NCA ECC
Gap assessment and remediation against the National Cybersecurity Authority Essential Cybersecurity Controls, the mandatory baseline for most Saudi organizations.
Learn moreTelecom and ICT providers answer to the Communications, Space and Technology Commission. We assess you against its Cybersecurity Regulatory Framework and prepare the evidence the regulator expects.
The Communications, Space and Technology Commission (CST) regulates the ICT sector in the Kingdom and has issued a Cybersecurity Regulatory Framework for ICT service providers. It sets cybersecurity requirements for the providers that run the networks and digital services the country depends on.
The framework covers governance, risk management, protection of networks and customer data, incident handling and reporting, and third-party risk. It sits alongside the NCA controls, and providers commonly need to show alignment with both.
Every engagement follows the Cyber Shields rhythm: Assess, Protect, Monitor. For this engagement, that translates into the following steps.
Findings are anchored to recognized frameworks so they are defensible and cross-mappable.
The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.
Every engagement is scoped individually. Pricing depends on the size and complexity of your environment, the systems or controls in scope, and the timeline you need to work to. Rather than publish figures that rarely fit a specific situation, we prepare a written proposal with a clear fee and schedule once your scope is understood.
Tell us about your organization and the deadline you are working toward, and we will return a tailored proposal within five business days, following a signed Non-Disclosure Agreement.
Yes, substantially. We cross-map them so evidence collected once serves both.
It depends on your licence and services. We confirm applicability during scoping.
Yes. We review your incident handling and reporting process against the framework.
Yes. Reports, the executive summary, and the readout session are available in both Arabic and English at no additional cost.
Gap assessment and remediation against the National Cybersecurity Authority Essential Cybersecurity Controls, the mandatory baseline for most Saudi organizations.
Learn moreImplementation and certification readiness for an Information Security Management System recognised by partners and clients worldwide.
Learn moreInternal and external network testing for exposed services, weak configurations, and lateral-movement paths, following PTES and NIST SP 800-115.
Learn moreTell us about your licences and services and we will return a written proposal within five business days. NDA first, always.