SAMA CSF
Cyber Security Framework
Alignment and implementation for banks and fintech platforms.
Built for GCC Compliance.
Every Framework. Navigable.
Each engagement begins with a gap assessment and ends with audit-ready assurance — structured like the standards themselves. We cover SAMA, NCA, CST, PCI DSS, PDPL, ISO and more across KSA, UAE, Jordan and the wider GCC.
15+
Frameworks
6
GCC Markets
End-to-end
Support
Gap → Cert
Full Journey
Framework group
SAMA & IA
Saudi Central Bank & Insurance Authority — banks, insurers & fintech
SAMA ITGF
IT Governance Framework
IT governance controls, roles, and evidence for SAMA-regulated entities.
SAMA BCM
Business Continuity Management
BIA, continuity planning, and testing aligned to SAMA BCM.
SAMA CTIP
Counter-Fraud & Threat Intelligence
Threat intel operations and reporting per SAMA CTIP.
SAMA CRFR
Fintech Cyber Resilience
Cyber resilience program for fintechs licensed by SAMA.
SAMA MVC
Minimum Verification Controls
Implementation of SAMA's minimum verification controls.
IA — Insurance
Insurance Authority Compliance
End-to-end compliance for KSA insurers and brokers.
Framework group
NCA & CST
National cybersecurity & telecom regulators
NCA ECC-2:2024
Essential Cybersecurity Controls
Gap assessment, control implementation, and NCA review support.
NCA CCC
Cloud Cybersecurity Controls
CCC-1:2020 alignment for cloud service providers and tenants.
CST CRF
Cybersecurity Regulatory Framework
Maturity assessment and compliance for ICT and telecom providers.
Framework group
Payments & Privacy
PCI DSS certification and SDAIA's PDPL
PCI DSS
Payment Card Security
Scope reduction, gap analysis, remediation, and QSA-ready evidence.
SDAIA PDPL
Personal Data Protection Law
Data inventory, privacy policies, DPO advisory, and breach playbooks.
Framework group
UAE, Jordan & International
Regional regulators and global standards
UAE IA Regulations
Information Assurance Standards
Compliance aligned with UAE National Cybersecurity Council requirements.
NCC Jordan
National Cybersecurity Centre
Advisory aligned with Jordan NCC frameworks and digital economy regulations.
ISO 27001
Information Security Management
Full ISMS implementation, risk assessment, and certification body support.
ISO 9001
Quality Management Systems
QMS design, process documentation, and certification preparation.
ZATCA
E-Invoicing Phase 2
E-invoicing alignment with ZATCA Phase 2 requirements.
Framework group
Security Testing
Offensive assurance for your controls
Penetration Testing
Network, application & infrastructure pen tests
Scoped engagements with prioritised remediation and re-test.
VAPT
Vulnerability Assessment & Penetration Testing
Combined VA and PT with executive and technical reporting.
OTP Auth Testing
OTP & authentication flow testing
Targeted testing of OTP, MFA, and authentication logic.
Working principle
Plan. Do. Check. Act.
Compliance is a cycle, not a certificate. We embed PDCA discipline into every engagement so frameworks become stages your teams can plan, implement, measure and improve.
1
Plan
Gap assessment against the framework; scoped roadmap with owners and dates.
2
Do
Policies, controls, and processes implemented alongside your teams.
3
Check
Internal audit, testing, and evidence review before the regulator looks.
4
Act
Remediation, tuning, and preparation for the next cycle of the standard.
Which regulation is keeping you up?
Start with a free discovery session — we'll bring the map.
Book a Free Discovery Session →