Services
Cybersecurity advisory built for Saudi regulation
Governance, risk, compliance and security leadership services aligned to SAMA, NCA and SDAIA requirements — scoped to your institution and delivered with evidence.
What does your institution need to get done?
Managed security services
Security operations, run for you
Monitoring, detection, response, testing, infrastructure controls and security leadership, delivered as services with agreed targets and plain reporting.
Some managed services are delivered by a vetted delivery partner rather than by CISO Consulting's own team. Each service states who delivers it, and the proposal confirms the delivering party and the contract before you commit.
Detect and respond
Exposure and testing
Infrastructure and cloud
Meet a regulator's requirements
10 services · Aligned to SAMASOC Analyst Training
Hands-on SOC training at three levels: alert triage, detection engineering and threat hunting, built on the tools and regulations your team works with. Training · One to five days, on site or online View service Awareness and trainingGovernance, Risk & Compliance Training
GRC training at three levels: governance fundamentals, risk assessment and treatment, and building a unified control framework your regulator can follow. Training · One to five days, on site or online View service Awareness and trainingSAMA & NCA Compliance Training
Training on the SAMA Cyber Security Framework and the NCA Essential Cybersecurity Controls: what each domain asks for, what evidence proves it and how assessments run. Training · One to five days, on site or online View service Awareness and trainingIncident Response & Digital Forensics Training
Incident response and digital forensics training with live simulations: containing an attack, preserving evidence and reporting to regulators on time. Training · One to five days, on site or online View service Awareness and trainingPenetration Testing & Ethical Hacking Training
Hands-on penetration testing training: web, network and mobile testing, from reconnaissance to a report developers can act on. Training · One to five days, on site or online View service Awareness and trainingCloud Security Training
Cloud security training for architects, engineers and compliance teams, covering shared responsibility, identity, data protection and the NCA cloud controls. Training · One to five days, on site or online View service Awareness and trainingSecure Application Development Training
Secure coding and application security training for developers, testers and product owners, from common weaknesses to threat modeling and secure pipelines. Training · One to five days, on site or online View service Awareness and trainingNetwork & Infrastructure Security Training
Network and infrastructure security training: segmentation, firewalls, secure remote access, hardening and monitoring, with labs on common enterprise platforms. Training · One to five days, on site or online View service Awareness and trainingData Protection & Privacy Training (PDPL)
Training on the Personal Data Protection Law: lawful processing, data subject rights, breach notification and the records a privacy program must keep. Training · One to five days, on site or online View service Awareness and trainingBusiness Continuity & Resilience Training
Business continuity and resilience training aligned to the SAMA BCM framework and ISO 22301: impact analysis, recovery strategies, plans and exercises. Training · One to five days, on site or online View service Awareness and trainingExecutive & Board Cybersecurity Training
Cybersecurity briefings and workshops for boards, executives and new security leaders: accountability, risk appetite, regulation and crisis decisions. Training · One to five days, on site or online View service Awareness and trainingCyber Threat Intelligence Training
Threat intelligence training: collecting and judging sources, tracking threat actors that target the region and turning findings into detections and briefings. Training · One to five days, on site or online View service Awareness and trainingIndustrial & OT Security Training
Operational technology security training for plant, facility and engineering teams: network zones, safe testing, monitoring and the NCA OT controls. Training · One to five days, on site or online View serviceNo service matches both choices. Pick another regulator, or tell us what you need.
Can't see what you need?
Describe the requirement and the deadline. We reply with a scoped proposal.
What each framework asks of you — and what we deliver
Pick a framework to see who it applies to, what it covers and what an engagement produces.
SAMA CSF
SAMA’s Cyber Security Framework for the institutions it regulates, assessed on a maturity scale.
Applies to
Main areas
What we deliver
- Maturity assessment against every control
- Gap analysis and remediation roadmap
- Policies, standards and procedures
- Evidence pack for SAMA reviews
NCA ECC-2:2024
The Essential Cybersecurity Controls — the baseline the National Cybersecurity Authority sets for national entities.
