NCA’s Other Control Sets: Cloud (CCC), Data (DCC), Telework (TCC), OT (OTCC) and Social Media (OSMACC)

Overview of Secondary NCA Control Sets

• CCC — Cloud Cybersecurity Controls — Expectations for cloud service providers and/or tenants. Scope carefully: provider vs tenant control sets differ.
• DCC — Data Cybersecurity Controls — Controls oriented to protecting data assets and related handling environments.
• TCC — Telework Cybersecurity Controls — Remote/hybrid work patterns, endpoints, and remote access governance.
• OTCC — Operational Technology Cybersecurity Controls — Industrial/OT environments; relevant where ICS domain content left ECC-1.
• OSMACC — Official Social Media Accounts Cybersecurity Controls — Security expectations for official organisational social media accounts and related processes.

Exact domain/control counts differ by document version. Use the current NCA publications for counts and applicability rather than secondary summaries.

How to Scope Them

1. Start with ECC-2:2024 as the essential baseline for in-scope entities.
2. Add CSCC when critical systems criteria are met.
3. Add CCC/DCC/TCC/OTCC/OSMACC only where the operating model exists.
4. Map shared evidence (IAM, logging, incident response) once; index multiple control IDs.

How CyberSilo Helps

• CSA can hold multi-framework control indexes for ECC plus scoped NCA extensions
• ThreatHawk covers logging/monitoring themes that recur across ECC Defense and cloud/OT programmes
• Advisory scoping workshops via contact

Related Resources

Aramco CCC (supplier) · ECC vs ISO 27001 · CSCC vs ECC

Frequently Asked Questions

Is NCA CCC the same as Aramco CCC?

No. NCA Cloud Cybersecurity Controls (CCC) are national cloud controls. Aramco’s Cybersecurity Compliance Certificate (CCC/CCC+) is a supplier assurance programme based on SACS-210.

Do we need every NCA control set?

Only those that apply to your systems and services. ECC is the essential baseline for in-scope entities; CSCC, CCC, DCC, TCC, OTCC, and OSMACC apply when those operating models are present.

Where should OT controls live after ECC-2?

Operational technology is addressed through NCA’s OTCC programme rather than as a fifth ECC domain.