Moving a workload to cloud
Before migration, check network paths, privileged roles, logs and backup responsibilities. Record which evidence comes from the provider and which remains the customer's responsibility.
All frameworks & requirements
National Cybersecurity Authority
NCA Cloud Cybersecurity Controls Readiness
Clarify provider and tenant responsibilities, cloud security architecture, evidence and NCA CCC readiness before migration or expansion.
CCC 2-2024Sources reviewed: 4 November 2026
Understand the requirement. Connect it to operations.
NCA Cloud Cybersecurity Controls extend ECC and address both cloud service providers and cloud service tenants. The published CCC 2-2024 update includes changes related to data localization. Assess the current document rather than repeating assumptions from an earlier cloud policy.
A secure cloud platform and a secure customer deployment are different responsibilities. A readiness program should make the service boundary explicit: who configures identities, protects data, collects logs, manages vulnerabilities, responds to incidents and supports recovery.
Confirm applicability before choosing controls.
Determine whether the organization is acting as a provider, tenant or both. Map service models, deployment locations, data classification, administrators, subprocessors and connectivity. Apply the relevant control perspective rather than assigning every obligation to the provider.
Review applicable NCA controls alongside CST cloud regulations, Saudi data-protection requirements and sector directions. These instruments address different questions; meeting one does not automatically settle the others. Resolve hosting and transfer decisions for the actual data and service.
Turn requirements into implementation and evidence.
| Focus area | Implementation examples | Evidence to maintain |
|---|---|---|
| Responsibility boundaries | Define provider, tenant and managed-service ownership for each control. | Approved responsibility matrix and contractual commitments. |
| Identity and administration | Review privileged roles, strong authentication and remote support access. | Role exports, access approvals and periodic reviews. |
| Data and workload protection | Assess classification, isolation, encryption and key ownership. | Data flows, configuration checks and key-management decisions. |
| Monitoring and incidents | Confirm log availability, escalation routes and evidence access. | Logging coverage, response procedures and joint exercise results. |
| Continuity and exit | Validate backups, recovery, portability and deletion arrangements. | Restoration tests, exit plan and disposal evidence. |
What this looks like in practice.
Adopting a SaaS or AI service
Review the real processing model, including support access, connectors, retained content and external dependencies. A regional hosting label does not answer every control question.
From readiness assessment to working controls.
Agree the scope, responsible owners and acceptance criteria before work begins. The approach is tailored to your systems, suppliers, operating constraints and existing evidence.
Assess and prioritize
Review applicability, current controls and evidence. Identify gaps and dependencies, distinguish design from operating effectiveness, and prioritize actions with accountable owners.
Design the improvements
Translate approved requirements into architecture, policies, processes and technical changes. Reuse effective controls while keeping national and sector mappings distinct.
Implement and validate
Configure agreed safeguards, document procedures and validate representative workflows within authorized access and change windows. Record exceptions and residual risks.
Handover and sustain
Organize evidence, transfer operating knowledge and define a review cadence. Track corrective actions as systems, services, suppliers and requirements change.
Agree concrete deliverables.
- A scope and applicability record with assumptions and responsibilities.
- A gap/risk register and prioritized remediation roadmap.
- Control mapping, architecture recommendations and operating procedures.
- An evidence register, agreed validation results and handover material.
Deliverables, depth, access and timing depend on the statement of work. This is readiness and implementation support; it does not include a promise of regulator acceptance or formal certification.
Common questions.
Is the provider's certificate sufficient?
It may support due diligence, but the tenant still needs evidence for its configuration, access, workloads and responsibilities. Check the certificate scope and service boundary.
Are CCC and CST regulations the same?
No. NCA CCC addresses cybersecurity controls, while CST's cloud regulations address service provisioning obligations. Map both where applicable.
Can we use an old localization statement?
Use the current CCC edition and relevant sector/data requirements. The 2024 update includes localization changes, so inherited statements need review against the actual workload.
Does cloud remove our incident responsibility?
No. Agree detection, notification, evidence access and response ownership with the provider. Exercise the handoff rather than relying on an undefined shared-responsibility promise.
What should we assess before renewal?
Review service changes, access, data locations, supplier dependencies, security evidence, recovery results and exit options. A renewal is an opportunity to close accountability gaps.
Start with the official sources.
Read the linked authority publications for the binding scope, wording and applicable updates. The implementation examples on this page are practical recommendations, not a reproduction of every regulatory requirement.
General readiness and technology information, not a legal opinion, regulator endorsement or guarantee of compliance. Confirm applicability, current versions and sector directions with the competent authority and qualified advisers.
Related frameworks and requirements
Define the right scope for your organization.
Bring your services, systems, supplier dependencies and existing findings. We will help turn them into a practical assessment and implementation scope.
Discuss your readiness