Regulatory compliance · KSA · Qatar · International
We prepare you for regulators in Saudi Arabia and Qatar and for international standards, from gap analysis to audit readiness.
Pick the regulator you answer to
National Cybersecurity Authority
From the Essential Controls to cloud, data and OT controls, we prepare your organization for NCA requirements, control by control.
- ECC
- CCC
- DCC
- OTCC
- TCC
- SMACC
- NCS
National Cybersecurity AuthorityNCA
Essential Cybersecurity Controls
The minimum cybersecurity baseline for national entities.
We help with
- Gap analysis
- Policies & procedures
- Technical controls
- Evidence preparation
Select a framework to see what it covers.
We help you comply; certification and accreditation are issued by the regulator.
Four clear stages, each with deliverables you hold in your hands and keep after the engagement ends.
- 01
01 / 04
Gap analysis
We measure you against every control and set priorities.
You receive
- Gap report per control
- Prioritized risk list
- Executive summary
- 02
02 / 04
Roadmap
A realistic timeline with owners and effort.
You receive
- Phased timeline
- A named owner per task
- Effort and resource estimate
- 03
03 / 04
Implementation
Policies, procedures and technical controls built with you.
You receive
- Approved policies and procedures
- Technical configurations and controls
- Awareness for the teams involved
- 04
04 / 04
Audit readiness
Organized evidence and an internal audit before the real one.
You receive
- Evidence binder mapped to controls
- Internal audit report
- Team prep for auditor interviews
We prepare, with you, the documents that prove controls exist and work, in Arabic and English, in a format you can keep updating.
- DOC-01
Information security policies
A coherent policy set sized to your organization and framework.
AR · EN
- DOC-02
Operating procedures
Practical steps showing who does what, and when.
AR · EN
- DOC-03
Risk register
Risks rated and assessed, each with a treatment plan and owner.
AR · EN
- DOC-04
Asset inventory
Systems, data and devices, with owners and classification.
AR · EN
- DOC-05
Incident response plan
Roles, escalation paths and ready-to-run playbooks.
AR · EN
- DOC-06
Business continuity plan
Recovery priorities and restore points for critical systems.
AR · EN
- DOC-07
Third-party risk
Vendor assessments and security clauses for contracts.
AR · EN
- DOC-08
Awareness & training records
What was delivered, to whom and when, in auditable form.
AR · EN
- DOC-09
Evidence binder per control
Each control linked to its proof: screenshot, log, minutes or config.
AR · EN
Six yes/no questions. Your result appears instantly on your device; nothing is stored or sent.
01Do you have an information security policy approved by top management?
02Is there an up-to-date inventory of all technology assets and their owners?
03Have you run a risk assessment in the last 12 months?
04Do you have a written, tested incident response plan?
05Are access rights to sensitive systems reviewed regularly?
06Could you show evidence for every control you apply, on request?
Answer to see your result
There are no wrong answers, just an honest picture of where you are.
This is an indicative guide only, not a formal assessment.
A scoping call to pin down the right framework and scope for your organization, with no commitment.
We help you comply; certification and accreditation are issued by the regulator.