Principles
Zero Trust Core Principles
Verify Explicitly
Every access request is authenticated and authorized based on all available signals.
Least-Privilege Access
Users and systems are granted only the minimum access required for their function.
Assume Breach
Network segmentation and monitoring designed to limit the blast radius of any single compromise.
Compliance
Mapped to NCA Frameworks
ECC-1:2018
Essential Cybersecurity Controls covering governance, defense, resilience, and third-party security.
CSCC-1:2019
Critical Systems Cybersecurity Controls for nationally critical systems, extending ECC requirements.
Converged with OT
IT Zero Trust architecture designed to interoperate with, not bypass, OT network segmentation.
FAQ
IT Security & Zero Trust - FAQ
What is the difference between NCA ECC and CSCC?
The Essential Cybersecurity Controls (ECC-1:2018) set baseline cybersecurity requirements for organizations in Saudi Arabia, while the Critical Systems Cybersecurity Controls (CSCC-1:2019) extend and add to those requirements specifically for systems classified as critical, reflecting their higher risk profile.
Is Zero Trust required by NCA regulations?
NCA frameworks do not mandate a specific architecture by name, but Zero Trust principles, such as least-privilege access and continuous verification, directly support many ECC and CSCC control requirements around identity, access management, and network security.
How does IT-side Zero Trust relate to OT cybersecurity?
IT Zero Trust and OT cybersecurity (OTCC-1:2022) are designed as complementary layers: IT Zero Trust governs enterprise network and identity access, while OT controls govern the industrial control network, with segmentation between the two being a shared requirement across both frameworks.
