Classified Data · Lifecycle Security

NCA DCC on Microsoft 365

Technical Implementation Guide for Data Cybersecurity Controls

The Data Cybersecurity Controls (DCC) issued by the National Cybersecurity Authority (NCA) establish mandatory data protection requirements for organisations handling classified information across the Kingdom of Saudi Arabia. Building upon the foundational Essential Cybersecurity Controls (ECC), DCC focuses specifically on safeguarding data throughout every stage of its lifecycle: creation, storage, transmission, usage, and disposal.

While human resources vetting, physical facility protections, and executive oversight remain the responsibility of your internal teams, the technical mechanisms required to classify, encrypt, watermark, and control classified data are native to Microsoft 365. PolicySecOps configures and documents these technical controls within your environment.

Standing Disclaimer

We configure and document the technical controls inside your Microsoft environment. We are not an auditor or certification body and we don't give legal advice. Meeting a regulation also depends on policies, people and physical controls that stay with your organisation.

Licence Dependency Notice

What we can switch on depends on the Microsoft licences you already have. The assessment shows you exactly what is possible today and what would need an extra licence. We don't sell licences, so we have nothing to push.

Applicability Matrix

Who NCA DCC Is For

NCA DCC applies to organisations that process, store, or handle classified organizational or national data in Saudi Arabia:

01

Ministries & Judicial Authorities

Saudi government ministries, judicial bodies, and state commissions managing statutory or classified public records.

02

State-Owned & PIF Entities

Enterprises and strategic asset entities affiliated with the Public Investment Fund handling confidential national development plans.

03

Critical Infrastructure Operators

Entities controlling strategic national utilities, telecom backbones, and energy networks holding classified operational telemetry.

04

Defence & Commercial Contractors

Management consultancies, engineering firms, defence suppliers, and technology vendors handling classified client material.

National Data Taxonomy

The Four-Tier Data Classification Framework

DCC operates in close coordination with national data governance guidelines, establishing technical controls mapped across four distinct classification tiers:

Tier 1 No Harm

Public

Information intended for public distribution or where unauthorized disclosure poses no harm to national or organizational interests.

Technical Enforcement:

Standard domain authentication, public access labeling, standard data lifecycle.

Tier 2 Moderate Operational Harm

Confidential

Sensitive organizational information intended solely for authorized personnel, where unauthorized disclosure could cause moderate operational, commercial, or reputational harm.

Technical Enforcement:

Encryption at rest and in transit, application containerization (MAM), internal sharing restrictions.

Tier 3 Serious Strategic Damage

Secret

Highly sensitive strategic, financial, or operational data, where unauthorized disclosure could cause serious damage to national security, public safety, or organizational stability.

Technical Enforcement:

Persistent cryptographic rights, dynamic screen/print watermarking, screen capture blocking, quarterly access reviews.

Tier 4 Catastrophic National Impact

Top Secret

Critical national or organizational information requiring exceptional containment, where unauthorized disclosure could result in catastrophic consequences.

Technical Enforcement:

Strict BYOD prohibition, verified Saudi national group restrictions, print blocking, tamper-proof disposal logging.

Demarcation of Responsibility

Audit Scope Breakdown

Detailed technical enforcement inside Microsoft Purview, Intune, and Entra ID versus retained physical and administrative obligations.

Technical Engineering

What We Help You Put in Place

We configure the technical controls required across the five stages of the data lifecycle using Microsoft Purview, Microsoft Intune, and Microsoft Entra ID:

Stage 1

Classification and Persistent Encryption

  • Four-Tier Sensitivity Labels: We deploy standardized classification labels matching national tiers across Word, Excel, PowerPoint, Outlook, and SharePoint, requiring users to classify every document and message.
  • Persistent Cryptographic Rights: Files classified as confidential, secret, or top secret receive persistent encryption. Decryption permissions travel with the file, ensuring only authorized personnel within designated groups can access the content, even if a document is exfiltrated.
  • National Personnel Group Restriction: Where mandated for top-tier classified information, decryption and viewing permissions are restricted strictly to verified Saudi national personnel groups.
Stage 2

