NCA CSCC — Critical Systems Cybersecurity Controls for Oil and Gas, Power, Banking

Overview

The Critical Systems Cybersecurity Controls (CSCC-1:2019) raise the ECC baseline for national critical systems — anything whose disruption would significantly impact national security, the economy, essential services or public safety. CSCC is additive to ECC: critical-system operators must comply with ECC plus the 32 extra CSCC controls. Audit cadence is annual and conducted by NCA-approved third parties.

Who this applies to

• Banking — every domestic bank and FI subject to SAMA.
• Energy — oil & gas operators, electricity transmission, refining.
• Water and wastewater utilities on a national scale.
• Healthcare — hospitals processing national-scale clinical records.
• Telecommunications — Tier 1 carriers and national datacentre operators.
• Aviation & ports — operators of national-significance terminals.

The classification is decided by the NCA in consultation with the sector regulator (SAMA, CST, Ministry of Energy, etc.). Once classified, the entity has 12 months to reach CSCC compliance.

Key extra controls

CSCC layers on top of ECC. The 32 CSCC-specific controls fall into four areas:

1. Strengthened governance — dedicated cybersecurity committee at C-level, mandatory CISO with direct line to the CEO and the board, dedicated cybersecurity budget line item.
2. Always-on defence — 24/7 Security Operations Centre with two-shift coverage minimum, mandatory threat intelligence feed subscription, mandatory red-team exercises every 12 months.
3. High availability — RPO ≤ 15 minutes, RTO ≤ 4 hours for tier-1 services; hot standby across two geographically separated KSA datacentres.
4. Strict OT/IT segmentation — Purdue model enforced, one-way data diodes for OT-to-IT flows where applicable.

Step 1: Re-baseline against ECC

Before adding CSCC, get to 100% on ECC. CSCC auditors will not start scoring CSCC controls until ECC baseline is met.

Step 2: Establish 24/7 SOC

Minimum staffing model for a tier-1 SOC:

| Role | Shift coverage | Count | |---|---|---| | SOC Manager | Business hours | 1 | | Tier 1 Analyst | 24/7 (3 shifts) | 6 | | Tier 2 Analyst | 24/7 (3 shifts) | 6 | | Tier 3 / IR Lead | On-call 24/7, weekday in-office | 2 | | Threat Hunter | Business hours | 1 | | SIEM Engineer | Business hours | 1 |

Tools: SIEM (Splunk / Sentinel / Wazuh + ELK), SOAR (Shuffle / Cortex XSOAR), threat intel platform (MISP / OpenCTI), EDR (Crowdstrike / SentinelOne / Wazuh).

Step 3: High-availability architecture

# Two-site active-passive sample for a critical Saudi service
sites:
  primary:
    region: ksa-riyadh
    rto: 0     # active
    rpo: 0
    capacity: 100%
  secondary:
    region: ksa-dammam   # >300km separation
    rto: 240   # 4h target
    rpo: 15    # 15-min target via async replication
    capacity: 100%
replication:
  database:
    mode: async-15s
    method: postgres-physical-streaming
  storage:
    mode: continuous
    method: minio-active-active

Step 4: Red-team exercises (CSCC 2-12-3)

Annual minimum scope:

• External attack-surface — black-box reconnaissance and exploitation.
• Insider threat — assume credentialed user as a malicious actor.
• Phishing campaign — at least one organisation-wide simulation.
• Physical access — social-engineering at site entry, with written prior approval.

Report must reach the cybersecurity committee within 30 days and remediation plan signed within 60.

Step 5: OT/IT segmentation

If you operate ICS/SCADA see the dedicated OTCC guide. Even non-OT critical systems must enforce three-tier segmentation: presentation / business logic / data store, with stateful inspection between every tier.

Common gotchas

• Stand-up SOC on paper but no run-books — automatic non-compliance.
• DR site in the same datacentre row — fails geographic-separation requirement.
• Annual red team executed but findings never closed — flags Open Audit Finding.
• Mixing critical and non-critical workloads in the same Kubernetes cluster.

Verification — audit-ready evidence

• C-level cybersecurity committee minutes for the last 12 months.
• SOC shift roster, on-call escalation matrix.
• Threat intel platform subscription invoice + ingestion proof.
• Annual red-team report + remediation evidence per finding.
• DR test report demonstrating RTO and RPO actuals.
• Asset register flagging "critical" tier explicitly.

Conclusion

CSCC turns cybersecurity from a department into a business function with continuous staffing and continuous testing. Treat the 24/7 SOC as your operational heartbeat and the red team as your annual reality check.

Related guides

• NCA ECC v2 — Full Compliance Guide
• NCA OTCC — Operational Technology Controls
• Building an NCA-Compliant SOC