Third-Party Risk
Managing risk from suppliers and vendors.
A free NCA CCC-2:2024 compliance checklist — the provider and tenant control sets, all four classification levels, and the evidence each subdomain needs.
A guide to NCA Cloud Cybersecurity Controls (CCC-2:2024) — the CSP and CST control sets, four classification levels, and the data localisation change.
A guide to the NCA Cybersecurity Guidelines for Internet of Things (CGIoT-1:2024) — four domains, 81 guidelines, and eleven principles for IoT manufacturers.
A free NCA CSCC compliance checklist — the seven criticality criteria, all 21 subdomains, and the review, patching and testing cadences inspectors ask for.
A guide to NCA Critical Systems Cybersecurity Controls (CSCC) — the seven identification criteria, 32 controls, and the in-Kingdom access and hosting rules.
A free NCA DCC-1:2022 compliance checklist — the four classification levels, every control by data lifecycle stage, and the third-party sharing rules.
A guide to NCA Data Cybersecurity Controls (DCC-1:2022) — four classification levels, 19 controls across the data lifecycle, and third-party sharing rules.
A guide to the NCA National Policy for MSOC and the licensing framework — the Tier 1 requirement, the 90-day report, and what in-house SOCs must do next.
A guide to NCA OSMACC-1:2021 — the 15 controls protecting official Saudi social media accounts, from MFA and dedicated devices to impersonation monitoring.
A guide to NCA Operational Technology Cybersecurity Controls (OTCC) — the three facility levels, 122 subcontrols, and the OT zone and remote access rules.
A free SAMA BCM Framework compliance checklist — every lifecycle stage, evidence requirement and testing cadence Saudi banks need before an inspection.
A practitioner's guide to the SAMA Counter-Fraud Framework in 2026 — scope, the four domains, the maturity model, third-party due diligence and fraud reporting for Saudi banks.
How Saudi organisations run third-party and vendor risk assessment in 2026 — tiering, due diligence, right-to-audit clauses and monitoring under SAMA, NCA ECC and PDPL.
How to handle PDPL cross-border data transfers from Saudi Arabia — adequacy, safeguards, SaaS vendor flows, and data residency strategies explained.