Analysis of Saudi regulatory developments and practical guidance for security and risk leaders.
NCA ECC Control 4-3-2 requires annual security assessments of critical third parties, but full re-audits are often impractical. This guide explains the four evidence artifacts that satisfy the annual-review obligation without re-auditing every vendor.
Mapping the 93 Annex A controls to SAMA Cyber Security Framework domains helps Saudi banks justify every inclusion and exclusion decision. This guide explains which controls are almost always applicable, which require business justification to exclude, and how to document your reasoning for auditors.
Five cryptographic controls should be validated before a key-management system goes live, and the certificate-lifecycle evidence decides whether Domain 5 logging holds up in audit. This guide shows how to scope vCISO work so the two domains stay aligned.
Clause 6.1.2 asks for a repeatable risk assessment process, not a hundred-page register. This article explains its four mandatory elements and three identification methods that auditors accept.
The SAMA CRFR fraud risk register needs more than a heat map. This guide sets out six scenario dimensions for each entry and an inherent-versus-residual method that tests whether controls work.
Requirement 1.4.2 expects proof that segmentation actually blocks access to the cardholder-data environment, not just a firewall export. This article sets out four test methods, the evidence format for each and how to choose between them.
SAMA CSF Domain 8 requires testing detection, response and recovery under realistic attack conditions, but most red-team scopes miss the adversary-simulation objectives regulators expect. This article shows which three attack scenarios map to controls 8.1, 8.2 and 8.3, and how to write a statement of work that tests people, process and technology end to end.
SAMA CRFR Article 4.2 requires an annual fraud-risk assessment but does not prescribe scenario taxonomy. This guide lists the seven fraud-scenario categories examiners expect and shows how to structure your assessment to satisfy both the regulator and the board.
Most penetration tests verify preventive controls but never prove your SOC can detect and contain a real attack. SAMA CSF Domain 6 controls 6.3.1 to 6.3.4 require testing detection and response capabilities through four adversary objectives that reveal whether your defences actually work.
Answer a few questions for your framework. You get a score, your biggest gaps and — if you want it — a detailed assessment from our team.
Tell us where you stand. We will show you the shortest path to what your regulator expects.
SAMA, NCA and SDAIA changes and what they mean for your institution — once a month.
↑↓ to move↵ to openEsc to close
