GRC Advisory
Governance, Risk & Compliance frameworks tailored to Saudi regulatory requirements including SAMA CSF and NCA ECC.
Learn MoreServices
Cybersecurity advisory built for Saudi regulation
Governance, risk, compliance and security leadership services aligned to SAMA, NCA and SDAIA requirements — scoped to your institution and delivered with evidence.
Compliance Assessments
Comprehensive gap assessments and readiness reviews against SAMA CSF, NCA ECC, PDPL, and ISO 27001.
Learn MoreCybersecurity Governance & Organization
We design or strengthen your cybersecurity governance: the function, its mandate, committees, roles and responsibilities, and how decisions reach the board.
Learn MorePolicies, Standards & Procedures
We develop or update your cybersecurity policies, standards and procedures, mapped to the frameworks you must meet and written in Arabic and English.
Learn MoreCyber Risk Management
We establish or mature your cyber risk management: methodology, appetite, assessment, treatment and reporting — integrated with your enterprise risk framework.
Learn MoreRegulatory Compliance Remediation Program
We run your remediation program after an assessment or regulatory review: prioritizing gaps, coordinating owners, implementing controls and building the evidence that closes each finding.
Learn MoreThird-Party & Supply-Chain Cyber Risk
We set up and run your third-party cyber risk program: vendor tiering, due-diligence questionnaires, contract clauses, assessments and ongoing monitoring.
Learn MoreIdentity & Access Governance
We strengthen how access is granted, reviewed and removed — joiner-mover-leaver processes, privileged access, segregation of duties and periodic access reviews.
Learn MoreISO/IEC 27001 ISMS Implementation
We implement your ISO/IEC 27001:2022 ISMS: scope, risk assessment, Statement of Applicability, policies, internal audit and management review — ready for certification.
Learn MoreGet Started
Need a custom solution?
Talk to our team to discuss your specific requirements.
Framework explorer
SAMA
NCA
SDAIA
SAMA
SAMA
NCA
SWIFT
ISO/IEC
PCI SSC
NIST
What each framework asks of you — and what we deliver
Pick a framework to see who it applies to, what it covers and what an engagement produces.
Saudi regulation
International and industry
SAMA CSF
SAMA’s Cyber Security Framework for the institutions it regulates, assessed on a maturity scale.
Applies to
BanksInsurance companiesFinance companiesOther SAMA-regulated institutions
Main areas
Leadership and governanceRisk management and complianceOperations and technologyThird-party cyber security
What we deliver
- Maturity assessment against every control
- Gap analysis and remediation roadmap
- Policies, standards and procedures
- Evidence pack for SAMA reviews
Typical first engagement: 8–12 weeks
NCA ECC-2:2024
The Essential Cybersecurity Controls — the baseline the National Cybersecurity Authority sets for national entities.
Applies to
Government entitiesCompanies owning or operating critical infrastructureTheir service providers
Main areas
Cybersecurity governanceCybersecurity defenseCybersecurity resilienceThird-party and cloud cybersecurity
What we deliver
- Compliance assessment with evidence
- Remediation plan with owners and dates
- Policies and procedures set
- Support through the NCA self-assessment
Typical first engagement: 6–10 weeks
PDPL
The Personal Data Protection Law and its regulations, overseen by SDAIA.
Applies to
Any organization processing personal data in the KingdomIncluding processing outside the Kingdom about its residents
Main areas
Lawful basis and consentData-subject rightsSecurity and breach notificationTransfers outside the Kingdom
What we deliver
- Personal data inventory and mapping
- Privacy notice and records of processing
- Breach response procedure
- Staff awareness
Typical first engagement: 6–8 weeks
SAMA BCM
SAMA’s Business Continuity Management framework for keeping critical services running through disruption.
Applies to
BanksInsurance and finance companies regulated by SAMA
Main areas
Governance and policyBusiness impact analysisContinuity and recovery plansTesting and exercises
What we deliver
- Business impact analysis
- Continuity and disaster-recovery plans
- Exercise design and reports
- Gap assessment against the framework
Typical first engagement: 8–12 weeks
SAMA CRFR
SAMA's fundamental requirements for cyber resilience: the baseline capabilities regulated institutions are expected to have in place to withstand, respond to and recover from cyber incidents.
Applies to
Institutions regulated by SAMA, as set out in SAMA's circularsTheir critical third parties, where the requirements extend to them
Main areas
Cyber resilience governance and oversightIdentification of critical services and assetsProtection and detection capabilitiesIncident response and recoveryTesting, exercising and continuous improvement
What we deliver
- Gap assessment against the requirements
- Prioritized remediation roadmap
- Resilience policies, plans and playbooks
- Exercise program and evidence pack for SAMA
Typical first engagement: 6–10 weeks for the assessment
NCA CCC
The Cloud Cybersecurity Controls — NCA’s requirements for cloud service providers and the organizations that use them.
Applies to
Cloud service providersOrganizations using cloud services
Main areas
GovernanceDefenseResilienceThird-party
What we deliver
- Cloud control assessment
- Shared-responsibility mapping
- Configuration review
- Remediation roadmap
Typical first engagement: 4–8 weeks
SWIFT CSCF
The Customer Security Controls Framework behind SWIFT’s yearly attestation.
Applies to
Every institution connected to SWIFT
Main areas
Secure your environmentKnow and limit accessDetect and respond
What we deliver
- Independent assessment of the controls
- Architecture-type review
- Evidence for the attestation
- Remediation support
Typical first engagement: 3–6 weeks
ISO/IEC 27001:2022
The international standard for an information security management system (ISMS): how an organization sets, runs, measures and improves its information security, with certification by an accredited body.
Applies to
Main areas
PCI DSS v4.0
The security standard for any organization that stores, processes or transmits payment card data, maintained by the PCI Security Standards Council.
Applies to
Main areas
NIST CSF 2.0
A widely used framework for managing cybersecurity risk, organized around six functions: Govern, Identify, Protect, Detect, Respond and Recover.
Applies to
Main areas
Readiness self-check
How ready are you? Find out in two minutes
Answer a few questions for your framework. You get a score, your biggest gaps and — if you want it — a detailed assessment from our team.
Ready to talk about your compliance?
Tell us where you stand. We will show you the shortest path to what your regulator expects.