الامتثال للأنظمة واللوائح السعودية

Data Privacy & Protection — PDPL Compliance

The Saudi Personal Data Protection Law (PDPL) is actively enforced by the Saudi Data & AI Authority (SDAIA).

• Data Classification & Inventory — Catalog and classify personal data across all systems.
• Privacy Impact Assessments (PIA/DPIA) — Assess privacy risks for new processes, systems, and products.
• Data Mapping & Flow Analysis — Trace personal data flows — who handles it, how, and with what protection.
• Data Retention & Disposal Policies — Establish compliant data lifecycle management procedures.
• Cross-Border Data Transfer Advisory — Navigate restrictions on international data transfers under PDPL.

NCA Essential Cybersecurity Controls (ECC) Compliance

Mandatory for all government entities and critical national infrastructure organizations.

• ECC Gap Assessment — Identify control gaps against all ECC domains.
• Compliance Roadmap — Prioritize and plan remediation activities.
• Control Implementation Support — Assist teams in deploying required technical and organizational controls.

NCA Cloud Cybersecurity Controls (CCC) Compliance

Assessment and compliance for cloud service consumers and providers.

• CCC Gap Assessment — identify control gaps against all ECC domains.
• Compliance Roadmap — prioritize and plan remediation activities.
• Control Implementation Support — assist teams in deploying required technical and organizational controls.

SAMA Cybersecurity Framework (CSF) & Payment Services

The Saudi Central Bank (SAMA) requires all financial institutions to comply with its Cybersecurity Framework; we also support the Payment Services Law.

• SAMA CSF Gap Analysis & Compliance Roadmap — Full assessment across all CSF domains and maturity levels.
• SAMA CSF Implementation Support — Operationalize required controls and processes.
• SAMA Payments & Payment Services Law — Advisory for payment service providers and fintech organizations.
• Multi-Framework Mapping — Help organizations under both SAMA CSF and NCA ECC avoid duplication.

PCI DSS & Generative AI Guidelines

• PCI DSS Compliance — Gap assessment, scoping, remediation, and audit preparation for payment card environments.
• CST Cybersecurity Regulatory Framework (CRF) — Compliance services for the telecommunications sector.
• NCA Generative AI Guidelines — Advisory for organizations deploying or consuming AI models in alignment with NCA's guidance.