📚 Knowledge Base

SAMA CSF v2 covers 5 major domains: (1) Leadership & Governance, (2) Risk Management & Compliance, (3) Cybersecurity Operations, (4) Third Party Cybersecurity, and (5) Cybersecurity Resilience. Each domain has multiple sub-domains and hundreds of controls. The framework aligns with ISO 27001, NIST CSF, and Basel III requirements.

SAMA CSF has 4 maturity levels: Level 1 - Initial/Ad-hoc (minimal controls, reactive), Level 2 - Developing (basic policies exist), Level 3 - Defined (documented, consistent), Level 4 - Managed (measured, monitored). SAMA expects financial institutions to achieve at least Level 3 for all critical controls.

You can request a demo directly through our website at ciso.sa by clicking "Request Demo" or by contacting us through the contact form. Our team will reach out within 24 hours to schedule a personalized demonstration of our platform and services.

A virtual CISO (vCISO) is a part-time or fractional Chief Information Security Officer service. CISO Consulting provides experienced security leaders who work with your organization remotely or on-site to develop cybersecurity strategy, manage compliance, oversee security operations, and report to the board — at a fraction of the cost of a full-time CISO.

The Saudi Personal Data Protection Law (PDPL) was issued by Royal Decree in 2021 and enforced by SDAIA (Saudi Data and AI Authority). It regulates the collection, processing, storage, and transfer of personal data. Key requirements include: legal basis for processing, data subject rights (access, correction, deletion), breach notification within 72 hours, and cross-border transfer restrictions.

NCA ECC (Essential Cybersecurity Controls) is a mandatory cybersecurity framework issued by the National Cybersecurity Authority (NCA) of Saudi Arabia. It applies to all government agencies and critical national infrastructure. ECC has 5 domains with 114 controls covering governance, defense, resilience, third parties, and cybersecurity technologies.

The SAMA Cyber Security Framework (CSF) is a mandatory cybersecurity standard issued by the Saudi Central Bank (SAMA) for all regulated financial institutions in Saudi Arabia. It covers 5 domains: Leadership & Governance, Risk Management & Compliance, Operations & Technology, Third-Party, and Resilience. Organizations are assessed on a maturity scale from 1 (Initial) to 5 (Optimizing).

Our core services include: vCISO (virtual Chief Information Security Officer), GRC assessments, regulatory compliance (SAMA CSF, NCA ECC, PDPL), penetration testing, security awareness training, risk management, incident response planning, and our AI-powered GRC platform.

CISO Consulting is a specialized cybersecurity and GRC platform designed for organizations in Saudi Arabia. It provides virtual CISO services, compliance management, risk assessments, and security frameworks aligned with SAMA CSF, NCA ECC, PDPL, and international standards.

The CISO Consulting platform includes: Risk Register (create, assess, treat risks), Policy Manager (create, publish, track policies), Audit Management (plan, execute, track findings), BCP/DR Management, Regulatory Tracker (SAMA CSF, NCA ECC, PDPL, ISO 27001 and more), Posture Scorecard (real-time security score), KPI/KRI Dashboard, Control Testing, Evidence Repository, Vendor Risk Management, Asset Inventory, Benchmark Platform, and AI-powered risk predictions.

CISO Consulting is a specialized cybersecurity and GRC platform designed for organizations in Saudi Arabia. It provides virtual CISO services, compliance management, risk assessments, and security frameworks aligned with SAMA CSF, NCA ECC, PDPL, and international standards.

Our core services include: vCISO (virtual Chief Information Security Officer), GRC assessments, regulatory compliance (SAMA CSF, NCA ECC, PDPL), penetration testing, security awareness training, risk management, incident response planning, and our AI-powered GRC platform.

The SAMA Cyber Security Framework (CSF) is a mandatory cybersecurity standard issued by the Saudi Central Bank (SAMA) for all regulated financial institutions in Saudi Arabia. It covers 5 domains: Leadership & Governance, Risk Management & Compliance, Operations & Technology, Third-Party, and Resilience. Organizations are assessed on a maturity scale from 1 (Initial) to 5 (Optimizing).

The CISO Consulting platform includes: Risk Register (create, assess, treat risks), Policy Manager (create, publish, track policies), Audit Management (plan, execute, track findings), BCP/DR Management, Regulatory Tracker (SAMA CSF, NCA ECC, PDPL, ISO 27001 and more), Posture Scorecard (real-time security score), KPI/KRI Dashboard, Control Testing, Evidence Repository, Vendor Risk Management, Asset Inventory, Benchmark Platform, and AI-powered risk predictions.

NCA ECC (Essential Cybersecurity Controls) is a mandatory cybersecurity framework issued by the National Cybersecurity Authority (NCA) of Saudi Arabia. It applies to all government agencies and critical national infrastructure. ECC has 5 domains with 114 controls covering governance, defense, resilience, third parties, and cybersecurity technologies.

The Saudi Personal Data Protection Law (PDPL) was issued by Royal Decree in 2021 and enforced by SDAIA (Saudi Data and AI Authority). It regulates the collection, processing, storage, and transfer of personal data. Key requirements include: legal basis for processing, data subject rights (access, correction, deletion), breach notification within 72 hours, and cross-border transfer restrictions.

A virtual CISO (vCISO) is a part-time or fractional Chief Information Security Officer service. CISO Consulting provides experienced security leaders who work with your organization remotely or on-site to develop cybersecurity strategy, manage compliance, oversee security operations, and report to the board — at a fraction of the cost of a full-time CISO.

You can request a demo directly through our website at ciso.sa by clicking "Request Demo" or by contacting us through the contact form. Our team will reach out within 24 hours to schedule a personalized demonstration of our platform and services.

SAMA CSF v2 covers 5 major domains: (1) Leadership & Governance, (2) Risk Management & Compliance, (3) Cybersecurity Operations, (4) Third Party Cybersecurity, and (5) Cybersecurity Resilience. Each domain has multiple sub-domains and hundreds of controls. The framework aligns with ISO 27001, NIST CSF, and Basel III requirements.

SAMA CSF has 4 maturity levels: Level 1 - Initial/Ad-hoc (minimal controls, reactive), Level 2 - Developing (basic policies exist), Level 3 - Defined (documented, consistent), Level 4 - Managed (measured, monitored). SAMA expects financial institutions to achieve at least Level 3 for all critical controls.