Cybersecurity assessment in Saudi Arabia and the UAE
Government organizations, critical sectors and the companies that serve them in Saudi Arabia and the UAE answer to national frameworks: the National Cybersecurity Authority’s controls in the Kingdom, and the UAE Information Assurance Regulation, with the Dubai Information Security Regulation alongside it in Dubai. We assess each control against evidence and give you a register in the regulator’s own structure.
Who it is for
- Saudi and UAE government entities, and the suppliers that serve them.
- Private sector organizations that own, operate or host critical national infrastructure.
- International companies bidding for or delivering government work in the region.
- Organizations with official social media accounts, or cameras, access control and building systems on their network.
What we assess against
Saudi NCA Essential Cybersecurity Controls (ECC-2:2024)
The NCA’s baseline for government organizations, the companies that serve them, and operators of critical national infrastructure in Saudi Arabia.
- All main domains: Cybersecurity Governance, Defense, Resilience, Third-Party and Cloud Computing Cybersecurity, and Industrial Control Systems Cybersecurity where it applies.
- Each subdomain and control rated against evidence, with the control number your NCA self-assessment uses.
- The physical security subdomain, tested on site.
Saudi NCA OSMACC (social media accounts)
An official account taken over is a public incident within minutes. We check every official account against the NCA’s Organizations’ Social Media Accounts Cybersecurity Controls with the account owner present, and never hold credentials.
- An inventory of every official account, its registered owner, and its recovery email and phone number.
- Who has access, including agencies and management tools, and how access ends when someone leaves or a contract ends.
- Multi-factor authentication, connected apps, publishing approvals and a takeover response plan.
Saudi NCA CGIoT (Internet of Things)
Cameras, access control panels, building management systems and sensors are often the least managed devices on the network. We assess them against the NCA’s IoT Cybersecurity Guidelines, from procurement to decommissioning.
- An IoT inventory checked against what is actually on the network.
- A sample of each device type: default credentials, exposed services, firmware currency and remote management.
- Segregation between IoT devices and corporate systems, and whether the devices and their cabinets can be physically reached.
UAE Information Assurance Regulation and Dubai ISR
The UAE IA Regulation, widely known by its former name, the NESA standards, sets management and technical controls for government entities and critical sectors. Dubai entities may also answer to the Dubai Information Security Regulation. We assess against whichever applies and map one to the other where both do.
- Management control families: strategy, governance, risk management, awareness, third parties and compliance.
- Technical control families, from asset management and access control to incident management and continuity.
- Control priorities, so the most important gaps close first, and physical and environmental controls tested on site.
How we assess
- Every control rated against evidence, in the structure and numbering your regulator uses.
- Links between the frameworks that apply to you, including the NCA’s Cloud, Data and Operational Technology controls, so one piece of evidence serves several.
- Data residency: whether data that must stay in the Kingdom or the UAE is hosted in a region there. See cloud security audit.
- Physical security controls, tested on site by our own physical security team.
What you receive
- A control register for each framework in scope: rating, evidence, owner and remediation step.
- A mapping between the UAE IA Regulation and the Dubai ISR where both apply.
- A remediation roadmap with a price range on every item.
- An executive summary in English, with Arabic on request.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically three to six weeks, depending on the frameworks, entities and sites in scope. OSMACC alone is usually one to two weeks for up to ten accounts.
Common questions
Who has to comply with the ECC?
The NCA applies the ECC to government organizations in Saudi Arabia and their companies and entities, and to private sector organizations that own, operate or host critical national infrastructure. It encourages other organizations to adopt it. The scope section of the published document is the authority.
We were assessed against ECC-1:2018. What now?
ECC-2:2024 is the current edition. We assess against it and map your earlier results across, so prior work carries over.
Is the UAE IA Regulation the same as the NESA standards?
Yes. The UAE IA Regulation is the current name for what was published as the NESA standards. Many contracts still use the older name.
Are the CGIoT mandatory?
They are published as guidelines. Whether they bind you depends on your sector and contracts, and many organizations use them as the benchmark for IoT procurement and operations regardless.
Do you submit to the regulator or certify us?
No. We assess readiness and give you the evidence and register to work from. Submissions are made by your organization, and we issue no certificate.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
Middle East
We reply within one business day.
Nothing you send is shared outside Calibre.