Analysis of Saudi regulatory developments and practical guidance for security and risk leaders.
The NCA periodically updates ECC control language and evidence expectations, but many institutions discover changes only when an assessor flags a gap. This checklist presents eight control amendments issued in Q1 2025, explains what changed in each, and identifies which policies or technical configurations you must update.
NCA ECC control 4-2-3 requires notification within 72 hours of discovering a cybersecurity incident, but most breaches are detected in stages. This article explains how to define discovery in your playbook, which evidence to timestamp, and how to prepare the initial notification when you have partial information.
Most screening tools pass exact-match tests but fail on transliteration variants, missing aliases and incomplete customer data. This article walks through the five recurring gaps found during sanctions screening validation and the evidence an independent validator delivers to satisfy examiners.
Three Saudi banks discovered their screening tools failed on transliteration, diacritics and name-order variations. Here are the four fuzzy-matching parameters to test before your next SAMA inspection.
Recent NCA guidance and regional threat patterns have introduced three cybersecurity awareness topics that were optional in 2023 but are now baseline expectations. Compliance officers and HR directors should understand which modules to add to their 2025 training calendar and the evidence format inspectors request during control 1-4-1 verification.
A routine coverage review revealed that a healthcare provider's cyber insurance excluded the very costs PDPL breach notification would trigger. This case shows which three sub-limits close the gap before a breach occurs.
Article 23 permits cross-border transfers only when adequate safeguards exist, but the regulation does not define them. This guide lists the five documented measures that SDAIA inspections verify, with sample clauses and retention requirements for each.
SDAIA has intensified its PDPL inspections in early 2025, focusing on four specific compliance areas. This update explains what data controllers must prioritise before the next inspection cycle.
FATF assessors verify that financial-crime training reaches the board, is role-specific, and produces completion evidence. Here are the three questions directors should ask to confirm their institution's program meets mutual-evaluation standards.
Tell us where you stand. We will show you the shortest path to what your regulator expects.
SAMA, NCA and SDAIA changes and what they mean for your institution — once a month.
↑↓ to move↵ to openEsc to close
