Services
Cybersecurity advisory built for Saudi regulation
Governance, risk, compliance and security leadership services aligned to SAMA, NCA and SDAIA requirements — scoped to your institution and delivered with evidence.
What does your institution need to get done?
0020 services
Show me everything
Every service across all our practices.
013 services
Meet a regulator's requirements
Strategy, governance, policies, risk, privacy and awareness.
024 services
Test and assess our defenses
Independent assessments, audits, red teaming and managed scanning.
0310 services
Fight fraud and financial crime
Counter-fraud, AML/CTF, KYC, sanctions and investigations.
042 services
Prepare for incidents and insurers
Continuity, response readiness, forensics and cyber insurance.
Meet a regulator's requirements
3 services · Aligned to International
Governance, risk and compliance
GRC Advisory
Governance, Risk & Compliance frameworks tailored to Saudi regulatory requirements including SAMA CSF and NCA ECC. Retainer · 12-month retainer View service Advisory and virtual CISOvCISO Services
Strategic cybersecurity leadership on demand — your dedicated Virtual CISO aligned to your business objectives. Retainer · Ongoing (days per month agreed) View service Governance, risk and complianceCompliance Assessments
Comprehensive gap assessments and readiness reviews against SAMA CSF, NCA ECC, PDPL, and ISO 27001. One-off assessment · 4–8 weeks View serviceCybersecurity talent — recruitment and outsourcing
We find, assess and place cybersecurity people for you — permanent hires, or specialists on our payroll working on your team. View serviceRegulatory Updates
Stay ahead of SAMA, NCA, and PDPL regulatory changes with timely intelligence, impact analysis, and practical implementation guidance. View serviceThreat Intelligence
Actionable cyber threat intelligence focused on the threats targeting Saudi organizations — not generic global feeds, but intelligence that informs real decisions. View service Security assessment and testingPenetration Testing
Advanced adversarial testing to identify vulnerabilities before threat actors do, aligned to SAMA requirements. One-off assessment · 1–4 weeks depending on scope View serviceSecurity Awareness
Customized training programs to build a security-first culture across your organization. View servicePolicy Development
End-to-end cybersecurity policy and procedure development aligned to Saudi regulatory frameworks. View serviceVirtual CISO & Security Leadership
An experienced CISO who leads your security function, reports to your board and represents you to regulators. Ongoing retainer, typically 12 months View serviceGovernance, Risk & Compliance
Governance structures, risk management and compliance programs aligned to Saudi and international frameworks. 8–16 weeks, then optional ongoing support View serviceSAMA Cyber Security Framework
Maturity assessment, gap remediation and evidence preparation against the SAMA Cyber Security Framework. Assessment 6–10 weeks; remediation as planned View serviceNCA Essential Cybersecurity Controls
Compliance assessment, remediation and self-assessment support for the NCA Essential Cybersecurity Controls. 6–10 weeks for the assessment View servicePersonal Data Protection (PDPL)
PDPL compliance programs: data mapping, records of processing, data-subject rights and breach response. 6–8 weeks View serviceSecurity Operations Advisory
Design, assessment and improvement of security operations, monitoring and incident response capabilities. 4–10 weeks depending on scope View serviceCloud & Application Security
Cloud security governance and assessment against NCA Cloud Cybersecurity Controls, and secure application practices. 4–8 weeks View serviceCybersecurity Awareness & Training
Awareness programs, executive briefings and role-based training that meet regulatory requirements and change behavior. Annual program or individual sessions View service Advisory and virtual CISOCybersecurity Strategy & Roadmap
We translate your business priorities, regulatory obligations and threat landscape into a costed, prioritized cybersecurity strategy and multi-year roadmap. Fixed-scope project · 6–10 weeks View service Governance, risk and complianceCybersecurity Governance & Organization
We design or strengthen your cybersecurity governance: the function, its mandate, committees, roles and responsibilities, and how decisions reach the board. Fixed-scope project · 4–6 weeks View service Governance, risk and compliancePolicies, Standards & Procedures
