ISO 31000
One risk language for the whole organization, aligned with ISO 31000.
Learn morePut the National Cybersecurity Authority's National Framework for Cybersecurity Risk Management to work: one consistent way to identify, assess, treat and report cybersecurity risk, owned by the business and understood by the board.
The National Framework for Cybersecurity Risk Management (NFCRM) was published by the National Cybersecurity Authority in July 2025. It gives organizations in the Kingdom a common way to manage cybersecurity risk, so that risks are identified, assessed, treated and monitored with the same discipline and language across the national landscape.
Most control frameworks, including the ECC, expect a working risk management process behind them. The framework turns that expectation into a structured method: clear roles, a defined risk appetite, a living risk register, and reporting that lets leadership make informed decisions rather than react to incidents.
Every engagement follows the Cyber Shields rhythm: Assess, Protect, Monitor. For this engagement, that translates into the following steps.
Findings are anchored to recognized frameworks so they are defensible and cross-mappable.
The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.
Every engagement is scoped individually. Pricing depends on the size and complexity of your environment, the systems or controls in scope, and the timeline you need to work to. Rather than publish figures that rarely fit a specific situation, we prepare a written proposal with a clear fee and schedule once your scope is understood.
Tell us about your organization and the deadline you are working toward, and we will return a tailored proposal within five business days, following a signed Non-Disclosure Agreement.
No. It is a framework for managing cybersecurity risk: how risks are identified, assessed, treated, monitored and reported. It supports the controls you implement under the ECC or other frameworks.
Yes. We align the cybersecurity method with your enterprise risk process and with ISO 31000, so cyber risk sits in the same register language as other business risks.
It depends on your size and starting point. We confirm a realistic timeline in the proposal once we understand your scope.
Yes. Reports, the executive summary, and the readout session are available in both Arabic and English at no additional cost.
One risk language for the whole organization, aligned with ISO 31000.
Learn moreGap assessment and remediation against the National Cybersecurity Authority Essential Cybersecurity Controls, the mandatory baseline for most Saudi organizations.
Learn moreImplementation and certification readiness for an Information Security Management System recognised by partners and clients worldwide.
Learn moreWho the NFCRM applies to, its four phases, the 5x5 matrix and what must be reported to the NCA.
Read the articleTell us how risk is managed today and we will return a written proposal within five business days. NDA first, always.