Skip to content
Emergency helpGet started
Compliance & Governance

What are the NCA Critical Systems Cybersecurity Controls (CSCC)?

NCA CSCC-1:2019 adds 32 main controls to the ECC for Saudi critical systems. Who it applies to, how systems are identified, and what it adds.
By VigilbasePublished
Read the guideMore Topics

The Critical Systems Cybersecurity Controls (CSCC-1:2019) are the National Cybersecurity Authority's extra requirements for systems that Saudi organizations identify as critical. The NCA built them as an extension and complement to the Essential Cybersecurity Controls (ECC), so an organization must keep complying with the ECC to be fully compliant with the CSCC. The CSCC has 4 main domains, 21 subdomains, 32 main controls, and 73 subcontrols, applied to the critical systems of government organizations and of subsidiaries of government or private organizations.

Who must apply the CSCC?

The controls apply to systems deemed critical, using the NCA's criteria, by the organizations that own or operate them. That includes government organizations in the Kingdom or abroad, such as ministries, authorities, establishments, and embassies, and subsidiaries of government or private organizations. Every in-scope organization must identify its critical systems, implement the controls on them within the compliance period the NCA defines, and stay compliant after that period.

How are critical systems identified?

The CSCC defines a critical system as any system or network whose failure, unauthorized change, or unauthorized access, including to its data, could disrupt the organization's services or cause negative economic, financial, security, or social impact at the national level. Organizations may use the following criteria to identify critical systems.
1.Negative impact on national security, or on the Kingdom's reputation and public image.
2.Significant financial losses, more than 0.01% of GDP.
3.Negative impact on services for a large number of users, more than 5% of the population.
4.Loss of lives.
5.Unauthorized disclosure of data classified as Top Secret or Secret.
6.Negative impact on the operations of one or more vital sectors.

How does the CSCC extend the ECC?

The CSCC uses the same four domains as the ECC: cybersecurity governance, defense, resilience, and third-party and cloud computing cybersecurity. Many controls start from an ECC control and add stricter minimums for critical systems.
1.Event logs: activate logs on every technical component of a critical system, monitor critical systems' security events around the clock, monitor user behavior and file integrity alerts, and keep critical systems' event logs for at least 18 months.
2.Third parties: screen or vet outsourcing and managed services companies and staff who work on critical systems, and rely on Saudi companies and organizations for outsourcing and managed services of critical systems.
3.Hosting: host critical systems inside the organization, or with cloud services from government organizations or Saudi companies that comply with the NCA's Cloud Cybersecurity Controls (CCC), taking the data classification into account.

How is CSCC compliance assessed?

The NCA evaluates compliance through self-assessments by organizations and on-site audits, using the mechanisms it considers appropriate. It also publishes a CSCC Assessment and Compliance Tool. The CSCC text sets no penalties of its own. It cites item 3 of Article 10 of the NCA's mandate and Royal Decrees No. 57231 and No. 7732 as its basis.

How do organizations evidence the CSCC?

Start with the critical systems register: which systems meet the criteria, who owns them, and which components each one has. Evidence for the CSCC then sits on top of the ECC evidence for the same systems.
1.The critical systems register and the assessment behind each decision.
2.Event log coverage for every technical component, with 18 months of retention.
3.Records of around-the-clock security event monitoring and user behavior analysis.
4.Vetting records and contracts for outsourcing and managed services on critical systems.
5.Hosting records showing where each critical system and its components run.

Where does Vigilbase fit with the CSCC?

Vigilbase OS keeps connected logs and events auditable and queryable in one place, and each investigation records the evidence, action, and verification. That can support monitoring evidence for systems outside the critical scope. For critical systems, check two CSCC requirements first. Control 4-1-1-2 requires outsourcing and managed services of critical systems to rely on Saudi companies and organizations, and 2-11-2 requires 18 months of event log retention, against a Vigilbase OS default of typically 30 to 90 days per dataset. Raise both during scoping, and confirm what an engagement may cover before any work touches a critical system.

About this guide

This guide summarizes the CSCC-1:2019 text published by the NCA, as available in October 2026. It is not legal advice. The CSCC still cross-references ECC-1:2018 control numbers, so check the current NCA publications, and confirm with your legal and compliance owners which systems and controls apply.

Key Takeaways

✓The CSCC adds 32 main controls and 73 subcontrols to the ECC for systems an organization identifies as critical.
✓Continuous ECC compliance is a prerequisite for CSCC compliance.
✓Critical systems' event logs must be kept for at least 18 months and monitored around the clock.
✓Outsourcing and managed services for critical systems must rely on Saudi companies and organizations.

Sources

Related Solutions

Vigilbase services related to this guide

Managed SOC

Learn more

Managed Cloudflare

Learn more

Get started with Vigilbase OS

Learn more

Cybersecurity in Saudi Arabia

Learn more

Frequently Asked Questions

What is the difference between the NCA ECC and the CSCC?

The ECC is the NCA's baseline for government entities and operators of Critical National Infrastructures. The CSCC adds stricter controls for the systems those organizations identify as critical, and continuous ECC compliance is a prerequisite for it.

How long must critical systems' logs be kept under the CSCC?

At least 18 months, under control 2-11-2, compared with at least 12 months for cybersecurity event logs under the ECC.What a SIEM doesSecurity operations responsibilities

Can a non-Saudi provider run managed services for a critical system?

Control 4-1-1-2 requires outsourcing and managed services of critical systems to rely on Saudi companies and organizations, in accordance with the relevant legislative and regulatory requirements. Check this with your compliance owner before you scope any provider's work on a critical system.

How does the NCA check CSCC compliance?

Through self-assessments by organizations and on-site audits. The NCA also publishes a CSCC Assessment and Compliance Tool.

Related Topics

Security Basics

What is SOC?

Compliance & Governance

NCA ECC

Compliance & Governance

SAMA Cyber Security Framework

Compliance & Governance

Saudi PDPL

Get Started

Ready to Improve Your Security?

Our team can help you implement the security measures discussed in this guide. Get expert guidance tailored to your organization.
Get started Continue Learning