NCA DCC Compliance Toolkit v3.0.1 (Bilingual EN/AR)

Everything a Saudi entity needs to assess, implement, evidence and sustain compliance with the NCA Data Cybersecurity Controls (DCC-1:2022): all 66 control records (55 scored criteria) traced from requirement to policy, verification and evidence. Bilingual English + Arabic, fully editable. Built by a certified GRC practitioner (CISSP, CISM, CRISC, CISA).

1. 01

   Assessment Workbook (Excel, blank + filled SAMPLE)

   Every DCC control with classification-level applicability, status, maturity score, evidence references, owner, reviewer and review date, with input validation. Live dashboard: implementation by official subdomain (EN/AR), implemented and assessed counts, internal maturity and chart. Control library with the official wording in English and Arabic, attributed to its source, plus framework mapping to ECC-2:2024, ISO/IEC 27001:2022 and NIST CSF 2.0.

2. 02

   Risk & Remediation Register (Excel, blank + filled SAMPLE)

   5x5 likelihood x impact method, DCC-linked risk register with inherent and residual scoring, remediation plan with owners and due dates, 22 KPI/KRI definitions with targets and RAG status, RACI matrix and annual compliance calendar.

3. 03

   11 Policies + 5 Forms (Word, separate EN and AR editions)

   Data-handler screening and awareness, named access, system hardening, mobile devices, data protection, cryptography, secure disposal, printers and office devices, and third-party sharing. Each policy carries implementation statements citing the control IDs, adjustable operating settings, two six-step procedures, effectiveness measures and a control-specific verification annex. Forms: data classification and handling, data-sharing and disclosure approval, secure disposal and custody, data-privilege approval and review, and strategic-consultancy restricted room. Coverage matrix (Excel) linking all 66 records.

4. 04

   Implementation Guides (PDF + DOCX, 42 pages EN / 42 pages AR)

   Applicability, classification decisions, twelve-month roadmap and implementation by official subdomain.

5. 05

   Evidence Samples

   Six domain evidence books per language (66 learning cases, each with a positive example, an insufficient example and a verification workpaper) plus a bilingual Excel evidence index.

• A one-page Executive Dashboard sheet in the assessment workbook: headline KPI tiles, compliance by domain and subdomain, and charts
• Every figure is calculated automatically from your assessment, so it updates the moment you change a status
• Drop it straight into a steering-committee or board pack; the separate risk dashboard shows inherent and residual risk at a glance

Not sure what evidence an assessor will ask for? Every expected evidence item for every control now has a dedicated, realistic sample in 05-Evidence-Samples/Evidence-Artifacts.

• 23 evidence artifacts: 9 Word documents, 9 Excel registers and 5 screenshot images (consoles, dashboards, emails and diagrams)
• Examples: steering-committee minutes reviewing DCC results, an independent audit findings register, access-request tickets, TLS scan results, approved hardening baselines, MDM remote-wipe records, an IRM label configuration screenshot and a document-shredding procedure
• Each sample carries a reference number, owner role, date, classification and an assessor verification note, so your team sees exactly what good evidence looks like
• Evidence Coverage Matrix (Excel): maps all 136 expected evidence items to the control they prove and to the sample that shows it
• These sit alongside the evidence books, so you get the explanation and a ready example for every control

• One ZIP organised in numbered folders, ready to share with your team
• Blank workbooks for your own assessment plus filled SAMPLE versions to learn from
• Editable Word, Excel and PDF files in English and Arabic
• CHANGELOG and a release manifest with SHA-256 checksums for every file

Data governance, cybersecurity GRC, internal audit and assurance teams at Saudi government entities, critical-infrastructure operators and their suppliers who handle classified data.

Your copy is individually licensed and watermarked with your name and order number, then emailed to you within minutes of purchase. One licence covers one legal entity. Consultants: contact support@cyberhacking.io for a multi-entity licence.

All sales are final. Faulty files are replaced when reported within 14 days to support@cyberhacking.io.

Official NCA wording is attributed; policies, defaults and examples are implementation aids. This independent resource does not claim NCA approval, certification or endorsement.