Analysis of Saudi regulatory developments and practical guidance for security and risk leaders.
Internal audit teams at SAMA-regulated institutions often lack the cybersecurity depth required to review ITGF Domain 9 controls independently. This article explains our three-week method for delivering cybersecurity audits in internal audit format, from risk-based scoping to final report with management responses.
Many firms treat risk registers as spreadsheet exercises and wonder why treatment plans feel disconnected from real threats. We run three facilitated workshops that produce a register auditors accept and executives actually use for budget decisions.
Generic awareness training fails because it does not reflect your actual threat landscape or job roles. This article shows our four-phase method: threat and role mapping, module design in Arabic and English, delivery cadence, and quarterly phishing simulation with board-ready metrics.
Most fraud assessments start with a control checklist and miss the scenarios that matter. Our four-week discovery sprint maps thirty-two attack scenarios to product lines before scoring a single control.
A detailed walk-through of our six-week SAMA counter fraud framework assessment method, from governance review to control-gap register. Understand the evidence requested, workshops conducted, and deliverables you receive for board presentation and examiner discussion.
Vendor demonstrations rarely reflect your real customer names. This article explains a vendor-independent, five-week method for testing name-matching accuracy on your own portfolio before you sign.
NCA ECC projects often stall when evidence collection pulls technical teams off their daily work. This article sets out a phased approach to ECC-2:2024 readiness that keeps client effort focused and predictable.
SAMA CSF Control 1-3-1 requires timely access provisioning and de-provisioning, but most institutions lack the workflow that links HR events to identity lifecycle. This article walks through our five-phase method to deliver joiner mover leaver SAMA CSF 1-3-1 access governance that produces the audit evidence examiners request.
Vendor questionnaires consume weeks and yield generic answers that do not map to NCA CCCC control requirements. This article walks through our three-phase method—automated configuration audit via API, contract-clause gap analysis and residual-risk quantification—showing exactly what evidence the client receives at each phase.
Answer a few questions for your framework. You get a score, your biggest gaps and — if you want it — a detailed assessment from our team.
Tell us where you stand. We will show you the shortest path to what your regulator expects.
SAMA, NCA and SDAIA changes and what they mean for your institution — once a month.
↑↓ to move↵ to openEsc to close
