NCA DCC Compliance Services for Data Cybersecurity in Saudi Arabia
Protect regulated data across its lifecycle with ValueMentor’s NCA DCC compliance services. Assess applicable controls, address data security gaps and prepare evidence for NCA assessment typically as part of a combined NCA ECC and DCC engagement.
You are here:
Accredited by Globally Recognised Authorities
The ValueMentor Advantage
Know which DCC controls apply, what needs attention and what falls under a different regulatory obligation.
Our NCA DCC Compliance Services
The NCA Data Cybersecurity Controls (DCC-1:2022) extend the Essential Cybersecurity Controls (ECC) to address data security throughout its lifecycle. In-scope organisations are expected to meet both frameworks. ValueMentor typically scopes DCC alongside NCA ECC Compliance Services, while standalone engagements are available where there is a specific business or regulatory driver.
Optional security testing: Access control reviews, configuration assessments, vulnerability assessments and penetration testing can be delivered through ValueMentor’s CREST-approved Security Testing practice.
Our NCA DCC Compliance Process
Scope & Classification Dependency Review
Confirm applicability, identify data assets and flows, and establish the status of data classification.
Gap Assessment & Control Mapping
Assess applicable controls and subcontrols, recording implementation status and supporting evidence.
Risk-Based Remediation Roadmap
Prioritise deficiencies based on cybersecurity risk, regulatory requirements and implementation dependencies.
Control Implementation & Documentation
Strengthen data security controls and establish supporting policies and governance practices.
Validation & Evidence Assembly
Review control effectiveness and organise evidence for completeness and traceability.
Assessment Support & Continuous Compliance
Support assessment preparation and establish ongoing monitoring and evidence maintenance.
Turn data security obligations into controls that can be demonstrated and maintained.
Why ValueMentor
ValueMentor is registered with the National Cybersecurity Authority as a cybersecurity service provider in the Kingdom of Saudi Arabia. The team supports organisations across the GCC with regulatory cybersecurity compliance, data security and control implementation.
DCC engagements combine regulatory understanding, structured control assessments and evidence-led remediation. Work is commonly coordinated with NCA ECC compliance, while Saudi PDPL obligations are addressed separately through ValueMentor’s privacy practice. Deliverables are available in Arabic and English.
V-Trust Methodology
PMO-Led Delivery
Faster Delivery Accelerators
Secusy & AI driven GRC platform
Client Retention
Rate
Rate
0
%+
Annual Compliance Assessments
0
+
Successful Assessments
Delivered
Delivered
0
+
Business Sectors
Served
Served
0
+
One partner across the NCA control family, registered to deliver cybersecurity services in the Kingdom.
FAQs
Who must comply with the NCA DCC?
The DCC applies to Saudi government organisations and their affiliated entities, as well as private-sector organisations that own, operate or host critical national infrastructure. The NCA encourages other organisations to adopt the controls as good practice. Its requirements cover structured and unstructured data, in both physical and digital forms, throughout the data lifecycle.
How is the NCA DCC different from the Saudi PDPL?
The DCC is an NCA cybersecurity control framework focused on protecting data within its defined scope. The Saudi Personal Data Protection Law (PDPL), regulated by SDAIA, governs the processing of personal data and has a broader organisational reach. An organisation may be subject to both, but compliance with one does not establish compliance with the other. ValueMentor handles PDPL through a separate privacy practice. Explore our PDPL services.
Does data need to be classified before a DCC assessment?
Data classification is a key prerequisite. DCC controls are defined against classification levels established by SDAIA. If classification is incomplete or inconsistent, ValueMentor identifies this during scoping and flags it as a dependency to resolve. Data classification itself is not currently offered as part of this service.
How does the NCA DCC relate to the ECC?
The DCC extends the ECC with additional controls focused on data cybersecurity. In-scope organisations are expected to comply with both. Coordinating the assessments helps reduce duplicated evidence gathering and creates a more consistent remediation roadmap. Explore NCA ECC Compliance Services.
How is DCC compliance assessed? Can a service provider certify our compliance?
The NCA evaluates compliance through self-assessment and other assessment mechanisms it considers appropriate. The DCC does not issue a compliance certificate, and external firms do not certify compliance on the NCA’s behalf. Organisations providing cybersecurity services in Saudi Arabia must be registered with the NCA. ValueMentor is registered as a cybersecurity service provider in the Kingdom.
Read the latest insights on NCA regulations, data security and regulatory compliance.
See What Our Customers Say!
ECommerce – UAE
I want to thank the entire ValueMentor team for the continuous support provided; I’m happy to see that your level of commitment and professionalism is always at the top and that we have in ValueMentor a precious partner in supporting our business.
Commercial Bank – Africa
Allow me to extend our heartfelt appreciation to the ValueMentor project team for their dedicated support to us to achieve this objective. At the kick-off of this project, we emphasized the need to complete it within a short period. I am delighted to report that ValueMentor has exceeded our expectations as a partner in this regard.
Fintech – Bahrain
Our team sincerely appreciates your effort, professionalism, and support throughout the NESA audit. Your guidance kept us on track and ensured success. It was a pleasure working with you, and we look forward to future collaborations.
Healthcare Tech
We are also very grateful that you managed to react so fast to our request and move things along quickly and efficiently in order to achieve the results before the Christmas holidays! Here’s to another successful VAPT!
Healthcare Tech, USA
The effectiveness and quality of your services were evident throughout the project. Your team provided clear guidance, ensured that requirements were addressed appropriately, and helped us stay aligned with timelines.
Healthcare Tech – Bulgaria
Thank you team for cooperating with us for this penetration testing! Your quick and efficient work and responses are much appreciated. I am glad that even with the small setback in the beginning, we managed to meet the established deadline. We hope to work alongside you again in the future!
Hospital – UAE
I would like to extend my appreciation in helping and guiding us to a good ADHICS score. Special thanks to the team in doing a great job, spearheading on the ground, and closing the gaps.
Customer Experience (CX) Technologies, USA
ValueMentor transformed our complex and intimidating PCI DSS journey into a smooth, structured, and fully manageable process. Their clarity, guidance, and consistent support helped us achieve certification on time with complete confidence.
Maritime Trade & Logistics – UAE
I would like to take this opportunity to thank you very much for your incredible support and patience throughout this assessment. We are extremely grateful for this achievement. Thanks for your professionalism and valuable advice. Looking forward to working together again!
Travel agency – UAE
Thank you for your hard work and dedication in achieving the PCI compliance timelines. Your commitment to excellence is sincerely appreciated.
Financial Tech – Bahrain
We would like to express our sincere appreciation for your service. Ever since we signed our contract, ValueMentor provided quality services, accepted tight schedules, conducted tests repeatedly till technical issues cleared, and handled internal parties and external vendor’s queries effectively. Thank you for your support!
Healthcare Tech – Texas, USA
The effectiveness and quality of your services were evident throughout the project. Your team provided clear guidance, ensured that requirements were addressed appropriately, and helped us stay aligned with timelines.
Request a Consultation
We provide tailored security and compliance solutions designed around your business needs. Submit the form and our team will reach out to understand your requirements and guide you through the next steps.