NCA Issues Mandatory Cloud Security Controls for Critical Infrastructure Operators

Key Details

The new cloud security controls framework encompasses 47 specific requirements across five critical domains: data sovereignty and localization, identity and access management, encryption and key management, incident response and forensics, and supply chain security. Organizations classified as critical infrastructure operators—including energy, healthcare, finance, telecommunications, and government entities—must conduct comprehensive cloud security assessments and implement remediation plans within the specified timeline.

The directive explicitly requires that all sensitive data processed by critical infrastructure operators must reside within Saudi Arabia or approved GCC jurisdictions, with specific encryption standards mandated for data at rest and in transit. Cloud service providers serving these organizations must demonstrate compliance with ISO/IEC 27017 and ISO/IEC 27018, alongside NCA-specific certification requirements that will be administered through the National Cybersecurity Center.

"This directive reflects the Kingdom's commitment to securing our digital infrastructure as we accelerate cloud adoption across critical sectors. Organizations must view this not as a compliance burden but as a strategic imperative that protects national interests while enabling innovation," stated an NCA senior official during the announcement briefing.

Impact on Saudi Organizations

The financial services sector, already subject to SAMA's Cloud Computing Framework, will need to harmonize existing controls with the new NCA requirements, creating a unified compliance posture. Healthcare providers utilizing cloud-based electronic health record systems must reassess their current architectures to ensure patient data sovereignty compliance. Energy sector operators, particularly those in oil and gas with operational technology (OT) environments increasingly connected to cloud platforms, face the most complex implementation challenges given the intersection of IT and OT security requirements.

Telecommunications operators serving as cloud service providers must undergo NCA certification processes, which include penetration testing, architecture reviews, and continuous monitoring capabilities. The directive also impacts government entities migrating to the Government Cloud Platform (Deem), requiring enhanced security baselines beyond standard configurations. Organizations leveraging multi-cloud strategies must implement unified security orchestration to maintain consistent policy enforcement across providers.

Recommendations

• Conduct an immediate gap analysis comparing current cloud security posture against the 47 NCA requirements, prioritizing data sovereignty, encryption, and access control domains
• Engage with cloud service providers to verify their NCA certification roadmap and ensure contractual agreements include compliance obligations and audit rights
• Establish a cross-functional cloud security governance committee including IT, security, legal, and business stakeholders to oversee implementation and maintain ongoing compliance
• Implement Cloud Security Posture Management (CSPM) tools to automate continuous compliance monitoring and configuration drift detection across multi-cloud environments
• Develop incident response playbooks specific to cloud environments, including procedures for forensic data collection that preserve evidence while meeting NCA reporting timelines
• Invest in staff training on cloud-native security controls and NCA ECC requirements, particularly for teams managing identity and access management (IAM) and encryption key lifecycle