NCA Risk Management
Adopt the national framework for identifying, assessing, treating and reporting cybersecurity risk.
Learn moreManage risk the same way across the whole organization. We align your enterprise and cybersecurity risk management with ISO 31000, so every risk is identified, assessed, treated and reported in one common language.
ISO 31000 provides principles, a framework and a process for managing risk of any kind. It is a guideline rather than a certifiable requirements standard: organizations use it to design a risk management approach that fits their context and supports better decisions.
For cybersecurity, ISO 31000 is the common ground between the security team and the rest of the business. It sits naturally alongside the NCA National Framework for Cybersecurity Risk Management and the risk process expected by ISO/IEC 27001.
Every engagement follows the Cyber Shields rhythm: Assess, Protect, Monitor. For this engagement, that translates into the following steps.
Findings are anchored to recognized frameworks so they are defensible and cross-mappable.
The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.
Every engagement is scoped individually. Pricing depends on the size and complexity of your environment, the systems or controls in scope, and the timeline you need to work to. Rather than publish figures that rarely fit a specific situation, we prepare a written proposal with a clear fee and schedule once your scope is understood.
Tell us about your organization and the deadline you are working toward, and we will return a tailored proposal within five business days, following a signed Non-Disclosure Agreement.
No. ISO 31000 is a guideline, not a certifiable standard. Organizations align with it to improve how they manage risk.
It provides the overall method; cybersecurity risk management, such as the NCA framework or ISO/IEC 27005, applies it to cyber risks.
No. We build on what works and fill the gaps, so the change is practical.
Yes. Reports, the executive summary, and the readout session are available in both Arabic and English at no additional cost.
Adopt the national framework for identifying, assessing, treating and reporting cybersecurity risk.
Learn moreImplementation and certification readiness for an Information Security Management System recognised by partners and clients worldwide.
Learn moreA tested, certifiable business continuity system, from impact analysis to rehearsed recovery.
Learn moreWho the NFCRM applies to, its four phases, the 5x5 matrix and what must be reported to the NCA.
Read the articleTell us how risk is managed today and we will return a written proposal within five business days. NDA first, always.