NCA TCC Compliance Toolkit v3.0.1 (Bilingual EN/AR)

Make remote work a controlled service: everything a Saudi entity needs to assess, implement, evidence and sustain compliance with the NCA Telework Cybersecurity Controls (TCC-1:2021): all 63 control records (47 scored criteria) traced from requirement to policy, verification and evidence. Bilingual English + Arabic, fully editable. Built by a certified GRC practitioner (CISSP, CISM, CRISC, CISA).

1. 01

   Assessment Workbook (Excel, blank + filled SAMPLE)

   Every TCC control with applicability, status, maturity score, evidence references, owner, reviewer and review date, with input validation. Live dashboard: implementation by official subdomain (EN/AR), implemented and assessed counts, internal maturity and chart. Control library with the official wording in English and Arabic, attributed to its source, plus framework mapping to ECC-2:2024, ISO/IEC 27001:2022 and NIST CSF 2.0.

2. 02

   Risk & Remediation Register (Excel, blank + filled SAMPLE)

   5x5 likelihood x impact method, TCC-linked risk register with inherent and residual scoring, remediation plan with owners and due dates, 32 KPI/KRI definitions with targets and RAG status, RACI matrix and source-based compliance calendar.

3. 03

   16 Policies + 5 Forms (Word, separate EN and AR editions)

   Telework policy and service authorization, risk assessment and release gates, competence and safe working, asset inventory and custody, identity and remote access, system hardening and sessions, network and gateway protection, mobile management and updates, classified data and leakage prevention, end-to-end cryptographic protection, backup and recovery, vulnerability discovery and treatment, penetration test and retest, logging and continuous monitoring, incident readiness and threat actions, and hosting location and change. 403 implementation statements per language citing the control IDs, adjustable operating settings, two six-step procedures per policy, metrics and a per-control verification annex. Forms: telework access request, remote device compliance, telework service risk and release, telework incident and threat action, and hosting location. Coverage matrix (Excel) linking all 63 records.

4. 04

   Implementation Guides (PDF + DOCX, 41 pages EN / 41 pages AR)

   Scope, pre-permission risk decisions, twelve-month roadmap and implementation by official subdomain. Source-language differences are disclosed, including the binding Arabic monthly system-patching interval.

5. 05

   Evidence Samples

   Six domain evidence books per language (63 learning cases, each with a positive example, an insufficient example and a verification workpaper) plus a bilingual Excel evidence index.

• A one-page Executive Dashboard sheet in the assessment workbook: headline KPI tiles, compliance by domain and subdomain, and charts
• Every figure is calculated automatically from your assessment, so it updates the moment you change a status
• Drop it straight into a steering-committee or board pack; the separate risk dashboard shows inherent and residual risk at a glance

Not sure what evidence an assessor will ask for? Every expected evidence item for every control now has a dedicated, realistic sample in 05-Evidence-Samples/Evidence-Artifacts.

• 32 evidence artifacts: 8 Word documents, 14 Excel registers and 10 screenshot images (consoles, dashboards, emails and diagrams)
• Examples: approved telework access requests, a managed SOC contract with a 24×7 SLA, the MDM compliance policy configuration, a 12-month SIEM retention configuration, the telework patch deployment schedule, policy acknowledgement statistics and a home-network security guide
• Each sample carries a reference number, owner role, date, classification and an assessor verification note, so your team sees exactly what good evidence looks like
• Evidence Coverage Matrix (Excel): maps all 113 expected evidence items to the control they prove and to the sample that shows it
• These sit alongside the evidence books, so you get the explanation and a ready example for every control

• One ZIP organised in numbered folders, ready to share with your team
• Blank workbooks for your own assessment plus filled SAMPLE versions to learn from
• Editable Word, Excel and PDF files in English and Arabic
• CHANGELOG and a release manifest with SHA-256 checksums for every file

Cybersecurity GRC, IT, internal audit and assurance teams at Saudi government entities, critical-infrastructure operators and private organizations that provide remote or hybrid work.

Your copy is individually licensed and watermarked with your name and order number, then emailed to you within minutes of purchase. One licence covers one legal entity. Consultants: contact support@cyberhacking.io for a multi-entity licence.

All sales are final. Faulty files are replaced when reported within 14 days to support@cyberhacking.io.

Official NCA wording is attributed; policies, defaults and examples are implementation aids. This independent resource does not claim NCA approval, certification or endorsement.