Analysis of Saudi regulatory developments and practical guidance for security and risk leaders.
Most tabletop exercises test containment and skip the regulatory-notification workflow. This article sets out four playbook steps to test under time pressure and a scorecard to measure the result.
A section-by-section structure for an incident response playbook NCA ECC assessors and real incidents can both rely on. It covers triggers, roles, containment, evidence, escalation and notification, and shows how a tabletop exposes the sections nobody can follow.
Many institutions measure recovery time objectives by system downtime rather than business-process interruption, leading SAMA BCM assessors to reject their analyses. This article explains the process-mapping method that links business activities to revenue, regulatory deadlines and customer obligations to produce defensible recovery priorities.
NCA ECC requires documented incident response capabilities and periodic testing. This article walks through the four-phase tabletop structure—scenario design, role assignment, simulation, and after-action reporting—so your team can demonstrate readiness and identify gaps before a real incident.
Many institutions test recovery plans through tabletop discussions that never validate technical restoration or decision-making under stress. This article defines four exercise scenarios that SAMA BCM examiners expect to see documented, with participant roles, decision logs, and recovery-time measurements for each.
NCA ECC control 4-2-3 requires notification within 72 hours of discovering a cybersecurity incident, but most breaches are detected in stages. This article explains how to define discovery in your playbook, which evidence to timestamp, and how to prepare the initial notification when you have partial information.
Most RTOs are set by asking IT how fast they can restore a system. SAMA BCM Section 4.3 requires the opposite: start with business-impact analysis, define maximum tolerable disruption, then design recovery strategies to meet it. This article walks through the four-step method to derive defensible RTOs.
SAMA Counter-Fraud Framework Article 4.3 mandates preservation of evidence for fraud investigation, but many teams collect only application logs. This article lists the four evidence types required, minimum retention windows, and the collection sequence that prevents gaps.
Answer a few questions for your framework. You get a score, your biggest gaps and — if you want it — a detailed assessment from our team.
Tell us where you stand. We will show you the shortest path to what your regulator expects.
SAMA, NCA and SDAIA changes and what they mean for your institution — once a month.
↑↓ to move↵ to openEsc to close
