Analysis of Saudi regulatory developments and practical guidance for security and risk leaders.
SAMA CRFR Article 4.2 requires an annual fraud-risk assessment but does not prescribe scenario taxonomy. This guide lists the seven fraud-scenario categories examiners expect and shows how to structure your assessment to satisfy both the regulator and the board.
NCA ECC Domain 1 requires fourteen separate cybersecurity policies, but many institutions create redundant documents or miss mandatory clauses. This checklist shows which policies are genuinely required, which three can be consolidated, and the eleven clauses every policy must contain.
Most penetration tests verify preventive controls but never prove your SOC can detect and contain a real attack. SAMA CSF Domain 6 controls 6.3.1 to 6.3.4 require testing detection and response capabilities through four adversary objectives that reveal whether your defences actually work.
The NCA reduced the remediation window for critical vulnerabilities in internet-facing systems from sixty to thirty days in Q1 2025. This article explains which assets the new clock applies to, the three acceptable compensating controls when vendor patches are unavailable, and the evidence format that satisfies NCA inspectors during the interim period.
The NCA quietly amended Control 1-4-1 in April 2025 to require documented phishing simulations and vishing exercises, not just classroom awareness. This update explains the two new simulation types, quarterly frequency expectations, and the three baseline metrics auditors now check during inspections.
Most SAMA-regulated institutions log everything but correlate almost nothing, turning their SIEM into an expensive archive. This article identifies the four correlation-logic gaps that Domain 4 maturity assessments verify and shows how to test whether your rules actually reduce detection time.
Most ISO 27001 projects treat threat intelligence as a subscription purchase, then fail certification because Annex A 5.7 requires documented processes. We describe our four-phase method that produces the evidence auditors require and delivers intelligence your SOC can act on within the same quarter.
Generic threat-intelligence feeds list tactics and indicators, but boards need to know which business assets are at risk. This article shows the three-step method three Jeddah firms used to map threat actors to critical systems, turning abstract intelligence into prioritised control investments.
NCA ECC Domain 4 requires a documented incident response plan, yet many organisations submit generic frameworks instead of scenario-specific playbooks. This guide explains the six mandatory scenarios and the notification decision matrix that auditors verify in every plan review.
Tell us where you stand. We will show you the shortest path to what your regulator expects.
SAMA, NCA and SDAIA changes and what they mean for your institution — once a month.
↑↓ to move↵ to openEsc to close
