01 · Compliance # Governance, Risk, Compliance & Audit Consulting We make sure organisations meet regulatory requirements, manage risk effectively, and align their cybersecurity strategy with business objectives. ## What’s included ### Cybersecurity strategy A strategy fully aligned with your organisational goals: vision, mission and initiatives prioritised with a balanced-scorecard approach, plus an operating model to deliver it. Typically three years, adjusted to your needs. ### Policy & procedure development - Cybersecurity policies and procedures tailored to your organisation. - Incident response, disaster recovery and business continuity plans. ### Risk assessment & management - Identify, assess and prioritise cybersecurity risks. - Risk management frameworks and policies. - Continuous risk monitoring and mitigation. ### Third-party risk management - Third-party risk frameworks and toolkits. - Due diligence on vendors and partners. - Mitigating risk from third-party services and cloud providers. ### Compliance management Achieve and maintain compliance by mapping controls to regulations in a Unified Control Framework, and prepare for certification audits such as ISO 27001, PCI-DSS and HIPAA. ### Internal & external audits - Internal audits of controls and cybersecurity posture. - Facilitating third-party and data-privacy audits. - Risk-based audits focused on your most critical areas. ### GRC tools implementation GRC platforms that automate compliance tracking, risk management and reporting, integrated with your existing enterprise systems. Regulations we work with - NCA ECC - CSCC - CCC - OSMACC - SAMA CSF - CRF - HIPAA - PCI-DSS - NIST - ISO 27001 - STAR - CIS Controls Risk standards we draw on - ISO 31000 - ISO 27005 - SA/SNZ HB 436:2013 - COBIT for Risk - NIST SP 800-30 - CSA - FedRAMP - ISO 27017 - ISO 19086-4:2019 ## What GRC means in practice - **Governance:** How security decisions are made: strategy, policies, roles, a steering committee and leadership oversight. NCA ECC and SAMA CSF both expect a dedicated cybersecurity function that is independent of IT. - **Risk management:** How you find, measure and treat threats, using a recognised method such as ISO 27005 or NIST SP 800-30 and a live risk register where every risk has an owner and a decision: reduce, transfer, accept or avoid. - **Compliance:** Meeting the laws, regulations and contracts that apply to you, and proving it with evidence. ## Saudi regulations we cover - **NCA ECC-2:2024:** The foundation of cybersecurity regulation in the Kingdom, for government entities and organisations that own, operate or host critical national infrastructure. - **NCA CCC, CSCC, OTCC, DCC and TCC:** Additional NCA controls for cloud, critical systems, operational technology, data and telework. - **SAMA Cyber Security Framework:** Mandatory for banks, insurers and finance companies. Maturity is scored from level 0 to 5, with level 3 as the expected baseline. - **Personal Data Protection Law:** Saudi Arabia’s privacy law, overseen by SDAIA: consent, data subject rights, breach notification, cross-border transfers and records of processing. - **Supply chain requirements:** Large enterprises increasingly ask suppliers to prove their security before signing, for example through third-party cybersecurity standards. ## How a GRC engagement runs 1. **Scoping workshop**: Confirm which regulations apply and agree scope, timeline and stakeholders. 2. **Information gathering**: Interviews with IT, security, HR, legal and business owners, plus document review. 3. **Control testing**: Check that controls exist on paper and work in practice. 4. **Gap and risk report**: Maturity scores, risks and priorities, with the evidence reviewed for each control. 5. **Remediation roadmap**: Quick wins, short-term and long-term actions, each with an owner and estimated effort. 6. **Implementation support**: We write documents, guide technical fixes and train staff. 7. **Validation and audit support**: We retest controls and prepare evidence packs for NCA, SAMA or ISO auditors. ## Typical deliverables - Compliance gap report with maturity scoring - Risk register and remediation roadmap - Policies, standards and procedures in Arabic and English - Business impact analysis and continuity plans - Third-party risk process - Evidence repository structure - Executive summary for the board ## Why CYBRT ### Riyadh-based, Gulf-focused Headquartered in Riyadh, working with organisations across Saudi Arabia and the Gulf. ### Certified consultants Our team holds CISA, CISM, CRISC, CGEIT, CDPSE, CCSP, CCSK, COBIT and ISO 27001 Lead Auditor certifications, among others. ### Regulation-ready We work with NCA and SAMA frameworks alongside ISO, NIST and PCI-DSS, so controls map straight to what auditors expect. ### End to end Six connected services, from strategy and awareness through testing, operations, cloud and technology. ## Frequently asked questions ### Which regulations and frameworks do you help with? NCA ECC, CSCC, CCC and OSMACC, SAMA CSF and CRF, plus HIPAA, PCI-DSS, NIST, ISO 27001, STAR and CIS Controls. We map your controls to all of them in a single Unified Control Framework. ### Can you prepare us for an ISO 27001 certification audit? Yes. We prepare organisations for certification audits including ISO 27001, PCI-DSS and HIPAA, and run internal audits beforehand to close gaps. ### How long does a cybersecurity strategy cover? Usually three years, defined with a balanced-scorecard approach and an operating model to deliver it. The horizon is flexible to suit your organisation. ### Is NCA ECC mandatory for private companies? ECC is mandatory for government organisations and for private organisations that own, operate or host critical national infrastructure. Many other companies adopt it because government clients and large enterprises require it in contracts. ### How long does it take to become ECC or SAMA compliant? A gap assessment usually takes two to six weeks. Remediation commonly takes three to twelve months, depending on your size, starting maturity and resources. ### What is the difference between NCA ECC and SAMA CSF? ECC is a control-based framework from the National Cybersecurity Authority that applies across sectors. SAMA CSF is a maturity-based framework from the Saudi Central Bank for financial institutions. SAMA-regulated entities may need to meet both. ### Can we do ISO 27001 and NCA compliance at the same time? Yes. The two overlap heavily, so we build one integrated programme and you do the work once. ## Related services ## Ready to protect your business? Book your free security consultation today. --- Canonical page: https://cybrt.sa/services/grc-consulting/ Guide for AI agents: https://cybrt.sa/llms.txt