GRC Advisory · Governance, risk & compliance
One GRC programme for every regulator, standard and board
Gulf organisations answer to several masters at once: national cybersecurity frameworks, sector regulators, ISO certificates, data protection law and their own boards. A joined-up GRC programme means one set of controls and one set of evidence, reported many ways.
Discuss a GRC requirement
Framework design, regulatory mapping, ERM, internal audit or continuity.
Consulting services
GRC framework design
Define how governance, risk and compliance fit together: roles, committees, policies, the obligation register and reporting lines.
- ✓Three-lines model
- ✓Policy architecture
- ✓Committee charters and reporting
Enterprise risk management
Build or refresh an ERM framework aligned with ISO 31000: risk appetite, taxonomy, scoring, KRIs and the reporting cycle.
- ✓Risk appetite statement
- ✓Risk workshops by function
- ✓KRI design
Regulatory compliance mapping
Map national frameworks and standards to one control set so you assess once and report many times.
- ✓NCA ECC, SACS-002, SAMA, UAE IA
- ✓ISO 27001 and 22301 alignment
- ✓Gap register and roadmap
Internal audit capability
Strengthen the internal audit function: methodology, risk-based planning, competency benchmarking and auditor training.
- ✓Audit methodology and templates
- ✓Competency framework for auditors
- ✓IIA-aligned quality assessment preparation
Business continuity programme
Stand up or mature a continuity programme: BIA, strategies, plans and exercises aligned with ISO 22301 and national standards.
- ✓BIA facilitation
- ✓Plan writing and exercises
- ✓NCEMA 7000 / ISO 22301 alignment
GRC software selection
Define requirements, shortlist established platforms, run scripted demos and support implementation, so the software fits your framework rather than the other way round.
- ✓Requirements and scoring model
- ✓Scripted demos and proof of concept
- ✓Rollout and adoption
Compliance management system
Implement a compliance management system so obligations are identified, owned, monitored and reported.
- ✓ISO 37301 implementation
- ✓Anti-bribery controls (ISO 37001)
- ✓Compliance training
Regulation guides
Plain-English overviews of the Saudi and UAE frameworks organisations ask about most, and how to meet them without duplicating work.
Saudi Arabia
NCA ECC
NCA Essential Cybersecurity Controls (ECC)
Government organisations in Saudi Arabia, their companies and entities, and private-sector organisations that own, operate or host critical national infrastructure.
Aramco CCC
Aramco Cybersecurity Compliance Certificate (CCC)
Suppliers, contractors and service providers that work with Saudi Aramco, particularly those that connect to its network, handle its data, host or develop systems for it, or provide cloud or outsourced services.
Saudi PDPL
Saudi Personal Data Protection Law (PDPL)
Organisations that process personal data of individuals in Saudi Arabia, including organisations outside the Kingdom that process such data.
NCA CCC
NCA Cloud Cybersecurity Controls (CCC)
Cloud service providers serving organisations in Saudi Arabia, and organisations in scope of the ECC that use cloud services.
NCA CSCC
NCA Critical Systems Cybersecurity Controls (CSCC)
Organisations in scope of the ECC that own or operate systems classified as critical.
NCA DCC
NCA Data Cybersecurity Controls (DCC)
Organisations in scope of the ECC that handle classified data.
NCA OTCC
NCA Operational Technology Cybersecurity Controls (OTCC)
Organisations that operate industrial control systems and operational technology, such as energy, utilities, manufacturing and transport.
NDMO standards
NDMO Data Management & Personal Data Protection Standards
Government entities in Saudi Arabia, and organisations that handle government data on their behalf.
SAMA CSF
SAMA Cyber Security Framework
Banks, insurers, finance companies and other organisations regulated by SAMA.
UAE
UAE IA
UAE Information Assurance Standards
UAE government entities and organisations designated as critical information infrastructure, plus suppliers asked to demonstrate equivalent controls.
NCEMA 7000
NCEMA 7000 Business Continuity Standard
UAE federal and local government entities and organisations in critical sectors, as directed by NCEMA.
UAE PDPL
UAE Personal Data Protection Law (PDPL)
Organisations processing personal data in the UAE, outside free zones such as DIFC and ADGM that have their own data protection laws, and subject to sector-specific rules for areas like health and banking.
Choosing software?
Get help choosing and implementing GRC software.
If your framework already exists but lives in spreadsheets and email, the right software gives you one source of evidence, live dashboards and reports that build themselves. We help you define requirements, compare established platforms with scripted demos, and roll out the one you choose.
Consulting, software, or both?
Consulting first
No agreed framework, risk appetite or control set yet. Define it before buying tools.
Software first
The framework exists but runs on spreadsheets and email. Move it onto one system.
Both together
A new regulatory obligation and no system to evidence it. Design and configure in one programme.
Software guides: GRC software · Enterprise risk management software · Internal audit software · Cybersecurity compliance software · Quality management software · HSE & ESG software · Business continuity software · Document control software · Business excellence assessment software
Next step
Train the people who run it
Risk management, BIA, business continuity and ISO lead auditor courses for risk, compliance and audit teams.