Document Traceability and Dynamic Watermarking

  • Real-Time Dynamic Watermarking: For secret and top-secret information, we implement dynamic watermarking that overlays the viewing user's exact email address, IP address, and timestamp diagonally across the entire screen and printed pages. If an image is photographed from a screen, the source is immediately identifiable.
  • Screen Capture and Screenshot Blocking: On devices displaying secret or top-secret documents, we enforce technical restrictions that disable screen capture utilities, snippet tools, and print-screen keys, rendering screen-capture attempts as blank screens.
Stage 3

Device Boundaries and BYOD Prohibitions

  • Strict Prohibition of Unmanaged Personal Devices: For secret and top-secret repositories, we implement strict identity and device access policies that prohibit personal, unmanaged, or non-compliant devices (BYOD) from accessing or synchronising data. Access is granted solely from verified, fully managed corporate endpoints.
  • Containerization for Moderate Tiers: Where mobile access to lower classification tiers is permitted, we enforce encrypted application containers that prevent copying data into personal mobile applications.
Stage 4

Data Leakage Prevention Across All Channels

  • Removable Media Restrictions: We configure endpoint controls that block copying classified documents to unencrypted USB drives, external storage devices, or network shares.
  • Channel and Cloud Exfiltration Blocks: Real-time data loss prevention rules monitor corporate browsers, email gateways, and messaging platforms, blocking attempts to upload or paste classified material into unsanctioned personal cloud storage or webmail.
  • Print Governance: We enforce rules that block the physical printing of secret and top-secret files on corporate endpoints.
Stage 5

Access Reviews and Lifecycle Governance

  • Privileged Data Access Elevation: Access to classified repositories is placed under just-in-time privileged access management, eliminating permanent standing permissions.
  • Scheduled Access Certifications: We configure recurring access reviews—conducted quarterly for secret and top-secret tiers—automatically revoking access if data owners do not recertify permissions.
  • Automated Lifecycle Changes: Automatic access changes apply when people join, move, or leave, where licensed.
  • Secure Disposal and Disposition Reviews: We configure automated retention schedules paired with multi-stage disposition reviews, generating tamper-proof proof-of-disposal records when classified data reaches the end of its lifecycle.
Client Governance Scope

What Stays With Your Organisation

Complying with NCA DCC involves physical, legal, and operational responsibilities that software configuration cannot resolve:

Personnel Security Screening

Performing candidate vetting, national security clearances, and background checks for personnel handling secret or top-secret information.

Signed Legal Pledges

Obtaining signed physical or administrative agreements from staff pledging not to use unapproved personal cloud storage or social media for corporate data.

Physical Room Security

Establishing closed, physical meeting rooms, accredited secure compartments, and physical access controls for strategic consultants handling classified materials.

Physical Printer Bay Security

Installing CCTV cameras covering centralized office printing bays and operating high-security cross-cut paper shredders.

Printer Hardware Firmware

Configuring physical multifunction printer settings, such as hardware disk wiping and immediate memory clearing after print jobs.

Protecting Non-Production Data

Conducting risk assessments and masking production databases before migrating data into development, testing, or training environments.

Independent Regulatory Audits

Contracting independent, accredited audit organisations to perform mandatory periodic audits required by the standard.

Engagement Outputs

Technical Deliverables You Receive

At the conclusion of a DCC implementation engagement, PolicySecOps provides:

Asset 01

Classification & Encryption Architecture

Four-tier sensitivity labels, dynamic watermarking rules, and rights management configurations deployed across your tenant.

Asset 02

Hardened Device & DLP Boundaries

Enforced identity and device access policies blocking unmanaged hardware from classified data, paired with endpoint exfiltration blocks.

Asset 03

Verifiable Audit & Disposal Records

Retention schedules, disposition review workflows, and configuration exports formatted for regulatory review.

Asset 04

As-Built Engineering Documentation

Detailed technical workbooks describing every policy switch, permission assignment, and administrative boundary.

Data Security Architecture Review

Align Your Microsoft 365 Tenant With NCA DCC

We assess your existing Microsoft subscriptions and data repositories to identify the exact technical controls required to protect classified data.

Request a Scoped Proposal