Analysis of Saudi regulatory developments and practical guidance for security and risk leaders.
A practical walkthrough of our four-phase method for designing cybersecurity governance that meets SAMA ITGF requirements. From mandate mapping to board-approved charter, each phase delivers documented structures that auditors accept.
QSAs now verify that fraud-detection rules monitor specific transaction behaviours, not just threshold alerts. This article lists the five patterns PCI DSS v4.0 expects every fraud system to detect and shows how to document them for assessments and vendor RFPs.
Many institutions test recovery plans through tabletop discussions that never validate technical restoration or decision-making under stress. This article defines four exercise scenarios that SAMA BCM examiners expect to see documented, with participant roles, decision logs, and recovery-time measurements for each.
SAMA ITGF requires an annual cybersecurity audit, but most audit committees approve scope proposals without asking whether the audit will test actual control effectiveness or merely verify documentation. Three questions ensure your audit delivers assurance, not just a checklist.
Most vCISO engagements fail to define concrete deliverables in the first quarter, leaving boards uncertain whether the arrangement delivers value. This checklist maps fifteen tangible outputs a vCISO must produce before presenting the first quarterly security report to the board.
PCI DSS v4.0 Requirement 8.4.2 demands multi-factor authentication for the cardholder environment, but Nafath alone does not prove the device initiating the payment is bound to the authenticated identity. This article walks through four test scenarios that expose gaps in device binding and transaction signing, and shows the evidence QSAs expect.
Control 5.2.3 requires documented network segmentation for external-facing services, but most architectures fail to show how inbound traffic is filtered, inspected and routed before reaching the cardholder-data environment. This article maps the three mandatory traffic patterns that SAMA examiners and QSAs verify during architecture reviews.
Underwriters do not weigh all ISO 27001:2022 Annex A controls equally when pricing cyber insurance. Eight specific controls—from backup testing to tabletop exercises—correlate with measurable premium reductions because they reduce claims frequency in actuarial models.
Underwriters verify five Annex A controls first because they predict claims frequency. This guide lists the exact evidence each requires, the formats accepted, and the three documentation gaps that trigger exclusions or premium loading.
Tell us where you stand. We will show you the shortest path to what your regulator expects.
SAMA, NCA and SDAIA changes and what they mean for your institution — once a month.
↑↓ to move↵ to openEsc to close
