Compliance
Practical guides on managing the SAMA framework family, the NCA framework family, ISO 27001, SOC 2 and PDPL inside Saudi banks, government entities and regulated enterprises.
A free NCA CCC-2:2024 compliance checklist — the provider and tenant control sets, all four classification levels, and the evidence each subdomain needs.
A guide to NCA Cloud Cybersecurity Controls (CCC-2:2024) — the CSP and CST control sets, four classification levels, and the data localisation change.
A free NCA CSCC compliance checklist — the seven criticality criteria, all 21 subdomains, and the review, patching and testing cadences inspectors ask for.
A guide to NCA Critical Systems Cybersecurity Controls (CSCC) — the seven identification criteria, 32 controls, and the in-Kingdom access and hosting rules.
A free NCA DCC-1:2022 compliance checklist — the four classification levels, every control by data lifecycle stage, and the third-party sharing rules.
A guide to NCA Data Cybersecurity Controls (DCC-1:2022) — four classification levels, 19 controls across the data lifecycle, and third-party sharing rules.
A guide to the NCA National Policy for MSOC and the licensing framework — the Tier 1 requirement, the 90-day report, and what in-house SOCs must do next.
A guide to the NCA National Cryptographic Standards (NCS-1:2020) — the MODERATE and ADVANCED levels, accepted algorithms, TLS and PKI rules, and key lifetimes.
A guide to NCA OSMACC-1:2021 — the 15 controls protecting official Saudi social media accounts, from MFA and dedicated devices to impersonation monitoring.
A guide to NCA Operational Technology Cybersecurity Controls (OTCC) — the three facility levels, 122 subcontrols, and the OT zone and remote access rules.
A guide to NCA Telework Cybersecurity Controls (TCC-1:2021) — the 21 controls across three domains, BYOD and MDM rules, and offshore remote access monitoring.
A practitioner's guide to the SAMA Counter-Fraud Framework in 2026 — scope, the four domains, the maturity model, third-party due diligence and fraud reporting for Saudi banks.
How Saudi CISOs run the periodic SAMA CSF and NCA ECC self-assessment in 2026 — the maturity model, evidence, control mapping and turning two assessments into one.
How Saudi CIOs meet the SAMA IT Governance Framework in 2026 — the four domains, IT risk assessment, the IT Steering Committee, maturity model and self-assessment.
Cyber incident classification, escalation and regulatory notification for Saudi Arabia — SAMA CSF, NCA ECC and PDPL/SDAIA obligations unified in one runbook.
The definitive comparison of NCA ECC and SAMA CSF — who must comply, control counts, assessment models, the 40% overlap, and how to satisfy both with unified evidence.
SDAIA is enforcing PDPL with SAR 5M fines. Saudi banks, government entities and enterprises in Riyadh and Dammam — here is why you should act now.
How to handle PDPL cross-border data transfers from Saudi Arabia — adequacy, safeguards, SaaS vendor flows, and data residency strategies explained.
A practitioner guide to PDPL data subject rights in Saudi Arabia — access, correction, destruction, objection and the 30-day response clock explained.
A step-by-step ISO 27001:2022 certification roadmap for Saudi organisations — scope, Annex A controls, Stage 1 and Stage 2 audits, and SAMA CSF alignment.
A free NCA ECC-2:2024 compliance checklist — every domain, control and evidence requirement Saudi government and CNI operators need, free to download.
A practitioner's guide to the NCA Essential Cybersecurity Controls (ECC-2:2024) — scope, the four domains, what changed from ECC-1:2018, and assessment.
A step-by-step PDPL Saudi Arabia implementation checklist — lawful basis, DPO, records of processing, data subject rights, breach notification and transfers.
A free SAMA CSF compliance checklist for 2026 — every domain, sub-control and maturity expectation Saudi banks need to evidence, with downloadable template.
A practitioner's guide to SAMA CSF compliance in 2026 — scope, maturity model, governance, third-party depth, inspection expectations for Saudi banks.
How SAMA CSF maps to ISO 27001 Annex A — what overlaps, what's Saudi-specific, and how to run one connected ISMS that satisfies both frameworks at once.
A factual comparison of SAMA CSF and NCA ECC — issuer, scope, structure, control counts, assessment methodology and how Saudi organisations manage both.