NCA TCC — Telework Cybersecurity Controls
Saudi Arabia's mandatory cybersecurity framework for organisations enabling remote or hybrid work. Covers telework governance, device security, network security, and identity management — issued by the National Cybersecurity Authority as a remote-work extension of the ECC baseline.
What NCA TCC covers
The NCA Telework Cybersecurity Controls (TCC – 1) is Saudi Arabia's mandatory cybersecurity framework for remote and hybrid working, issued by the National Cybersecurity Authority. TCC recognises that the shift to telework fundamentally changes the threat landscape — corporate endpoints leave the protected network perimeter, connections traverse untrusted home broadband and public Wi-Fi, and identity becomes the primary security boundary.
TCC applies to any organisation operating in Saudi Arabia that enables employees, contractors, or third parties to work remotely. It is mandatory for government entities and CNI operators; private-sector organisations enabling telework are also in scope. Compliance requires evidenced implementation of all applicable TCC controls — from documented telework policies through device posture records to session monitoring evidence — with periodic submission through the NCA's national reporting service.
The four TCC domains extend the NCA ECC baseline with controls specific to the remote-work context. Notably, TCC introduces a dedicated BYOD subdomain, explicit zero-trust architecture principles, VPN and tunnelling requirements, and detailed session recording obligations for privileged remote access — none of which are covered at this level of specificity in the ECC. Organisations subject to TCC must maintain ECC compliance simultaneously; TCC adds to, not replaces, the ECC baseline.
NCA TCC domains and subdomains
Telework Cybersecurity Governance
Telework Device Security
Telework Network Security
Telework Identity & Access Management
Who must comply with NCA TCC
NCA TCC vs NCA ECC
| Aspect | NCA TCC | NCA ECC |
|---|---|---|
| Primary focus | Remote and hybrid work security controls — device, network, identity, governance | Organisational cybersecurity baseline across all control domains |
| Scope | Any Saudi organisation enabling employees to work remotely | All government, CNI, and critical-sector organisations in Saudi Arabia |
| Endpoint / device security | Dedicated domain — hardening, MDM, BYOD, encryption, remote wipe all explicit | Endpoint addressed under asset management; less granular |
| VPN and remote access | Explicit secure VPN, tunnelling, and network access control requirements | Remote access addressed through identity and network controls at high level |
| BYOD controls | Dedicated BYOD Policy & Controls subdomain with specific obligations | Not explicitly addressed; implied through general asset and identity controls |
| Zero-trust principles | Zero-Trust Architecture Principles subdomain within IAM domain | Not an explicit framework construct; implied through segmentation and access controls |
| MFA for remote access | Explicit requirement within Telework IAM domain | MFA addressed within identity management subdomain as general requirement |
| Session monitoring & recording | Explicit subdomain for telework session monitoring and privileged access recording | Covered under monitoring domain at a general level |
| Control count | ~50 controls | 108 controls, 92 sub-controls |
| Assessment cadence | NCA-mandated periodic assessment and evidence submission | NCA-mandated annual self-assessment via national reporting service |
GRC Vantage for NCA TCC
Six purpose-built capabilities covering the full TCC control set — from telework policy governance to device posture and privileged session recording — hosted inside Saudi Arabia for data residency compliance.
Frequently asked questions
- What is NCA TCC?
- The NCA Telework Cybersecurity Controls (TCC – 1) is a mandatory framework issued by Saudi Arabia's National Cybersecurity Authority that defines cybersecurity requirements for organisations enabling remote or hybrid work. It covers four domains: governance, device security, network security, and identity and access management — providing specific controls that extend the ECC baseline for telework environments.
- Who must comply with NCA TCC?
- Any organisation operating in Saudi Arabia that permits employees, contractors, or third parties to work remotely must implement NCA TCC. This includes government ministries, semi-government entities, CNI operators, and private-sector companies with remote or hybrid workers. SAMA-licensed financial institutions enabling telework must align with both TCC and SAMA CSF remote-work requirements.
- How does NCA TCC relate to NCA ECC?
- NCA ECC is the organisational cybersecurity baseline that all in-scope Saudi entities must comply with. NCA TCC adds a remote-work-specific layer on top of the ECC, introducing controls that the ECC addresses only at a high level — such as BYOD policy, dedicated VPN requirements, zero-trust architecture principles, and telework session recording. Organisations with remote workers must comply with both frameworks; TCC does not replace ECC, it supplements it for the telework context.
- What are key NCA TCC device security requirements?
- The Telework Device Security domain requires endpoint hardening against a documented baseline, mobile device management (MDM) enrolment for all corporate devices used remotely, documented BYOD policy with technical controls enforcing data segregation, encryption of all devices and storage media used for remote work, and a capability for remote device wipe and compliance checking. Evidence of MDM policy, device encryption certificates, and BYOD agreements must be maintained for NCA examination.
- Does BYOD require special treatment under NCA TCC?
- Yes. NCA TCC has a dedicated BYOD Policy & Controls subdomain within the Telework Device Security domain. Organisations permitting BYOD must have a documented BYOD policy, technical segregation between personal and corporate data on the device, enrolment and monitoring controls, acceptable-use agreements signed by employees, and a process for remotely removing corporate data when an employee departs. BYOD devices must meet the same encryption and endpoint hardening baseline as corporate-issued devices.
- How does zero-trust relate to NCA TCC?
- The Telework Identity & Access Management domain includes a Zero-Trust Architecture Principles subdomain. NCA TCC requires organisations with remote workers to move toward a zero-trust model — where access is never implicitly trusted regardless of network location and is instead granted based on continuous verification of identity, device posture, and context. In practice this means implementing conditional access policies, micro-segmentation, and identity-centric controls that treat each remote access request as untrusted by default.
Run your NCA TCC compliance programme with GRC Vantage
The complete NCA TCC control library is pre-loaded inside GRC Vantage with remote access policy workflows, endpoint posture tracking, BYOD controls, and submission-ready evidence packs. Hosted inside Saudi Arabia for full NCA, SAMA, and PDPL data residency compliance.