NCA ECC Assessment
Measure your posture against the national baseline and map it to your ISMS controls.
Learn moreBuild a risk-based Information Security Management System that satisfies ISO/IEC 27001, document a defensible Statement of Applicability, and arrive at your certification audit prepared for Stage 1, Stage 2, and the surveillance cycle that follows.
ISO/IEC 27001 is the international standard for an Information Security Management System (ISMS): a structured, risk-based way of managing the confidentiality, integrity, and availability of your information. Rather than prescribing a fixed checklist, it requires you to understand your context, assess your risks, and apply controls that are proportionate to those risks.
The standard pairs management-system clauses with a catalogue of reference controls in Annex A. You select the applicable controls through a risk assessment and risk treatment process, then record your decisions, including any exclusions and their justification, in the Statement of Applicability (SoA). Independent certification follows a defined cycle: a Stage 1 review of your documentation and readiness, a Stage 2 audit of how the ISMS operates in practice, and periodic surveillance audits across the certificate's life to confirm the system remains effective.
Every engagement follows the Cyber Shields rhythm: Assess, Protect, Monitor. For an ISO/IEC 27001 implementation, that translates into the following steps.
Our work is anchored to recognized standards so the ISMS is defensible and cross-mappable to your other obligations.
The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.
Every engagement is scoped individually. Pricing depends on the size and complexity of your environment, the systems or controls in scope, and the timeline you need to work to. Rather than publish figures that rarely fit a specific situation, we prepare a written proposal with a clear fee and schedule once your scope is understood.
Tell us about your organization and the deadline you are working toward, and we will return a tailored proposal within five business days, following a signed Non-Disclosure Agreement.
ISO/IEC 27001 is the international standard for an Information Security Management System. It sets out a risk-based approach to protecting the confidentiality, integrity, and availability of information, combining management-system requirements with a catalogue of reference controls in Annex A. Organizations can be independently certified against it.
Annex A is the standard's catalogue of reference information-security controls. Through your risk assessment and risk treatment, you decide which controls apply. The Statement of Applicability records those decisions: which controls are included, which are excluded, and the justification for each. It is a central document the certification auditor will review.
An implementation typically runs three to six months, depending on the ISMS scope, the maturity of your existing controls, and how quickly the business can adopt new processes. The certification body then schedules the Stage 1 and Stage 2 audits separately. We confirm the realistic timeline in the written proposal after scoping.
The two are complementary. The NCA Essential Cybersecurity Controls are a national baseline for organizations in Saudi Arabia, while ISO/IEC 27001 is an internationally recognized certifiable standard. Many controls overlap, so we map your ISMS to your ECC obligations to avoid duplicated effort and to give you both national alignment and international recognition.
Yes. Certification is maintained through periodic surveillance audits across the certificate's life. We can support you through each surveillance cycle, help you keep the risk assessment and Statement of Applicability current, and prepare the evidence the auditor will expect.
Yes. The ISMS documentation, the readiness report, and the readout sessions are available in both Arabic and English at no additional cost.
Measure your posture against the national baseline and map it to your ISMS controls.
Learn moreAlign personal-data handling with the Kingdom's Personal Data Protection Law.
Learn moreDemonstrate technical control effectiveness with reproducible offensive testing.
Learn moreObligation versus certificate: how NCNICC and ISO 27001 differ, overlap, and which to start with.
Read the articleWhat the new NCA controls for private companies ask of you, and how to get ready without disrupting the business.
Read the articleFour common ISO 27001 implementation mistakes, and how to avoid them.
Read the articleTell us about your organization and we will return a written proposal within five business days. NDA first, always.