Applies to
Main areas
What we deliver
- Compliance assessment with evidence
- Remediation plan with owners and dates
- Policies and procedures set
- Support through the NCA self-assessment
NCA CSCC
The Critical Systems Cybersecurity Controls — NCA’s requirements, on top of the Essential Cybersecurity Controls, for systems whose disruption would seriously harm national interests.
Applies to
Main areas
What we deliver
- Critical system identification
- CSCC gap assessment
- Hardening and monitoring review
- Remediation roadmap
PDPL
The Personal Data Protection Law and its regulations, overseen by SDAIA.
Applies to
Main areas
What we deliver
- Personal data inventory and mapping
- Privacy notice and records of processing
- Breach response procedure
- Staff awareness
SAMA BCM
SAMA’s Business Continuity Management framework for keeping critical services running through disruption.
Applies to
Main areas
What we deliver
- Business impact analysis
- Continuity and disaster-recovery plans
- Exercise design and reports
- Gap assessment against the framework
SAMA CRFR
SAMA's fundamental requirements for cyber resilience: the baseline capabilities regulated institutions are expected to have in place to withstand, respond to and recover from cyber incidents.
Applies to
Main areas
What we deliver
- Gap assessment against the requirements
- Prioritized remediation roadmap
- Resilience policies, plans and playbooks
- Exercise program and evidence pack for SAMA
CMA CSG
The Capital Market Authority’s cybersecurity guidelines for financial market institutions — how they govern, manage and test their cybersecurity.
Applies to
Main areas
What we deliver
- Gap assessment against the guidelines
- Governance and policy set
- Risk and audit review
- Remediation roadmap
NCA CCC
The Cloud Cybersecurity Controls — NCA’s requirements for cloud service providers and the organizations that use them.
Applies to
Main areas
What we deliver
- Cloud control assessment
- Shared-responsibility mapping
- Configuration review
- Remediation roadmap
CST CRF
The Cybersecurity Regulatory Framework (CRF) — CST’s requirements for licensed service providers in the information and communications technology sector, set at three compliance levels.
Applies to
Main areas
What we deliver
- Compliance level confirmation
- CRF gap assessment
- Policy and control uplift
- Audit readiness
Aramco CCC
The Cybersecurity Compliance Certificate (CCC) Saudi Aramco requires from its third parties, showing they meet its Third Party Cybersecurity Standard.
Applies to
Main areas
What we deliver
- Classification check
- Readiness assessment
- Evidence pack
- Support through the audit firm’s review
SWIFT CSCF
The Customer Security Controls Framework behind SWIFT’s yearly attestation.
Applies to
Main areas
What we deliver
- Independent assessment of the controls
- Architecture-type review
- Evidence for the attestation
- Remediation support
ISO/IEC 27001:2022
The international standard for an information security management system (ISMS): how an organization sets, runs, measures and improves its information security, with certification by an accredited body.
Applies to
Main areas
What we deliver
- Gap assessment against all 93 controls
- ISMS scope, policies and risk register
- Internal audit and management review
- Support through stage 1 and stage 2
PCI DSS v4.0
The security standard for any organization that stores, processes or transmits payment card data, maintained by the PCI Security Standards Council.
Applies to
Main areas
What we deliver
- Scoping and data-flow mapping
- Gap assessment against v4.0
- Remediation plan and evidence pack
- Support through the SAQ or the QSA audit
NIST CSF 2.0
A widely used framework for managing cybersecurity risk, organized around six functions: Govern, Identify, Protect, Detect, Respond and Recover.
Applies to
Main areas
What we deliver
- Current-profile assessment across the six functions
- Target profile agreed with the board
- Prioritized roadmap with owners and dates
- Mapping to SAMA, NCA and ISO 27001
How ready are you? Find out in two minutes
Answer a few questions for your framework. You get a score, your biggest gaps and — if you want it — a detailed assessment from our team.
Ready to talk about your compliance?
Tell us where you stand. We will show you the shortest path to what your regulator expects.