Saudi NCA OSMACC assessment
An official account taken over is a public incident within minutes. The NCA’s Organizations’ Social Media Accounts Cybersecurity Controls set out how organizations should own, access and protect them. We check every official account against those controls with the account owner present.
Who it is for
- Organizations within the NCA’s scope that run official social media accounts.
- Organizations whose accounts are run by an agency or through a management tool.
- Communications and security teams that want one owner for account security.
What we assess
- An inventory of every official account, its registered owner, and its recovery email and phone number.
- Who has access, through which tool, and how access ends when someone leaves or an agency contract ends.
- Multi-factor authentication, recovery settings, connected third-party apps and login history on each account.
- Policy, publishing approvals, and the response plan for takeover and impersonation, including platform escalation contacts.
What you receive
- An OSMACC control register with evidence and remediation steps.
- An account inventory with ownership and access confirmed.
- A short takeover response checklist your team can keep to hand.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically one to two weeks for up to ten accounts.
Common questions
Do you need our passwords?
No. The account owner signs in while we review settings together. We never hold credentials.
An agency runs our accounts. Is that in scope?
Yes. Third-party access is one of the most common gaps: who at the agency can post, how they sign in, and what happens to that access when the contract ends.
Who does OSMACC apply to?
Its scope broadly follows the NCA’s other controls. The scope section of the published document is the authority, and we confirm how it applies to you at scoping.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
Saudi NCA OSMACC assessment
We reply within one business day.
Nothing you send is shared outside Calibre.