On this page
Need a formal NCA assessment? We run the full engagement for you and route the formal audit through our local partner firms in Saudi Arabia, so you deal with one team and get all your work done.
Moving to the cloud does not move your NCA obligations to the cloud provider. CCC makes that explicit: it gives providers and tenants separate duties and expects each to show evidence for its own side. Testing is where that evidence comes from.
What NCA CCC is
The Cloud Cybersecurity Controls are published by the National Cybersecurity Authority (NCA). They sit alongside the Essential Cybersecurity Controls (ECC) and add requirements that only make sense in cloud: how a provider separates customers, how data is protected in shared infrastructure, and what a tenant must do to secure the workloads it runs.
- Issued by
- National Cybersecurity Authority (NCA), Saudi Arabia
- Current version
- CCC-2:2024
- Applies to
- Cloud service providers and cloud service tenants
- Relationship to ECC
- Extends and complements ECC; ECC still applies
- Domains
- Governance, defense, resilience and third-party cybersecurity
- What decides your duties
- Your role, the service model and the sensitivity of the data
Provider or tenant: who tests what
Cloud service providers (CSPs)
Test the platform you offer: the management plane and customer portals, hypervisor and container isolation between tenants, provider APIs, identity systems, and the network that connects customers to the service.
Cloud service tenants (CSTs)
Test what you build and configure: cloud identities and roles, storage and database exposure, network security groups, Kubernetes clusters, serverless functions, and the applications and APIs you run.
Many Saudi organisations are both: a SaaS company is a tenant of its hyperscaler and a provider to its own customers. In that case you carry both sets of duties and your test plan should reflect both.
What a CCC-ready cloud test covers
- Identity and access: over-privileged roles, unused keys, missing MFA on privileged accounts and paths to escalate privileges inside the cloud account
- Storage and data exposure: public buckets, snapshots or databases, and data readable by the wrong role
- Network controls: security groups, exposed management ports and paths between environments that should be separated
- Workloads: virtual machines, containers, Kubernetes and serverless functions, including secrets stored in code or environment variables
- Applications and APIs: authentication and authorisation flaws in the services that handle your data
- Encryption and keys: data encrypted at rest and in transit, and who can use or export the keys
- Logging and detection: whether the attack activity during the test was logged and noticed
- Tenant isolation (providers): whether one customer can reach another customer’s data or resources
A configuration review on its own tells you what is misconfigured. Penetration testing shows how those misconfigurations chain together, which is what an auditor and your board actually need to understand. Our cloud security assessment combines both.
How CCC builds on ECC testing
ECC already requires periodic penetration testing of internet-facing services (see our ECC 2-11 guide). CCC does not remove that. It widens the picture to cloud-specific attack surface that a traditional external test can miss: the cloud control plane, identity, storage services and the separation between tenants. If you also run critical systems in the cloud, CSCC’s six-month cycle applies to them on top.
| Framework | Testing focus | Who it applies to |
|---|---|---|
| ECC | Periodic penetration testing of technical components and internet-facing services | Government entities and CNI operators in scope |
| CSCC | Monthly vulnerability assessment and six-monthly penetration tests of critical systems | Owners and operators of critical systems |
| CCC | Cloud workloads, identities, configurations, APIs and tenant isolation | Cloud service providers and tenants in scope |
Testing in the cloud without breaking the rules
- Check your provider’s testing policy. Most major providers let customers test their own resources but prohibit denial-of-service and attacks on shared infrastructure.
- Define the boundary. List accounts, subscriptions or projects, regions and services in scope, and exclude anything you do not own.
- Agree access and data handling. Decide where testers connect from, how test data is stored and how access is revoked afterwards, in line with your data classification.
- Test identity first. Many cloud breaches start with credentials and roles, not open ports.
- Retest and record. Keep the report, the fixes and the retest together for your auditor.
Data location matters
CCC also addresses where data is stored and processed, and the rules depend on how the data is classified. Settle data location and tester access before the engagement starts, the same way you would for any system holding classified data.
Evidence auditors ask for
For each cloud environment in scope, keep: the asset and account inventory used to define scope; the test plan and provider-policy check; the penetration test and configuration review reports; remediation tickets; and retest results. Providers should add tenant isolation test results and evidence that customers’ data and environments are separated. Map each finding to the CCC and ECC controls it supports so the auditor can follow the trail.
How Summit supports NCA CCC
Summit tests cloud environments for Saudi providers and tenants: cloud identity and configuration review, penetration testing of workloads, APIs and applications, and tenant isolation testing for providers. We work with our verified NCA-registered partner firm, scope engagements around data classification and in-Kingdom access needs, and map findings to CCC and ECC. We have supported 100+ Saudi clients across Riyadh, Jeddah, Dammam and beyond.
Preparing for a CCC review?
We can scope a cloud test against your side of the shared responsibility model and deliver evidence your auditor can follow. Read our NCA CCC guide or talk to our team.
Related reading: VAPT provider checklist and cost for Saudi Arabia · SAMA CSF penetration testing · API penetration testing checklist
Frequently asked questions
What is NCA CCC?
The Cloud Cybersecurity Controls (CCC) are issued by Saudi Arabia's National Cybersecurity Authority. They set cybersecurity requirements for cloud service providers and for cloud service tenants, the organisations that use cloud services. The current version is CCC-2:2024.
Does CCC replace the Essential Cybersecurity Controls?
No. CCC extends and complements ECC with cloud-specific requirements. Organisations in scope still need to meet ECC, including its penetration testing control.
Does NCA CCC require penetration testing?
Yes. CCC's defense domain covers vulnerability management and penetration testing of cloud services and workloads, on top of ECC's penetration testing requirements. The scope and depth depend on whether you are a provider or a tenant and on the sensitivity of the data you host.
Who is responsible for testing in the cloud, the provider or the tenant?
Both, for different layers. The provider tests and secures the cloud platform and tenant isolation; the tenant tests its own workloads, identities, configurations, applications and data. Your shared responsibility model and contract should state the split.
Do I need permission from my cloud provider to run a penetration test?
Major public cloud providers publish testing policies. Many allow customers to test their own resources without prior approval but prohibit denial-of-service testing and attacks on the provider's shared infrastructure. Check the current policy of your provider before testing.
