NCA CCC Compliance Services for Cloud Providers & Tenants
Navigate Saudi Arabia’s CCC-2:2024 requirements with confidence. ValueMentor helps cloud service providers and tenants assess applicable controls, address security gaps and prepare compliance evidence.
You are here:
Accredited by Globally Recognised Authorities
The ValueMentor Advantage
Understand Your Requirements. Strengthen Your Cloud Security.
Our Core NCA CCC Compliance Services
ValueMentor supports both Cloud Service Providers and Cloud Service Tenants under the applicable CCC-2:2024 control sets. Our approach establishes the right compliance scope before implementation begins. Where applicable, we also coordinate CCC requirements with NCA ECC compliance.
CCC-2:2024 – Four Key Cybersecurity Domains
Two Control Sets. Four Classification Levels. One Clear Compliance Roadmap.
Our NCA CCC Compliance Process
Provider & Tenant Applicability Assessment
Determine the applicable control set, organisational scope, cloud workloads and classification levels.
Gap Assessment & Control Mapping
Evaluate applicable CCC requirements and document control gaps with supporting evidence.
Risk-Based Remediation Roadmap
Prioritise deficiencies based on cybersecurity risk, regulatory requirements and implementation dependencies.
Cloud Control Implementation
Strengthen cloud security controls, governance practices, documentation and shared responsibility arrangements.
Validation & Evidence Preparation
Validate implemented controls, review evidence and address outstanding gaps before assessment.
Self-Assessment & Continuous Compliance
Support self-assessment preparation and establish ongoing monitoring and evidence management.
Make Cloud Compliance a Continuous Practice
Why ValueMentor
ValueMentor is registered with the National Cybersecurity Authority as a cybersecurity service provider in Saudi Arabia. We help cloud service providers and organisations using cloud services navigate CCC-2:2024 through structured assessments, practical implementation and evidence-driven compliance support.
Our V-TRUST™ methodology combines regulatory expertise, cloud security knowledge and PMO-led delivery to establish a clear path from applicability assessment to sustained compliance.
We also support organisations subject to both CCC and ECC requirements through coordinated compliance engagements. Deliverables are available in Arabic and English.
V-Trust Methodology
PMO-Led Delivery
Faster Delivery Accelerators
Secusy & AI driven GRC platform
Client Retention
Rate
Rate
0
%+
Annual Compliance Assessments
0
+
Successful Assessments
Delivered
Delivered
0
+
Business Sectors
Served
Served
0
+
Strengthen Cloud Security. Simplify Regulatory Compliance.
FAQs
Does NCA CCC apply to Cloud Service Providers or Cloud Service Tenants?
CCC-2:2024 has separate control sets for providers and tenants. Providers serving in-scope Saudi tenants must address provider requirements, regardless of their location. Applicable Saudi government entities, subsidiaries and private-sector critical national infrastructure organisations using cloud services fall under tenant requirements. Organisations performing both roles may need to address both control sets.
Does NCA CCC-2:2024 require cloud services to be hosted in Saudi Arabia?
No. CCC-2:2024 removed the previous in-Kingdom hosting requirements. Data localisation obligations may still apply under separate regulations, including requirements administered through SDAIA’s National Data Management Office.
How does NCA CCC relate to NCA ECC?
CCC extends the ECC with additional cloud-specific security requirements. Organisations subject to both frameworks should assess them together to identify shared controls, avoid duplication and address additional cloud obligations.
What are the four cybersecurity classification levels under CCC?
CCC-2:2024 uses four classification levels based on data sensitivity and security requirements. The applicable level determines which controls are mandatory or optional for the cloud services and workloads in scope.
Does ValueMentor certify NCA CCC compliance?
No. The NCA conducts CCC compliance assessments through self-assessments, periodic reporting and on-site audits. ValueMentor is registered with the NCA as a cybersecurity service provider and supports organisations with gap assessments, control implementation and evidence preparation.
Can an international cloud service provider fall under NCA CCC?
Yes. Cloud Service Providers serving in-scope Saudi tenants may be subject to provider requirements regardless of where the provider is headquartered or operates.
Explore Our Latest Insights on NCA Regulations and Cloud Security
Discover expert guidance on Saudi cybersecurity frameworks, cloud governance and emerging compliance requirements.
See What Our Customers Say!
ECommerce – UAE
I want to thank the entire ValueMentor team for the continuous support provided; I’m happy to see that your level of commitment and professionalism is always at the top and that we have in ValueMentor a precious partner in supporting our business.
Healthcare Tech – Bulgaria
Thank you team for cooperating with us for this penetration testing! Your quick and efficient work and responses are much appreciated. I am glad that even with the small setback in the beginning, we managed to meet the established deadline. We hope to work alongside you again in the future!
Financial Tech – Bahrain
We would like to express our sincere appreciation for your service. Ever since we signed our contract, ValueMentor provided quality services, accepted tight schedules, conducted tests repeatedly till technical issues cleared, and handled internal parties and external vendor’s queries effectively. Thank you for your support!
Healthcare Tech – Texas, USA
The effectiveness and quality of your services were evident throughout the project. Your team provided clear guidance, ensured that requirements were addressed appropriately, and helped us stay aligned with timelines.
Maritime Trade & Logistics – UAE
I would like to take this opportunity to thank you very much for your incredible support and patience throughout this assessment. We are extremely grateful for this achievement. Thanks for your professionalism and valuable advice. Looking forward to working together again!
Customer Experience (CX) Technologies, USA
ValueMentor transformed our complex and intimidating PCI DSS journey into a smooth, structured, and fully manageable process. Their clarity, guidance, and consistent support helped us achieve certification on time with complete confidence.
Hospital – UAE
I would like to extend my appreciation in helping and guiding us to a good ADHICS score. Special thanks to the team in doing a great job, spearheading on the ground, and closing the gaps.
Commercial Bank – Africa
Allow me to extend our heartfelt appreciation to the ValueMentor project team for their dedicated support to us to achieve this objective. At the kick-off of this project, we emphasized the need to complete it within a short period. I am delighted to report that ValueMentor has exceeded our expectations as a partner in this regard.
Travel agency – UAE
Thank you for your hard work and dedication in achieving the PCI compliance timelines. Your commitment to excellence is sincerely appreciated.
Healthcare Tech
We are also very grateful that you managed to react so fast to our request and move things along quickly and efficiently in order to achieve the results before the Christmas holidays! Here’s to another successful VAPT!
Healthcare Tech, USA
The effectiveness and quality of your services were evident throughout the project. Your team provided clear guidance, ensured that requirements were addressed appropriately, and helped us stay aligned with timelines.
Fintech – Bahrain
Our team sincerely appreciates your effort, professionalism, and support throughout the NESA audit. Your guidance kept us on track and ensured success. It was a pleasure working with you, and we look forward to future collaborations.
Prepare Your Organisation for NCA CCC-2:2024 Compliance
Understand your applicable control requirements, strengthen cloud security and build an evidence-ready compliance environment.
Request a Consultation
We provide tailored security and compliance solutions designed around your business needs. Submit the form and our team will reach out to understand your requirements and guide you through the next steps.