Policies without practice
Approved policies describe controls the systems never enforce, such as password rules the directory ignores.
Compliance & assurance
Assess and implement compliance controls.
Assess what applies, test what works, and connect every gap to an owner, evidence source, and remediation action.
Assessment and remediation stages
Applicability and scope
Map which requirements apply and to which systems.
Assess
Test design, implementation, operation, and evidence across the selected framework.
Prioritize risk
Rank gaps by exposure, dependency, and business impact.
Assign ownership
Give each action a decision-maker, due date, and evidence source.
Remediate
Translate findings into governance, process, and engineering work.
Validate
Retest the control and keep the evidence current.
Frameworks
- NCA Essential and Cloud Cybersecurity Controls (ECC & CCC)
- SAMA Cyber Security Framework (CSF)
- ISO/IEC 27001 readiness and internal assessment
- PCI-DSS readiness and remediation
- Cybersecurity risk management and governance frameworks
One control library for several frameworks
A Saudi bank can answer to the Saudi Central Bank's Cyber Security Framework (SAMA CSF), the National Cybersecurity Authority's Essential Cybersecurity Controls (NCA ECC), the Payment Card Industry Data Security Standard (PCI DSS) and an ISO/IEC 27001 certificate at the same time. Four separate programmes mean four sets of documents, four rounds of testing and four versions of the truth.
The frameworks overlap heavily. All of them require governance, risk management, access control, vulnerability management, logging and monitoring, incident response and third-party security. Limaz builds one control library in which each control is written once, owned once and tested once, then mapped to every requirement it satisfies: an ECC control number, a SAMA CSF subdomain, an ISO 27001 Annex A control and a PCI DSS requirement.
The library also keeps what is unique to each framework. NCA ECC-2:2024 requires managed security operations centres that use remote access to be fully located in Saudi Arabia. SAMA CSF measures maturity and expects level 3 or above. PCI DSS applies to the cardholder data environment and every system connected to it or able to affect its security, so scoping decides how much of the library it touches. ISO 27001 requires a Statement of Applicability that justifies every Annex A control you include or exclude.
Framework mapping: which rules apply to whom
- Banks
- SAMA CSF applies to all banks operating in Saudi Arabia, with maturity level 3 as the minimum. PCI DSS v4.0.1 applies to card issuing and acquiring. NCA ECC-2:2024, and CCC-2:2024 for cloud use, apply when the bank owns, operates or hosts Critical National Infrastructure. ISO 27001 certification is voluntary and adds independent assurance.
- Insurers, credit bureaus and market infrastructure
- Insurance and reinsurance companies, credit bureaus and financial market infrastructure are all named in the SAMA CSF applicability. PCI DSS applies to any card payments they accept or process.
- Fintechs
- Financing companies fall directly under SAMA CSF. Licensed payment service providers must comply with SAMA's cybersecurity requirements under the Implementing Regulations of the Law of Payments and Payment Services. PCI DSS applies to any fintech that stores, processes or transmits card data. ISO 27001 gives bank partners and enterprise clients a recognised certificate.
- Critical National Infrastructure operators
- Private-sector entities that own, operate or host Critical National Infrastructure must comply with NCA ECC-2:2024. When they use cloud services, the tenant controls of NCA's Cloud Cybersecurity Controls (CCC-2:2024) apply. Operators of industrial control systems also follow the Operational Technology Cybersecurity Controls (OTCC-1:2022).
- Government entities
- NCA ECC-2:2024 applies to all government entities, including ministries, authorities, establishments and their companies inside and outside the Kingdom. CCC-2:2024 applies to their use of cloud services. PCI DSS applies to government payment channels that accept cards.
- Cloud service providers
- CCC-2:2024 applies to any cloud provider serving government entities or Critical National Infrastructure operators, with 37 main controls and 94 subcontrols for providers and 18 main controls and 26 subcontrols for tenants.
How a compliance assessment works
Limaz runs every assessment against the control library, so one round of fieldwork produces a result for each framework that applies to you.
Confirm applicability
Establish which frameworks apply, which entities, services and systems they cover, and the target: ECC compliance, a SAMA CSF maturity level, PCI DSS validation or ISO 27001 certification.
Collect documents
Gather policies, procedures, risk records, architecture diagrams, asset inventories, contracts and previous audit reports.
Interview control owners
Walk through each control with the people who run it in governance, IT operations, security operations, HR, procurement and engineering.
Test the controls
Test design, implementation and operation. Read the policy, check the configuration in the live system, then sample records across a period to prove the control works every time.
Rate each requirement
Record compliance status for NCA ECC, a maturity level from 0 to 5 for SAMA CSF, in place or not in place for PCI DSS, and conformity for ISO 27001.
Report findings
Rank findings by risk. Each one carries its framework references, the evidence gap and a recommended fix.
Plan remediation
Agree a roadmap with owners, dates and dependencies, sequenced so that fixes closing gaps in several frameworks come first.
Evidence that holds up in an audit
- Approved documents
- Policies and procedures with a version, an owner, an approval date and a review date. Auditors reject unsigned drafts.
- System evidence
- Configuration exports, timestamped screenshots and reports taken from production, showing the control is switched on in the live environment.
- Operating records
- Access reviews, vulnerability scan results, change tickets, incident records and training completion across the whole audit period, proving the control runs every cycle.
- Samples
- Records the assessor selects from full populations, such as all joiners and leavers in the period, to confirm the control worked in every case.
- Traceability
- Each artefact tagged to its control and to every framework requirement it supports, so one piece of evidence answers several auditors.
- Currency
- Evidence refreshed on each control's own schedule, with a named owner accountable for the next collection.
