Analysis of Saudi regulatory developments and practical guidance for security and risk leaders.
Generic awareness training fails because it does not reflect your actual threat landscape or job roles. This article shows our four-phase method: threat and role mapping, module design in Arabic and English, delivery cadence, and quarterly phishing simulation with board-ready metrics.
Boards often approve an AML risk assessment without testing whether high-risk scenarios appear in it. This article sets out three FATF Recommendation 1 components to challenge and a scenario-testing method to confirm coverage.
Healthcare providers often inherit SaaS contracts signed before NCA ECC applied to them, leaving gaps in data location and incident notification. This article walks through three contract amendments that close those gaps without forcing a platform migration.
Boards often sign the annual SWIFT attestation without knowing which controls were independently verified. This article gives directors three questions on scope, evidence quality and gap closure to ask before signing.
Most fraud assessments start with a control checklist and miss the scenarios that matter. Our four-week discovery sprint maps thirty-two attack scenarios to product lines before scoring a single control.
A detailed walk-through of our six-week SAMA counter fraud framework assessment method, from governance review to control-gap register. Understand the evidence requested, workshops conducted, and deliverables you receive for board presentation and examiner discussion.
ISO 27001 Clause 6.1.2 yields a technical risk register, but boards approve appetite in business terms. This article sets out a three-step translation from risk-assessment output to appetite statements the board will recognise.
Most teams can draft policies internally, but five scenarios demand external expertise. This article explains when ISO 27001 policy projects require a consultant, what good looks like in each case, and the internal effort needed even when you outsource.
Most institutions subscribe to commercial threat feeds but cannot demonstrate how intelligence is contextualized, integrated into operations or used to inform control decisions. This article identifies the three evidence gaps SAMA assessors flag most often and the documentary trail that closes each gap.
Tell us where you stand. We will show you the shortest path to what your regulator expects.
SAMA, NCA and SDAIA changes and what they mean for your institution — once a month.
↑↓ to move↵ to openEsc to close
