CCC-2:2024 replaces CCC-1:2020; current NCA publication dated 31 July 2025 (page updated 24 June 2026)
Last verified
2026-10-20
The Cloud Cybersecurity Controls (CCC) extend the ECC to cloud services. CCC-2:2024 replaces CCC-1:2020. The NCA's current publication is dated 31 July 2025 (page updated 24 June 2026) and was "updated to reflect changes related to data localization requirements".
Scope: tenants are government entities and CNI operators; providers are those serving them.
Levels: 1 to 4, following data classification.
Localisation: subcontrols 2-3-P-1-10 and 2-3-P-1-11 (cloud services, storage, processing, disaster recovery and monitoring from within the Kingdom) are deleted; localisation is referred to NDMO at SDAIA.
Incidents: providers notify affected tenants of incidents in real time.
Guides: GCCC-CST-1:2023 for tenants (written for CCC-1:2020) and GCCC-CSP-2:2026 for cloud service providers.
Proposed PDPL change (as at 20 October 2026): SDAIA's draft amendments to the PDPL Implementing Regulation (IR), open for comment to 5 November 2026, would require controllers to apply applicable NCA controls (draft Art 23(1)(b)), to store personal data in the Kingdom (draft Art 23(2)) and to notify SDAIA within 72 hours of any breach, without prejudice to NCA reporting (draft Art 24). With ECC-2 and CCC-2 referring localisation to NDMO, draft Art 23(2) would become the main general localisation rule.