Analysis of Saudi regulatory developments and practical guidance for security and risk leaders.
Compliance assessments verify that policies and processes exist. A ransomware incident reveals whether those controls actually function under pressure. This article maps eleven SAMA CSF controls that are stress-tested when ransomware strikes.
Most institutions subscribe to commercial threat feeds but cannot demonstrate how intelligence is contextualized, integrated into operations or used to inform control decisions. This article identifies the three evidence gaps SAMA assessors flag most often and the documentary trail that closes each gap.
Nafath authenticates the individual opening an account but does not verify who ultimately owns or controls a corporate customer. This article explains the three missing verification steps SAMA examiners cite under FATF Recommendation 24 and shows how two Riyadh fintechs adapted their eKYC workflow to capture this data.
Version 4.0 elevated external penetration testing from annual checkbox to scenario-driven validation. This article maps the four attack paths QSAs expect in scope, the testing depth required for each, and the documented evidence format that satisfies Requirement 11.3.1.
QSAs now verify that fraud-detection rules monitor specific transaction behaviours, not just threshold alerts. This article lists the five patterns PCI DSS v4.0 expects every fraud system to detect and shows how to document them for assessments and vendor RFPs.
Answer a few questions for your framework. You get a score, your biggest gaps and — if you want it — a detailed assessment from our team.
Tell us where you stand. We will show you the shortest path to what your regulator expects.
SAMA, NCA and SDAIA changes and what they mean for your institution — once a month.
↑↓ to move↵ to openEsc to close
