NCA CSCC Compliance Services for Critical Systems in Saudi Arabia
Identify critical systems, assess applicable NCA controls and build a defensible compliance roadmap. ValueMentor supports organisations with CSCC gap assessments, control implementation and evidence readiness, typically alongside NCA ECC compliance.
You are here:
Accredited by Globally Recognised Authorities
The ValueMentor Advantage
Know which DCC controls apply, what needs attention and what falls under a different regulatory obligation.
Our NCA CSCC Compliance Services
The NCA Critical Systems Cybersecurity Controls (CSCC-1:2019) extend the Essential Cybersecurity Controls (ECC), which are a prerequisite for CSCC compliance. The framework applies to critical systems whose failure or unauthorised access could negatively affect national security, the national economy, public services or businesses.
It comprises four domains, 21 subdomains, 32 main controls and 73 subcontrols. ValueMentor typically scopes CSCC alongside NCA ECC Compliance Services, with standalone engagements available where a specific requirement exists.
Separately scoped security testing: CSCC requires penetration testing by a qualified team, vulnerability assessment using trusted methods and tools, and secure source code review before release. These services are scoped separately through ValueMentor's CREST-approved Security Testing practice. OT and industrial control environments are addressed separately on a case-by-case basis.
Our NCA CSCC Compliance Process
Scope & Classification Dependency Review
Apply NCA criticality criteria, document inclusion and exclusion decisions, and confirm the assessment scope.
Gap Assessment & Control Mapping
Evaluate applicable controls and subcontrols, recording implementation status and supporting evidence.
Risk & Remediation Prioritisation
Prioritise gaps based on system criticality, operational dependencies, threat exposure and regulatory requirements.
Control Implementation & Operating Model Changes
Strengthen controls and plan the required changes to access, connectivity, vendors and personnel arrangements.
Validation & Evidence Assembly
Review control effectiveness, verify evidence completeness and address outstanding deficiencies.
Assessment Support & Continuous Compliance
Support assessment preparation and establish ongoing monitoring and evidence-management practices.
A scope you can defend, a roadmap you can resource and evidence you can produce.
Why ValueMentor
ValueMentor is registered with the National Cybersecurity Authority as a cybersecurity service provider in the Kingdom of Saudi Arabia. The team supports organisations across the GCC with national cybersecurity compliance, control implementation and assessment readiness.
Engagements combine regulatory understanding with technical control assessment and structured remediation. Advisory work is delivered remotely as standard, with in-Kingdom deployment available on a project or contract-staffing basis where control requirements, system access restrictions or client policies call for it.
CSCC engagements are commonly coordinated with NCA ECC compliance. Deliverables are available in Arabic and English.
V-Trust Methodology
PMO-Led Delivery
Faster Delivery Accelerators
Secusy & AI driven GRC platform
Client Retention
Rate
Rate
0
%+
Annual Compliance Assessments
0
+
Successful Assessments
Delivered
Delivered
0
+
Business Sectors
Served
Served
0
+
One partner across the NCA control family, registered to deliver cybersecurity services in the Kingdom.
FAQs
1. What qualifies as a critical system under the NCA CSCC?
A system whose failure or compromise could harm national security, the economy or essential services. Each organisation must identify and document its critical systems against NCA criteria.
2. Does the CSCC prohibit remote access from outside Saudi Arabia?
Yes. Remote access and technical support from outside the Kingdom are prohibited for critical systems.
3. Is penetration testing mandatory under the CSCC?
Yes. The framework requires penetration testing, vulnerability assessments and secure source code reviews. These services are scoped separately.
4. Is ECC compliance required before CSCC compliance?
Yes. CSCC extends the ECC, so organisations must meet the applicable requirements of both frameworks.
5. Does the CSCC cover OT and industrial control systems?
No. OT and industrial control environments are addressed under the NCA’s separate OTCC framework.
6. Does the NCA issue a CSCC compliance certificate?
No. The NCA evaluates compliance through self-assessments and on-site audits. External providers cannot certify compliance on its behalf.
7. Must cybersecurity service providers be registered with the NCA?
Yes. Cybersecurity service providers operating in Saudi Arabia must be registered with the NCA. ValueMentor holds this registration.
Read the latest insights on NCA regulations, data security and regulatory compliance.
See What Our Customers Say!
Healthcare Tech – Bulgaria
Thank you team for cooperating with us for this penetration testing! Your quick and efficient work and responses are much appreciated. I am glad that even with the small setback in the beginning, we managed to meet the established deadline. We hope to work alongside you again in the future!
Healthcare Tech
We are also very grateful that you managed to react so fast to our request and move things along quickly and efficiently in order to achieve the results before the Christmas holidays! Here’s to another successful VAPT!
Fintech – Bahrain
Our team sincerely appreciates your effort, professionalism, and support throughout the NESA audit. Your guidance kept us on track and ensured success. It was a pleasure working with you, and we look forward to future collaborations.
Maritime Trade & Logistics – UAE
I would like to take this opportunity to thank you very much for your incredible support and patience throughout this assessment. We are extremely grateful for this achievement. Thanks for your professionalism and valuable advice. Looking forward to working together again!
Healthcare Tech, USA
The effectiveness and quality of your services were evident throughout the project. Your team provided clear guidance, ensured that requirements were addressed appropriately, and helped us stay aligned with timelines.
Customer Experience (CX) Technologies, USA
ValueMentor transformed our complex and intimidating PCI DSS journey into a smooth, structured, and fully manageable process. Their clarity, guidance, and consistent support helped us achieve certification on time with complete confidence.
Financial Tech – Bahrain
We would like to express our sincere appreciation for your service. Ever since we signed our contract, ValueMentor provided quality services, accepted tight schedules, conducted tests repeatedly till technical issues cleared, and handled internal parties and external vendor’s queries effectively. Thank you for your support!
Commercial Bank – Africa
Allow me to extend our heartfelt appreciation to the ValueMentor project team for their dedicated support to us to achieve this objective. At the kick-off of this project, we emphasized the need to complete it within a short period. I am delighted to report that ValueMentor has exceeded our expectations as a partner in this regard.
Hospital – UAE
I would like to extend my appreciation in helping and guiding us to a good ADHICS score. Special thanks to the team in doing a great job, spearheading on the ground, and closing the gaps.
ECommerce – UAE
I want to thank the entire ValueMentor team for the continuous support provided; I’m happy to see that your level of commitment and professionalism is always at the top and that we have in ValueMentor a precious partner in supporting our business.
Healthcare Tech – Texas, USA
The effectiveness and quality of your services were evident throughout the project. Your team provided clear guidance, ensured that requirements were addressed appropriately, and helped us stay aligned with timelines.
Travel agency – UAE
Thank you for your hard work and dedication in achieving the PCI compliance timelines. Your commitment to excellence is sincerely appreciated.
Request a Consultation
We provide tailored security and compliance solutions designed around your business needs. Submit the form and our team will reach out to understand your requirements and guide you through the next steps.