We develop or update your cybersecurity policies, standards and procedures, mapped to the frameworks you must meet and written in Arabic and English. Fixed-scope project · 6–12 weeks View service Governance, risk and complianceCyber Risk Management
We establish or mature your cyber risk management: methodology, appetite, assessment, treatment and reporting — integrated with your enterprise risk framework. Fixed-scope project · 6–8 weeks View service Governance, risk and complianceRegulatory Compliance Remediation Program
We run your remediation program after an assessment or regulatory review: prioritizing gaps, coordinating owners, implementing controls and building the evidence that closes each finding. Retainer · 3–9 months View service Data protection and privacyPersonal Data Protection (PDPL) Program
We build your PDPL compliance program: data inventory and records of processing, lawful bases, notices, data-subject rights, breach notification, transfers and DPO support. Fixed-scope project · 8–12 weeks View service Cyber resilience and continuityBusiness Continuity & Cyber Resilience
We build and test your business continuity and cyber resilience capability in line with SAMA BCM and SAMA cyber resilience requirements: impact analysis, recovery strategies, plans and… Fixed-scope project · 8–12 weeks View service Governance, risk and complianceThird-Party & Supply-Chain Cyber Risk
We set up and run your third-party cyber risk program: vendor tiering, due-diligence questionnaires, contract clauses, assessments and ongoing monitoring. Retainer · Setup 4–6 weeks, then ongoing View service Governance, risk and complianceIdentity & Access Governance
We strengthen how access is granted, reviewed and removed — joiner-mover-leaver processes, privileged access, segregation of duties and periodic access reviews. Fixed-scope project · 6–10 weeks View service Managed securityVulnerability Management Program
We run or mature your vulnerability management: scanning coverage, risk-based prioritization, remediation tracking against agreed timelines, and reporting. Managed service · Ongoing (monthly cycle) View service Security assessment and testingSecurity Architecture Review
We review the security of new and existing systems and network designs — segmentation, identity, data flows, integration and resilience — and recommend practical improvements. One-off assessment · 2–4 weeks per system View service Security assessment and testingRed Teaming & Adversary Simulation
We simulate a determined attacker pursuing agreed objectives — from initial access to impact — to test your people, processes and technology end to end. One-off assessment · 4–8 weeks View service Cyber resilience and continuityIncident Response Readiness & Tabletop Exercises
We prepare your organization to respond: incident response plan and playbooks, roles and escalation, regulatory notification, and tabletop exercises for technical teams and executives. Fixed-scope project · 4–8 weeks View service Cyber resilience and continuityDigital Forensics & Incident Investigation
When an incident happens, our specialists help contain it, preserve evidence, investigate root cause and scope, and support regulatory reporting and recovery. Advisory hours · On demand View service Security assessment and testingSecurity Operations (SOC) Maturity Assessment
We assess your security operations — in-house or outsourced — across people, process, technology, detection coverage and response, and give you a prioritized improvement plan. One-off assessment · 3–5 weeks View service Security assessment and testingSWIFT CSCF Assessment & Attestation
We independently assess your SWIFT environment against the current Customer Security Controls Framework, identify gaps and support remediation and your annual attestation. One-off assessment · 3–5 weeks View service Security assessment and testingPCI DSS Readiness & Compliance
We prepare you for PCI DSS v4.0: scoping and segmentation, gap assessment, remediation support and readiness for your QSA assessment or self-assessment questionnaire. Fixed-scope project · 6–12 weeks View service Governance, risk and complianceISO/IEC 27001 ISMS Implementation
We implement your ISO/IEC 27001:2022 ISMS: scope, risk assessment, Statement of Applicability, policies, internal audit and management review — ready for certification. Fixed-scope project · 4–8 months View service Security assessment and testingInternal Cybersecurity Audit
