliance calendar, metrics and periodic reviews so you can demonstrate compliance to a regulator or customer at any time.

## Frequently asked questions

### How is CSCC different from ECC?

ECC sets the minimum controls for the whole organisation. CSCC adds stricter controls for the specific systems classified as critical, such as tighter access, monitoring, testing and resilience requirements.

### Do we need ECC first?

Yes. CSCC is an extension of ECC, so organisations implement ECC and then apply the CSCC controls to their critical systems.

Related: https://securei3.com/standards/nca-ecc/, https://securei3.com/standards/nca-otcc/, https://securei3.com/standards/iso-27001/, https://securei3.com/standards/iso-22301/

Contact: https://securei3.com/contact/: info@securei3.com