Saudi NCA CGIoT assessment
Cameras, access control panels, building management systems and sensors are often the least managed devices on the network. We assess them against the NCA’s Cybersecurity Guidelines for the Internet of Things, from procurement to decommissioning, and test a sample of each device type on site.
Who it is for
- Organizations with CCTV, access control, building management or industrial sensors on their network.
- Facilities and IT teams who share ownership of the same devices.
- Organizations writing IoT security requirements into procurement.
What we assess
- An inventory of IoT devices, checked against what is actually on the network.
- Procurement and supplier requirements, including update commitments.
- A sample of each device type: default credentials, exposed services, firmware currency, encryption and remote management.
- Network segregation between IoT devices and corporate systems.
- Patching, monitoring, incident response and secure decommissioning.
- The physical side: whether the devices and their cabinets can be reached and tampered with.
What you receive
- A CGIoT register with evidence and remediation steps.
- A validated IoT asset inventory.
- Device findings that name the setting, firmware version or network change needed.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically two to four weeks, depending on device types and sites.
Common questions
Are the CGIoT mandatory?
They are published as guidelines. Whether they bind you depends on your sector and contracts, and many organizations use them as the benchmark for IoT procurement and operations regardless.
Will testing disrupt cameras or doors?
We agree a sample and a schedule with the device owners, avoid anything that could take a device offline, and leave safety-related systems to configuration review only.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
Saudi NCA CGIoT assessment
We reply within one business day.
Nothing you send is shared outside Calibre.