NCA ECC Assessment
Map your posture to the National Cybersecurity Authority's Essential Cybersecurity Controls and reach audit readiness.
Learn moreMeasure your institution against the Saudi Central Bank's Cyber Security Framework using its maturity model, receive a gap and risk register tied to each domain, and follow a remediation roadmap that moves you to your target maturity level.
The Cyber Security Framework issued by the Saudi Central Bank (SAMA) sets the cyber security expectations for its member organizations. These include banks, insurance companies, financing companies, credit bureaus, and payment service providers operating in the Kingdom of Saudi Arabia. The framework exists to raise the resilience of the financial sector against evolving threats and to protect the data and services that underpin it.
Rather than a simple pass or fail checklist, the framework uses a maturity model. Each control is assessed against defined maturity levels, so an institution can see not only whether a control exists but how well it is defined, implemented, measured, and improved over time. SAMA sets a target maturity level that member organizations are expected to reach and sustain.
The framework is organized into main domains covering cyber security leadership and governance, cyber security risk management and compliance, cyber security operations and technology, and third-party cyber security. Subcontrols sit beneath each domain and are the unit of assessment in the maturity model.
Every engagement follows the Cyber Shields rhythm: Assess, Protect, Monitor. For a SAMA CSF engagement, that translates into the following steps.
Findings are anchored to recognized control frameworks so they are defensible and cross-mappable.
The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.
Every engagement is scoped individually. Pricing depends on the size and complexity of your environment, the systems or controls in scope, and the timeline you need to work to. Rather than publish figures that rarely fit a specific situation, we prepare a written proposal with a clear fee and schedule once your scope is understood.
Tell us about your organization and the deadline you are working toward, and we will return a tailored proposal within five business days, following a signed Non-Disclosure Agreement.
The framework applies to organizations regulated by the Saudi Central Bank, including banks, insurance companies, financing companies, credit bureaus, and payment service providers. Many suppliers and technology partners to these institutions are also expected to evidence their cyber security posture under the framework's third-party requirements.
Instead of a simple pass or fail, each control is assessed against defined maturity levels that describe how well a control is documented, implemented, measured, and improved. SAMA sets a target maturity level that member organizations are expected to reach and sustain. Our assessment shows your current level for each subcontrol and the distance to the target.
The two frameworks serve different regulators and have different scopes. SAMA CSF governs the financial sector under the Saudi Central Bank, while the NCA Essential Cybersecurity Controls form the National Cybersecurity Authority's baseline for organizations more broadly. There is meaningful overlap in governance, risk, and operations, so we cross-map findings to reduce duplicated effort where both apply.
Yes. We help you prepare the evidence, validate that your maturity ratings are supportable, and conduct a pre-assessment review before submission. The responsibility for the submission remains with your institution, and we make sure the underlying assessment is complete and defensible.
Yes. The reporting, the board-ready summary, and the readout session are available in both Arabic and English at no additional cost.
Map your posture to the National Cybersecurity Authority's Essential Cybersecurity Controls and reach audit readiness.
Learn moreBuild the management system that satisfies governance controls and earns certification.
Learn moreProactively search your environment for adversary activity that automated controls may miss.
Learn moreTell us about your institution and we will return a written proposal within five business days. NDA first, always.