A customer-data export
Check who can export it, where it can be sent and how long copies remain accessible. Test the workflow rather than assessing the database alone.
All frameworks & requirements
National Cybersecurity Authority
NCA Data Cybersecurity Controls Readiness
Connect NCA DCC readiness with data discovery, classification, access, sharing, retention and verifiable protection across the lifecycle.
DCC 1-2022Sources reviewed: 4 November 2026
Understand the requirement. Connect it to operations.
NCA Data Cybersecurity Controls extend ECC with minimum cybersecurity requirements focused on protecting data throughout its lifecycle. The official publication identifies DCC 1-2022. The assessment boundary should follow data flows, not only the servers that hold a database.
Data protection becomes operational when staff know what information they handle, systems enforce appropriate access and sharing, and owners can demonstrate what happens through creation, use, movement, storage and disposal. IRIS Technology can help connect governance decisions to these technical mechanisms.
Confirm applicability before choosing controls.
Confirm applicability and identify the data, systems, users and external parties within scope. Map classification decisions to actual repositories, endpoints, applications, collaboration platforms and backups. Treat unknown copies and exports as assessment questions rather than assuming that the primary repository is the whole picture.
Keep cybersecurity classification distinct from the legal definition of personal or sensitive personal data. DCC and privacy obligations can overlap, but a DLP policy or classification label cannot establish lawful processing, consent or a transfer basis.
Turn requirements into implementation and evidence.
| Focus area | Implementation examples | Evidence to maintain |
|---|---|---|
| Discovery and classification | Locate repositories and validate labels with business owners. | Approved inventory, classification decisions and coverage gaps. |
| Access and privilege | Apply least privilege to users, service accounts and administrators. | Permission reviews, approvals and revoked access. |
| Controlled movement | Review sharing, exports, removable media and application interfaces. | Sharing rules, exception records and representative tests. |
| Protection and keys | Assess encryption, key custody and administrative separation. | Configuration evidence and key ownership records. |
| Retention and disposal | Connect approved schedules to systems, archives and backup handling. | Retention settings, deletion validation and documented exceptions. |
What this looks like in practice.
An enterprise AI assistant
Map the documents the assistant can retrieve and the identities it uses. Test whether output respects permissions and whether prompts and logs create additional copies.
From readiness assessment to working controls.
Agree the scope, responsible owners and acceptance criteria before work begins. The approach is tailored to your systems, suppliers, operating constraints and existing evidence.
Assess and prioritize
Review applicability, current controls and evidence. Identify gaps and dependencies, distinguish design from operating effectiveness, and prioritize actions with accountable owners.
Design the improvements
Translate approved requirements into architecture, policies, processes and technical changes. Reuse effective controls while keeping national and sector mappings distinct.
Implement and validate
Configure agreed safeguards, document procedures and validate representative workflows within authorized access and change windows. Record exceptions and residual risks.
Handover and sustain
Organize evidence, transfer operating knowledge and define a review cadence. Track corrective actions as systems, services, suppliers and requirements change.
Agree concrete deliverables.
- A scope and applicability record with assumptions and responsibilities.
- A gap/risk register and prioritized remediation roadmap.
- Control mapping, architecture recommendations and operating procedures.
- An evidence register, agreed validation results and handover material.
Deliverables, depth, access and timing depend on the statement of work. This is readiness and implementation support; it does not include a promise of regulator acceptance or formal certification.
Common questions.
Is DCC a replacement for Saudi PDPL?
No. DCC addresses data cybersecurity; PDPL addresses personal-data processing rights and obligations. Map each applicable requirement without treating the two as equivalent.
Does a DLP deployment complete readiness?
No. Discovery, ownership, classification, identity, configuration, response and lifecycle evidence still matter. Test the tool against agreed data flows.
Should we classify every document manually?
Choose an approach based on information types, processes and risk. Automated discovery can assist, but owners must validate important decisions and exceptions.
Do backups need to be considered?
Yes, include recovery copies and archives. Design access, retention and disposal handling without creating untested recovery or deletion assumptions.
Where should we start?
Select a meaningful data flow, identify the accountable owner, map repositories and sharing paths, then test protection and evidence. Expand systematically rather than beginning with an unowned tool rollout.
Start with the official sources.
Read the linked authority publications for the binding scope, wording and applicable updates. The implementation examples on this page are practical recommendations, not a reproduction of every regulatory requirement.
General readiness and technology information, not a legal opinion, regulator endorsement or guarantee of compliance. Confirm applicability, current versions and sector directions with the competent authority and qualified advisers.
Related frameworks and requirements
Define the right scope for your organization.
Bring your services, systems, supplier dependencies and existing findings. We will help turn them into a practical assessment and implementation scope.
Discuss your readiness