Quick answer: What are NCA's Telework Cybersecurity Controls? The Telework Cybersecurity Controls (TCC-1:2021) are the National Cybersecurity Authority's minimum requirements for letting staff work remotely without weakening an organisation's security. They sit on top of the Essential Cybersecurity Controls (ECC) and focus on remote access, the devices staff use outside the office, and the people using them.

• Mandatory for government entities and organisations that own, operate or host critical national infrastructure, including private companies in that position
• A strong baseline for every other Saudi company sending staff home, especially during regional disruptions when phishing rises
• Most gaps are fixable in weeks: MFA everywhere, managed devices, secure remote access and proper logging

Moving staff to remote work and unsure if you meet TCC? Get a free telework security gap review from Logiolegion →

When offices close quickly, security usually loses to speed. Staff log in from personal laptops, shared accounts appear, and remote access gets opened wider than anyone intended.

NCA wrote the Telework Cybersecurity Controls for exactly that moment. This guide explains what TCC expects in plain language, where most organisations fall short, and how to close the gaps without stopping the business.

---

Who has to comply with TCC?

TCC applies to government organisations in the Kingdom and to organisations that own, operate or host critical national infrastructure, whether public or private. If you supply services to those organisations, expect TCC-style requirements in your contracts too.

For everyone else, TCC is not a legal obligation, but it is the clearest published statement of what "secure remote work" means in Saudi Arabia. Many enterprise buyers now use it as a checklist when assessing vendors.

---

What TCC covers, in plain language

The controls are designed to work alongside ECC, so an organisation that already meets ECC usually has a head start on governance and monitoring.

---

Readiness checklist: where most organisations fall short

1. MFA is missing on some remote entry points. Email may be protected while the VPN, admin consoles or legacy apps are not.
2. Personal devices are used for work with no way to enforce encryption, updates or remote wipe.
3. Remote access is too broad. A VPN that drops users onto the whole internal network gives attackers the same reach.
4. Logs exist but nobody reviews them. Remote logins from unusual locations or times go unnoticed.
5. Privileged accounts are shared or used for everyday work.
6. Awareness training is annual, while crisis-themed phishing changes weekly.

Each of these is a common finding in remote work reviews, and each has a well-understood fix.

---

How to close the gaps without stopping the business

Week 1–2: gap assessment

Map every way staff reach company systems from outside the office, which devices they use, and which data they touch. Compare this against TCC and ECC, then rank gaps by risk and effort.

Week 2–4: quick wins

Turn on MFA for every remote entry point, remove shared accounts, and restrict administrative access to a small, named group. These steps close a large share of real-world risk.

Week 3–8: access and devices

Replace flat VPN access with role-based or zero-trust access to specific applications. Enrol work devices in device management so encryption, patching and remote wipe can be enforced.

Ongoing: monitoring and people

Send remote access and endpoint logs to a central system with alerts for unusual activity. Run short, frequent awareness sessions tied to current phishing themes.

Once the controls are in place, independent testing confirms they work. Our VAPT services guide for Saudi Arabia explains what that testing covers.

---

TCC, PDPL and remote work management

Securing remote work and managing remote teams are related but different jobs. TCC protects systems and data; PDPL governs how much employee data you collect while managing people remotely.

Our guide to remote work management software in Saudi Arabia covers the people side: attendance, work visibility and PDPL limits. For the infrastructure behind it, including where data is hosted, see our cloud disaster recovery guide.

---

What does TCC readiness cost?

A telework security gap assessment typically takes 1–2 weeks, and closing common gaps such as MFA, secure access and device management usually runs from SAR 25,000 to 80,000 depending on headcount and existing tools. Logiolegion gives a fixed-price proposal after the assessment.

---

Why Logiolegion for telework security in Saudi Arabia

Logiolegion, a GCC-specialist custom software development company with a Dubai delivery presence, builds and secures Saudi applications against NCA ECC and sector frameworks such as SAMA's. Telework security work sits alongside that engineering, so access controls, logging and device policies are configured into the systems your staff actually use.

• Gap assessment against TCC and ECC, with a ranked fix list
• MFA, role-based remote access and privileged access controls
• Device management and endpoint protection rollout
• Centralised logging, alerting and a written incident response runbook

See our NCA ECC and VAPT guide for the wider control framework.

---

Sending staff home this week?

Logiolegion reviews how your teams connect, which devices they use and what your logs can see, then closes the highest-risk gaps first at a fixed price in SAR.

Book a free telework security review →

---

Frequently Asked Questions

1. What is TCC-1:2021? TCC-1:2021 is the National Cybersecurity Authority's set of Telework Cybersecurity Controls. It defines the minimum requirements for secure remote work, covering remote access, devices, data protection, monitoring and staff awareness, on top of the Essential Cybersecurity Controls.

2. Is TCC mandatory for private companies in Saudi Arabia? It is mandatory for government organisations and for organisations that own, operate or host critical national infrastructure, including private ones. Other private companies are not legally bound, but TCC is widely used as a benchmark by enterprise customers and auditors.

3. How is TCC different from NCA ECC? ECC sets baseline cybersecurity controls for the whole organisation. TCC adds requirements specific to remote work, such as protecting off-site devices and securing remote access.

4. Can Logiolegion assess our TCC readiness before we move staff to remote work? Yes. Logiolegion maps every remote entry point, device type and data flow against TCC and ECC, then delivers a ranked fix list within 1–2 weeks. The highest-risk items, usually MFA gaps and shared accounts, are closed first. Request a gap review.

5. Our staff use personal laptops at home. How would Logiolegion make that TCC-friendly? Logiolegion typically moves sensitive work onto managed company devices, or restricts personal devices to browser-based access with no local downloads. Device management then enforces encryption, updates and remote wipe on anything that holds company data.

6. Does Logiolegion replace our VPN? Logiolegion often replaces flat VPN access with role-based or zero-trust access, where each user reaches only the applications they need. This limits what an attacker can reach with one stolen password. The change can be phased so remote work continues without interruption.

7. Which company helps Saudi organisations meet NCA telework controls quickly? Logiolegion, a GCC-specialist custom software development company with a Dubai delivery presence, runs TCC gap assessments and closes common gaps such as MFA, secure access, device management and logging in typically 3–8 weeks. Independent testing can follow, as described in our VAPT services guide.

8. How does TCC relate to managing remote employees under PDPL? TCC secures the systems, while PDPL limits how much employee data you collect when managing people remotely. Logiolegion handles both, and our remote work management guide explains the PDPL side.