Cybersecurity advisory,
anchored in the Kingdom's frameworks.

Cybersecurity Strategy

We build cybersecurity strategies from a maturity baseline, not a template: a current-state review against applicable NCA ECC and SAMA CSF requirements, a target state your board signs off, and a costed multi-year roadmap sequenced by risk reduction — with the investment case to defend it.

• Cybersecurity maturity review against applicable NCA ECC and SAMA CSF requirements
• Board-approved target state and guiding principles
• Costed multi-year roadmap sequenced by risk reduction
• Investment case and budget defence material

Cybersecurity Governance

NCA ECC and SAMA CSF both open with governance for a reason. We design the cybersecurity governance layer — the CISO mandate and reporting line, steering committees, roles and responsibilities across the three lines, and the metrics that let a board actually supervise security rather than receive it.

• CISO operating model, mandate and reporting line
• Cybersecurity steering committee charter and cadence
• Security roles and RACI across the three lines of defence
• Board-level security metrics and reporting pack

Security Policies & Frameworks

We author complete security documentation suites — policies, standards and procedures — mapped control-by-control to NCA ECC, SAMA CSF and ISO 27001. Written to be operated and audited rather than filed, and delivered in Arabic and English with the review workflows to keep them current.

• Policy architecture with document hierarchy and lifecycle
• Policies, standards and procedures mapped to ECC, CSF and ISO 27001
• Bilingual Arabic and English drafting with stakeholder review cycles
• Attestation, exception and periodic review workflows

Cyber Risk Advisory

We help boards and management understand and prioritise cyber risk across critical business services — connecting security exposure to business impact, regulatory obligations and treatment priorities.

• Cyber risk governance framework
• Risk scenarios and business-impact analysis on critical services
• Cyber risk register design with treatment priorities
• Cyber risk reporting for management and boards
• Alignment with applicable NCA and SAMA requirements

AI Governance & Security

AI adoption is running ahead of AI governance in most organisations. We build the structures to close that gap: AI use-case inventories and risk classification, model lifecycle controls, data protection under PDPL, and security controls for both in-house and vendor AI — aligned to SDAIA's AI Ethics Principles and emerging regulatory guidance.

• AI governance framework with use-case inventory and risk tiering
• AI security controls across the model and data lifecycle
• PDPL and data-governance impact analysis for AI workloads
• AI policy, acceptable-use standards and vendor AI assessment criteria

Security Architecture Advisory

We provide security architecture advisory independent of any vendor: an enterprise security reference architecture, design reviews for major change programmes, zero-trust roadmaps and control-placement decisions — designed against ECC and CSF control requirements from the start, so later audits get cheaper instead of harder.

• Enterprise security reference architecture
• Security design reviews for major change programmes
• Zero-trust readiness review and adoption roadmap
• Control-placement and security technology rationalisation advice