Analysis of Saudi regulatory developments and practical guidance for security and risk leaders.
Most tabletop exercises test containment and skip the regulatory-notification workflow. This article sets out four playbook steps to test under time pressure and a scorecard to measure the result.
A SAMA CSF security architecture review checklist of twelve design questions for core banking, payment switch and treasury deployments. Use it before go-live to find system-specific risks while they are still cheap to fix.
Several Riyadh institutions appointed a CISO before the function's mandate was written down, and spent a long period resolving overlap with IT and risk. This article sets out the mistakes behind that pattern and the five mandate elements that prevent it.
Click rates alone do not show whether employees can recognise real threats. This article sets out five quarterly metrics and a scenario-rotation pattern that measure detection skill rather than template memory.
NCA ECC projects often stall when evidence collection pulls technical teams off their daily work. This article sets out a phased approach to ECC-2:2024 readiness that keeps client effort focused and predictable.
Clause 6.1.2 asks for a repeatable risk assessment process, not a hundred-page register. This article explains its four mandatory elements and three identification methods that auditors accept.
New buy-now-pay-later products carry embedded fraud vectors that emerge only after launch. This article identifies three transaction-behaviour patterns that SAMA Counter-Fraud Framework Article 2.4 requires product committees to assess during design, and shows how a fraud-risk assessment scores each pattern before the product goes live.
SAMA CSF Control 1-3-1 requires timely access provisioning and de-provisioning, but most institutions lack the workflow that links HR events to identity lifecycle. This article walks through our five-phase method to deliver joiner mover leaver SAMA CSF 1-3-1 access governance that produces the audit evidence examiners request.
The SAMA CRFR fraud risk register needs more than a heat map. This guide sets out six scenario dimensions for each entry and an inherent-versus-residual method that tests whether controls work.
Tell us where you stand. We will show you the shortest path to what your regulator expects.
SAMA, NCA and SDAIA changes and what they mean for your institution — once a month.
↑↓ to move↵ to openEsc to close