We perform cybersecurity audits on behalf of, or alongside, your internal audit function — planned, executed and reported to internal audit standards. One-off assessment · 3–6 weeks per audit View service Fraud risk managementFraud Assessment
An enterprise-wide assessment of internal and external fraud risk across products, channels and processes, scored against the SAMA Counter-Fraud Framework. One-off assessment · 4–6 weeks View service Fraud risk managementFraud Management Solution
Vendor-independent selection and implementation of a fraud management system: requirements, vendor evaluation, rules and models, integration and go-live. Fixed-scope project · 4–9 months View service Fraud risk managementSAMA Counter-Fraud Framework Implementation
We design and implement the governance, policies, roles, processes and reporting your institution needs to meet the SAMA Counter-Fraud Framework. Fixed-scope project · 3–6 months View service Fraud risk managementFraud Detection and Transaction Monitoring Optimization
Review and tune the rules, scores and workflows of your fraud monitoring system across cards, mada, SARIE, instant payments and digital channels. Fixed-scope project · 6–10 weeks View service Fraud risk managementDigital Banking and Payment Fraud Controls Review
An end-to-end review of fraud controls in mobile and internet banking, eKYC onboarding (Nafath), device binding, transaction signing and customer notifications. One-off assessment · 4–8 weeks View service Fraud risk managementFraud Investigation and Forensic Accounting
Independent investigation of suspected internal or external fraud, with evidence handling suitable for disciplinary, regulatory and legal action. Advisory hours · As needed View service AML/CTF and financial crimeAML Assessment
An independent assessment of your AML/CTF program against the SAMA rules and the FATF Recommendations: governance, risk assessment, KYC, monitoring, reporting and training. One-off assessment · 5–8 weeks View service AML/CTF and financial crimeAML Compliance Solution
Vendor-independent selection and implementation of AML technology: customer risk scoring, sanctions screening, transaction monitoring and case management. Fixed-scope project · 4–9 months View service AML/CTF and financial crimeAML Monitoring and Screening Model Validation
Independent validation of transaction monitoring scenarios and name-screening tools: data quality, thresholds, fuzzy-matching performance and coverage of your risk assessment. Fixed-scope project · 6–10 weeks View service AML/CTF and financial crimeKYC, CDD and eKYC Program Review
Review of customer due diligence, enhanced due diligence, beneficial ownership, PEP handling and digital onboarding through Nafath against SAMA requirements. One-off assessment · 4–6 weeks View service AML/CTF and financial crimeSanctions Compliance Program
Design or review of your sanctions compliance program covering UN, local, OFAC and EU regimes: screening, trade and payment controls, escalation and reporting. Fixed-scope project · 6–12 weeks View service AML/CTF and financial crimeFinancial Crime Awareness Training
Role-based AML/CTF, sanctions and fraud training for the board, front line, operations and compliance teams, with completion evidence for regulators. Training · 1–3 days per audience View service Cyber insuranceCyber Insurance Readiness Assessment
We assess your controls the way underwriters do, close the gaps that drive premiums and exclusions, and prepare the evidence before you go to market. One-off assessment · 3–4 weeks View service Cyber insuranceInsurer Questionnaire and Underwriting Support
We complete insurer proposal forms and supplementary questionnaires with you, accurately and consistently, and support underwriting calls. Fixed-scope project · 1–3 weeks View service Cyber insuranceCyber Insurance Coverage Review
A broker-neutral review of your cyber policy against your actual risks: limits, sub-limits, retentions, waiting periods, exclusions and conditions. One-off assessment · 2–3 weeks View service Cyber insuranceCyber Claims and Incident Support
When an incident happens we help you meet the policy conditions: timely notification, panel firms, cost records and the evidence the insurer needs to pay. Advisory hours · As needed View service Cyber insuranceCyber Risk Quantification for Insurance
We estimate the financial impact of your most likely and most severe cyber scenarios, so limits, retentions and budgets rest on numbers the board can trust. Fixed-scope project · 4–6 weeks View serviceNo service matches both choices. Pick another regulator, or tell us what you need.