How each framework is assessed
- NCA ECC-2:2024
- NCA evaluates compliance through self-assessment by the entity, periodic reports from the ECC-2:2024 Assessment and Compliance Tool, and field audit visits. Subdomain 1-8 also requires the entity to review its own implementation periodically and to have its cybersecurity controls audited independently.
- SAMA CSF
- Member organisations are measured on a six-level maturity model from 0, non-existent, to 5, adaptive, and must reach level 3 or above. Cybersecurity audits must be independent and follow generally accepted auditing standards, and customer-facing and internet-facing services need an annual review and penetration test.
- ISO/IEC 27001:2022
- An accredited certification body audits in two stages: a review of the ISMS design, then an assessment of the ISMS in operation. Certificates run on a three-year cycle with surveillance audits in between. The transition deadline for certificates to the 2013 edition was 31 October 2025.
- PCI DSS v4.0.1
- Compliance is validated through a Report on Compliance from a Qualified Security Assessor (QSA) or a Self-Assessment Questionnaire (SAQ), according to the level the payment brands assign. The requirements that were future-dated in v4.0 became mandatory on 31 March 2025.
Remediation that sticks
Findings close quickly on paper and reopen at the next audit when the fix was a document instead of a working control. Limaz treats remediation as engineering work with an owner, a design and a test.
Each finding becomes a ticket in the backlog the responsible team already uses. Its acceptance criteria are written as the evidence the auditor will ask for. A finding closes only when that evidence exists and a retest confirms the control works.
Fixes are built into process and tooling so they keep running: access reviews scheduled in the identity platform, vulnerability deadlines enforced through the ticketing workflow, and security requirements added to change management and procurement. Evidence is collected automatically wherever the system can produce it, so the next assessment starts from current records.
Limaz also implements the technical controls, including identity and access management (IAM), privileged access management (PAM) and DevSecOps, so a finding moves straight from assessment to a working control with one accountable team.
Common compliance gaps
Evidence gathered in a rush
Screenshots collected in the week before the audit, with no history to prove the control ran all year.
Scope drawn too narrow
Cloud tenants, subsidiaries or systems connected to the card environment left out of the assessment, then found by the auditor.
One programme per framework
The same access review tested four times by four teams, producing four different results.
Third parties outside the programme
Managed service providers and cloud platforms running critical services without the contract clauses and risk assessments that ECC subdomain 4-1 and SAMA CSF domain 3.4 require.
Findings closed without a retest
Actions marked complete on the owner's word, with no evidence that the control now works.
Further reading
NCA ECC-2:2024: what changed from ECC-1, and what to update
The second edition of the Essential Cybersecurity Controls is shorter, not easier. Here is what moved, what was removed, and how to update an existing ECC programme without starting over.
SAMA CSF vs NCA ECC: which applies to you, and how to run both
Many Saudi financial institutions answer to both frameworks. The fastest route is one control library with two mappings, not two parallel programmes.
Focused services
ISO 27001 readiness
Build and test the ISMS before independent certification assessment.
PCI DSS readiness
Define payment scope, remediate gaps, and prepare evidence.
Cybersecurity risk management
Turn assessment findings into owned treatment and governance.
Security control implementation
Move remediation into working technical controls.
Questions
SAMA CSF applies to every bank operating in Saudi Arabia, with maturity level 3 as the minimum. Banks that issue or acquire cards must meet PCI DSS v4.0.1. NCA ECC-2:2024, and CCC-2:2024 for cloud services, apply when the bank owns, operates or hosts Critical National Infrastructure. ISO 27001 certification is voluntary. A single mapped control library lets a bank meet all of them with one set of evidence.
Financing companies are named directly in the SAMA CSF applicability. Licensed payment service providers must comply with the cybersecurity requirements SAMA issues, under the Implementing Regulations of the Law of Payments and Payment Services. Fintechs that store, process or transmit card data also need PCI DSS. Limaz builds the control set to SAMA CSF from the start, so licensing reviews and partner due diligence draw on the same evidence.
NCA ECC-2:2024 is the national baseline for government entities and private operators of Critical National Infrastructure, with 4 domains, 28 subdomains, 108 main controls and 92 subcontrols, assessed for compliance. SAMA CSF is the Saudi Central Bank's framework for banks, insurers, financing companies, credit bureaus and financial market infrastructure, organised in four domains and measured on a maturity scale from 0 to 5. The two overlap heavily, so one mapped control set serves both.
No. ISO 27001 certifies that your information security management system (ISMS) meets an international standard, and much of its Annex A overlaps with ECC and SAMA CSF. The Saudi frameworks add requirements of their own, such as ECC's rule that managed security operations centres using remote access sit fully inside the Kingdom, and SAMA's maturity level 3 target. A mapped control library closes the difference.
NCA evaluates compliance through self-assessment by the entity, periodic reports from the ECC-2:2024 Assessment and Compliance Tool, and field audit visits. Under subdomain 1-8, entities must also review their own implementation periodically and have their cybersecurity controls audited by an independent party. Evidence must show that each control is documented, approved, implemented and operating.
Auditors want three things for each control: an approved policy or procedure, proof that it is configured in the live system, and records showing it operated across the audit period. Examples include signed access reviews, vulnerability scan history, change tickets, incident records and training completion. Every item must be dated, attributed to an owner and traceable to the requirement it supports.
SAMA expects member organisations to reach maturity level 3, structured and formalised, or above. The scale runs from level 0, non-existent, through ad hoc, repeatable but informal, structured and formalised, and managed and measurable, to level 5, adaptive. At level 3, controls are documented, approved and implemented consistently. Level 4 adds measurement of how well they work.
Discuss your requirements with Limaz
Tell us which system, control, or requirement you are working on. We’ll come back with a clear next step.