Analysis of Saudi regulatory developments and practical guidance for security and risk leaders.
Control 3-3-2 requires continuous monitoring of third-party cyber risk, but the ECC does not define frequency or acceptable evidence. This article explains the four monitoring mechanisms we implement and how to document each for NCA audits.
SAMA examiners distinguish between registered ownership and actual control when reviewing corporate KYC files. This article explains the three-layer verification process that satisfies beneficial-ownership requirements under Article 2.3.1.
The NCA reduced the remediation window for critical vulnerabilities in internet-facing systems from sixty to thirty days in Q1 2025. This article explains which assets the new clock applies to, the three acceptable compensating controls when vendor patches are unavailable, and the evidence format that satisfies NCA inspectors during the interim period.
The NCA quietly amended Control 1-4-1 in April 2025 to require documented phishing simulations and vishing exercises, not just classroom awareness. This update explains the two new simulation types, quarterly frequency expectations, and the three baseline metrics auditors now check during inspections.
Recent NCA guidance and regional threat patterns have introduced three cybersecurity awareness topics that were optional in 2023 but are now baseline expectations. Compliance officers and HR directors should understand which modules to add to their 2025 training calendar and the evidence format inspectors request during control 1-4-1 verification.
SDAIA has intensified its PDPL inspections in early 2025, focusing on four specific compliance areas. This update explains what data controllers must prioritise before the next inspection cycle.
Answer a few questions for your framework. You get a score, your biggest gaps and — if you want it — a detailed assessment from our team.
Tell us where you stand. We will show you the shortest path to what your regulator expects.
SAMA, NCA and SDAIA changes and what they mean for your institution — once a month.
↑↓ to move↵ to openEsc to close