Can't see what you need?
Describe the requirement and the deadline. We reply with a scoped proposal.
Framework explorer
SAMA
NCA
NCA
SDAIA
SAMA
SAMA
CMA
NCA
CST
Aramco
SWIFT
ISO/IEC
PCI SSC
NIST
What each framework asks of you — and what we deliver
Pick a framework to see who it applies to, what it covers and what an engagement produces.
Saudi regulation
International and industry
SAMA CSF
SAMA’s Cyber Security Framework for the institutions it regulates, assessed on a maturity scale.
Applies to
BanksInsurance companiesFinance companiesOther SAMA-regulated institutions
Main areas
Leadership and governanceRisk management and complianceOperations and technologyThird-party cyber security
What we deliver
- Maturity assessment against every control
- Gap analysis and remediation roadmap
- Policies, standards and procedures
- Evidence pack for SAMA reviews
Typical first engagement: 8–12 weeks
NCA ECC-2:2024
The Essential Cybersecurity Controls — the baseline the National Cybersecurity Authority sets for national entities.
Applies to
Government entitiesCompanies owning or operating critical infrastructureTheir service providers
Main areas
Cybersecurity governanceCybersecurity defenseCybersecurity resilienceThird-party and cloud cybersecurity
What we deliver
- Compliance assessment with evidence
- Remediation plan with owners and dates
- Policies and procedures set
- Support through the NCA self-assessment
Typical first engagement: 6–10 weeks
NCA CSCC
The Critical Systems Cybersecurity Controls — NCA’s requirements, on top of the Essential Cybersecurity Controls, for systems whose disruption would seriously harm national interests.
Applies to
Government organizations that run critical systemsPrivate-sector owners and operators of critical national infrastructure
Main areas
GovernanceDefenseResilienceThird-party and cloud
What we deliver
- Critical system identification
- CSCC gap assessment
- Hardening and monitoring review
- Remediation roadmap
Typical first engagement: 6–10 weeks
PDPL
The Personal Data Protection Law and its regulations, overseen by SDAIA.
Applies to
Any organization processing personal data in the KingdomIncluding processing outside the Kingdom about its residents
Main areas
Lawful basis and consentData-subject rightsSecurity and breach notificationTransfers outside the Kingdom
What we deliver
- Personal data inventory and mapping
- Privacy notice and records of processing
- Breach response procedure
- Staff awareness
Typical first engagement: 6–8 weeks
SAMA BCM
SAMA’s Business Continuity Management framework for keeping critical services running through disruption.
Applies to
BanksInsurance and finance companies regulated by SAMA
Main areas
Governance and policyBusiness impact analysisContinuity and recovery plansTesting and exercises
What we deliver
- Business impact analysis
- Continuity and disaster-recovery plans
- Exercise design and reports
- Gap assessment against the framework
Typical first engagement: 8–12 weeks
SAMA CRFR
SAMA's fundamental requirements for cyber resilience: the baseline capabilities regulated institutions are expected to have in place to withstand, respond to and recover from cyber incidents.
Applies to
Institutions regulated by SAMA, as set out in SAMA's circularsTheir critical third parties, where the requirements extend to them
Main areas
Cyber resilience governance and oversightIdentification of critical services and assetsProtection and detection capabilitiesIncident response and recoveryTesting, exercising and continuous improvement
What we deliver
- Gap assessment against the requirements
- Prioritized remediation roadmap
- Resilience policies, plans and playbooks
- Exercise program and evidence pack for SAMA
Typical first engagement: 6–10 weeks for the assessment
CMA CSG
The Capital Market Authority’s cybersecurity guidelines for financial market institutions — how they govern, manage and test their cybersecurity.
Applies to
Capital market institutions authorized by the CMAOther organizations under CMA supervision
Main areas
GovernanceRisk management, review and auditOperational controlsThird-party security
What we deliver
- Gap assessment against the guidelines
- Governance and policy set
- Risk and audit review
- Remediation roadmap
Typical first engagement: 4–8 weeks
NCA CCC
The Cloud Cybersecurity Controls — NCA’s requirements for cloud service providers and the organizations that use them.
