Kuwait NCSC National Basic Cybersecurity Controls

The Kuwait National Cyber Security Center (NCSC) is the competent national authority responsible for building and developing an effective national cybersecurity ecosystem in the State of Kuwait. The NCSC’s mandate includes protecting vital interests and critical infrastructure, strengthening national cybersecurity capabilities, and issuing national cybersecurity strategies, policies, and standards.

To establish a common national minimum level of cybersecurity, the NCSC issued Decision No. 2 of 2026, establishing the National Basic Cybersecurity Controls (NBCC). These controls apply to government civil, military, and security agencies, as well as relevant private sector institutions within the State of Kuwait.

A key component of this regulation for organizations utilizing cloud services is:

• Appendix A – Cloud Security Minimum Controls: This section outlines the mandatory baseline controls (CLD-1 through CLD-16) that regulated entities must implement when using public cloud services, including Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and Software-as-a-Service (SaaS). It comprehensively governs cloud acquisition, shared responsibility, identity and access management, data protection, data residency, and operational security. Regulated entities retain ultimate accountability for data classification, access management, and resource configuration.

Navigating the Kuwait NCSC NBCC Requirements on Google Cloud

This guide highlights Google Cloud's core commitment to security and compliance and details how our services align with the Cloud Security Minimum Controls (Appendix A) outlined by the Kuwait NCSC. It provides actionable implementation links to assist you with understanding how Google Cloud Platform (GCP) capabilities, features, and contractual commitments can help you meet the NCSC requirements as a cloud service provider.