Cybersecurity
GRC Consulting for NCA, SAMA & CMA Readiness
SERVICE ENGINEERING GUIDE
BrightGate provides governance, risk and compliance consulting for organisations in Saudi Arabia. We help assess readiness against applicable NCA, SAMA and CMA requirements, establish accountable control owners, and turn gaps into a prioritised remediation programme.
Saudi regulatory readiness, matched to your organisation
We first confirm your business activities, regulator, entities, systems and current obligations. The engagement then maps the relevant requirements to controls, evidence and named owners. Scope and applicability are agreed with your compliance team.
NCA cybersecurity readiness
Assess applicable Essential Cybersecurity Controls (ECC 2-2024) and agree any additional relevant NCA control sets. Review implementation evidence, identify gaps and establish a prioritised improvement roadmap.
NCA official controls ↗SAMA framework readiness
Support in-scope financial organisations with governance, cyber risk management and compliance, operational controls and third-party considerations under the applicable SAMA Cyber Security Framework. Agree the assessment scope and evidence requirements before delivery.
SAMA official framework ↗CMA cybersecurity readiness
Support capital market institutions in evaluating the CMA Cybersecurity Guidelines, including governance, risk management and assurance, operational security and third-party controls. Record applicable obligations, gaps and follow-up actions.
CMA official guidelines ↗BrightGate provides readiness and implementation support. The customer retains regulatory accountability; the engagement does not constitute regulator approval or a compliance certification.
What we deliver in practice
Control applicability & baseline
Review organisational scope and identify relevant controls with the customer. Map current evidence to requirements and distinguish implemented, partially implemented and unverified controls; applicability requires customer validation.
Control applicability and evidence-gap register.
Risk assessment & treatment
Relate threats and weaknesses to business assets and service impact. Agree likelihood and impact scales, treatment options, owners and due dates; make residual risk acceptance a recorded management decision.
Risk register and prioritised treatment plan.
Policies & operating procedures
Tailor policy content to actual responsibilities and technology. Define approval, exception, review and evidence-retention workflows, then run workshops so control owners know what records they must maintain.
Policy set, responsibility matrix and workflow templates.
GRC workflow enablement
Configure agreed workflows in the chosen GRC platform or structured register. Assign evidence requests and review cycles, track remediation and prepare management reporting without treating software deployment as compliance approval.
Configured registers, dashboards and review calendar.
Third-party and supplier risk
Define supplier assessment criteria, due diligence, risk ownership and review cycles, including relevant cloud and outsourcing dependencies.
Supplier risk register and assessment workflow.
Management reporting and assurance
Agree control KPIs, risk indicators, evidence quality checks and reporting cadence. Prepare traceable findings and follow-up actions for management and assurance reviews.
Management dashboard requirements and evidence-review calendar.
Resilience and recovery governance
Review business-impact assumptions, service dependencies, recovery ownership and exercise evidence within the agreed scope.
Resilience governance gaps and a prioritised action plan.
The technology, explained
GRC
Governance assigns decisions and accountability; risk management prioritises exposure; compliance maps obligations to controls and evidence. The three need a shared operating process.
Residual risk
The exposure remaining after controls are applied. Its acceptance needs an accountable decision, with assumptions, review dates and treatment responsibilities recorded.
Control evidence
Records demonstrating that a control exists and operates, such as approvals, configuration extracts or reviewed test results. A policy document alone may not prove execution.
Reference architectures & design practices
Illustrative patterns for project discussions. Final topology, sizing, products and acceptance criteria are developed against your requirements. These are BrightGate concept diagrams, not vendor-certified designs.
From requirement to assurance evidence+
On smaller screens, scroll the diagram sideways to see all components.
Requirements are mapped to controls and accountable owners. Evidence is reviewed, gaps become tracked actions, and management reviews the residual exposure. This operating model supports readiness; it is not a regulatory approval or certification.
Design practices to apply
- Store evidence with owner, date and control reference.
- Separate control execution from independent review.
- Use risk priority to sequence remediation.
Systems, products & official references
Examples to evaluate during scoping. Selection, supported features, hardware and licences depend on the agreed solution; a product mention does not imply a certification or an included purchase.
NCA ECC
Official Saudi control reference; applicability and current requirements are established for the specific organisation.
Official reference NCA Essential Cybersecurity ControlsSHAHIN AI GRC
A platform option for governance and evidence workflows, subject to the selected modules and scope.
Official reference SHAHIN AI — official solution overviewNIST Cybersecurity Framework
A reference for organising cybersecurity outcomes and discussing current and target capabilities.
Official reference NIST Cybersecurity FrameworkA result your team can accept
Acceptance evidence
Traceability
Sample a requirement through control, owner, evidence and remediation.
Risk decisions
Confirm treatment owners and documented acceptance of residual risks.
Operating adoption
Run an evidence-request and review cycle with control owners.
View the complete capability checklist
- Governance policies, roles and security operating model
- Risk assessments, risk registers and treatment plans
- Saudi NCA control-readiness mapping where applicable
- ISO 27001 readiness and control-gap assessments
- Privacy-control mapping and data-governance support
- Third-party risk and supplier assessment workflows
- Business-continuity and recovery governance
- Audit evidence, dashboards and SHAHIN GRC configuration