Applies to
Cloud service providersOrganizations using cloud services
Main areas
GovernanceDefenseResilienceThird-party
What we deliver
- Cloud control assessment
- Shared-responsibility mapping
- Configuration review
- Remediation roadmap
Typical first engagement: 4–8 weeks
CST CRF
The Cybersecurity Regulatory Framework (CRF) — CST’s requirements for licensed service providers in the information and communications technology sector, set at three compliance levels.
Applies to
Telecom operators licensed by CSTICT and digital service providers licensed or registered with CSTPostal service providers
Main areas
GovernanceAsset managementRisk managementLogical securityPhysical securityThird-party security
What we deliver
- Compliance level confirmation
- CRF gap assessment
- Policy and control uplift
- Audit readiness
Typical first engagement: 6–12 weeks
Aramco CCC
The Cybersecurity Compliance Certificate (CCC) Saudi Aramco requires from its third parties, showing they meet its Third Party Cybersecurity Standard.
Applies to
Suppliers and contractors of Aramco Group companiesService providers that host, process or connect to Aramco data and systems
Main areas
General requirementsOutsourced infrastructureCustomized softwareCloud computingNetwork connectivityOperational technologyCritical data processing
What we deliver
- Classification check
- Readiness assessment
- Evidence pack
- Support through the audit firm’s review
Typical first engagement: 3–6 weeks
SWIFT CSCF
The Customer Security Controls Framework behind SWIFT’s yearly attestation.
Applies to
Every institution connected to SWIFT
Main areas
Secure your environmentKnow and limit accessDetect and respond
What we deliver
- Independent assessment of the controls
- Architecture-type review
- Evidence for the attestation
- Remediation support
Typical first engagement: 3–6 weeks
ISO/IEC 27001:2022
The international standard for an information security management system (ISMS): how an organization sets, runs, measures and improves its information security, with certification by an accredited body.
Applies to
Any organization seeking certificationSuppliers asked for it in a tenderGroups standardizing security across entities
Main areas
Context, leadership and risk assessmentThe 93 Annex A controlsInternal audit and management reviewCertification and surveillance audits
What we deliver
- Gap assessment against all 93 controls
- ISMS scope, policies and risk register
- Internal audit and management review
- Support through stage 1 and stage 2
Typical first engagement: 6 to 9 months to certification
PCI DSS v4.0
The security standard for any organization that stores, processes or transmits payment card data, maintained by the PCI Security Standards Council.
Applies to
Merchants taking card paymentsPayment service providersAnyone storing or transmitting card data
Main areas
The 12 requirements and 6 goalsScope and cardholder data flowsSegmentation and testingThe SAQ or the Report on Compliance
What we deliver
- Scoping and data-flow mapping
- Gap assessment against v4.0
- Remediation plan and evidence pack
- Support through the SAQ or the QSA audit
Typical first engagement: 4 to 8 months
NIST CSF 2.0
A widely used framework for managing cybersecurity risk, organized around six functions: Govern, Identify, Protect, Detect, Respond and Recover.
Applies to
Boards wanting one view of cyber riskOrganizations with no single mandate to followGroups mapping several frameworks to one language
Main areas
Govern, Identify, Protect, Detect, Respond and RecoverCurrent and target profilesTiers and the improvement plan
What we deliver
- Current-profile assessment across the six functions
- Target profile agreed with the board
- Prioritized roadmap with owners and dates
- Mapping to SAMA, NCA and ISO 27001
Typical first engagement: 2 to 4 months
Readiness self-check
How ready are you? Find out in two minutes
Answer a few questions for your framework. You get a score, your biggest gaps and — if you want it — a detailed assessment from our team.
Ready to talk about your compliance?
Tell us where you stand. We will show you the shortest path to what your regulator expects.