01 · Compliance
Governance, Risk, Compliance & Audit Consulting
We make sure organisations meet regulatory requirements, manage risk effectively, and align their cybersecurity strategy with business objectives.
What’s included
Cybersecurity strategy
A strategy fully aligned with your organisational goals: vision, mission and initiatives prioritised with a balanced-scorecard approach, plus an operating model to deliver it. Typically three years, adjusted to your needs.
Policy & procedure development
- Cybersecurity policies and procedures tailored to your organisation.
- Incident response, disaster recovery and business continuity plans.
Risk assessment & management
- Identify, assess and prioritise cybersecurity risks.
- Risk management frameworks and policies.
- Continuous risk monitoring and mitigation.
Third-party risk management
- Third-party risk frameworks and toolkits.
- Due diligence on vendors and partners.
- Mitigating risk from third-party services and cloud providers.
Compliance management
Achieve and maintain compliance by mapping controls to regulations in a Unified Control Framework, and prepare for certification audits such as ISO 27001, PCI-DSS and HIPAA.
Internal & external audits
- Internal audits of controls and cybersecurity posture.
- Facilitating third-party and data-privacy audits.
- Risk-based audits focused on your most critical areas.
GRC tools implementation
GRC platforms that automate compliance tracking, risk management and reporting, integrated with your existing enterprise systems.
Regulations we work with
Risk standards we draw on
What GRC means in practice
- Governance
- How security decisions are made: strategy, policies, roles, a steering committee and leadership oversight. NCA ECC and SAMA CSF both expect a dedicated cybersecurity function that is independent of IT.
- Risk management
- How you find, measure and treat threats, using a recognised method such as ISO 27005 or NIST SP 800-30 and a live risk register where every risk has an owner and a decision: reduce, transfer, accept or avoid.
- Compliance
- Meeting the laws, regulations and contracts that apply to you, and proving it with evidence.
Saudi regulations we cover
- NCA ECC-2:2024
- The foundation of cybersecurity regulation in the Kingdom, for government entities and organisations that own, operate or host critical national infrastructure.
- NCA CCC, CSCC, OTCC, DCC and TCC
- Additional NCA controls for cloud, critical systems, operational technology, data and telework.
- SAMA Cyber Security Framework
- Mandatory for banks, insurers and finance companies. Maturity is scored from level 0 to 5, with level 3 as the expected baseline.
- Personal Data Protection Law
- Saudi Arabia’s privacy law, overseen by SDAIA: consent, data subject rights, breach notification, cross-border transfers and records of processing.
- Supply chain requirements
- Large enterprises increasingly ask suppliers to prove their security before signing, for example through third-party cybersecurity standards.
How a GRC engagement runs
- 01Scoping workshop
Confirm which regulations apply and agree scope, timeline and stakeholders.
- 02Information gathering
Interviews with IT, security, HR, legal and business owners, plus document review.
- 03Control testing
Check that controls exist on paper and work in practice.
- 04Gap and risk report
Maturity scores, risks and priorities, with the evidence reviewed for each control.
- 05Remediation roadmap
Quick wins, short-term and long-term actions, each with an owner and estimated effort.
- 06Implementation support
We write documents, guide technical fixes and train staff.
- 07Validation and audit support
We retest controls and prepare evidence packs for NCA, SAMA or ISO auditors.
Typical deliverables
- Compliance gap report with maturity scoring
- Risk register and remediation roadmap
- Policies, standards and procedures in Arabic and English
- Business impact analysis and continuity plans
- Third-party risk process
- Evidence repository structure
- Executive summary for the board
Why CYBRT
Riyadh-based, Gulf-focused
Headquartered in Riyadh, working with organisations across Saudi Arabia and the Gulf.
Certified consultants
Our team holds CISA, CISM, CRISC, CGEIT, CDPSE, CCSP, CCSK, COBIT and ISO 27001 Lead Auditor certifications, among others.
Regulation-ready
We work with NCA and SAMA frameworks alongside ISO, NIST and PCI-DSS, so controls map straight to what auditors expect.
End to end
Six connected services, from strategy and awareness through testing, operations, cloud and technology.
Frequently asked questions
Which regulations and frameworks do you help with?
NCA ECC, CSCC, CCC and OSMACC, SAMA CSF and CRF, plus HIPAA, PCI-DSS, NIST, ISO 27001, STAR and CIS Controls. We map your controls to all of them in a single Unified Control Framework.
Can you prepare us for an ISO 27001 certification audit?
Yes. We prepare organisations for certification audits including ISO 27001, PCI-DSS and HIPAA, and run internal audits beforehand to close gaps.
How long does a cybersecurity strategy cover?
Usually three years, defined with a balanced-scorecard approach and an operating model to deliver it. The horizon is flexible to suit your organisation.
Is NCA ECC mandatory for private companies?
ECC is mandatory for government organisations and for private organisations that own, operate or host critical national infrastructure. Many other companies adopt it because government clients and large enterprises require it in contracts.
How long does it take to become ECC or SAMA compliant?
A gap assessment usually takes two to six weeks. Remediation commonly takes three to twelve months, depending on your size, starting maturity and resources.
What is the difference between NCA ECC and SAMA CSF?
ECC is a control-based framework from the National Cybersecurity Authority that applies across sectors. SAMA CSF is a maturity-based framework from the Saudi Central Bank for financial institutions. SAMA-regulated entities may need to meet both.
Can we do ISO 27001 and NCA compliance at the same time?
Yes. The two overlap heavily, so we build one integrated programme and you do the work once.
Related services
Ready to protect your business?
Book your free security consultation today.