Wadira: Find your way through Saudi data & privacy law.
Home › Frameworks › Cybersecurity › Telework Cybersecurity Controls (TCC)
| Type | Framework |
|---|---|
| Issuing authority | National Cybersecurity Authority (NCA) |
| Framework | Cybersecurity |
| Tier | Rules, controls & standards |
| Legal status | Binding |
The Telework Cybersecurity Controls (TCC-1:2021) are the National Cybersecurity Authority's minimum cybersecurity requirements for enabling organisations to operate telework securely, complementing the Essential Cybersecurity Controls (ECC) and taking the Critical Systems Cybersecurity Controls (CSCC) into account where critical systems are used in telework.
The controls apply to government organisations in the Kingdom and to private-sector organisations owning, operating or hosting critical national infrastructure; the NCA encourages all other organisations to adopt them, and any in-scope organisation that allows telework must comply with all applicable controls. The TCC comprise 3 main domains (cybersecurity governance, cybersecurity defence, and third-party and cloud computing cybersecurity), with 16 subdomains, 21 main controls and 42 subcontrols. Continuous ECC compliance is a prerequisite; compliance is mandated under item 3 of Article 10 of the NCA's mandate and Royal Decree 57231 (10/11/1439H), and is assessed through self-assessment and external compliance assessment. A separate guide (GTCC-1:2023) supports implementation.
Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-08-13