A register nobody decides from
Risks are listed with no owner who holds authority, no treatment decision and no date. The register is updated before audits and ignored in between.
Cybersecurity risk and GRC
Assess cyber risk and assign treatment actions.
Limaz identifies material cyber risks, assigns decision owners, maps existing controls, and tracks treatment actions through review and closure.
Use the risk register to drive treatment
A useful cybersecurity risk assessment shows what could affect the business, which systems and processes are exposed, how existing controls change that exposure, and who must decide what happens next.
Limaz turns that analysis into treatment work with owners, target dates, control dependencies, acceptance decisions, and evidence. The result can support enterprise GRC, regulatory programs, investment planning, and assurance without becoming another static spreadsheet.
What Limaz delivers
- Scope and context
- Critical services, information assets, systems, dependencies, threat context, and risk criteria.
- Cybersecurity risk assessment
- Threat scenarios, vulnerabilities, existing controls, likelihood, impact, and residual risk.
- Risk treatment plan
- Prioritized actions, owners, target dates, dependencies, funding decisions, and acceptance paths.
- Governance model
- Decision rights, committees, escalation, reporting, exceptions, and review cadence.
- Control mapping
- One control view connected to relevant NCA, SAMA, ISO 27001, PCI DSS, and internal requirements.
- GRC workflow
- Registers, evidence links, issue tracking, and reporting implemented in your GRC tool.
- Validation
- Retest treatment actions and confirm whether risk and control status are supported by current evidence.
Risk assessment and treatment stages
Define
Agree the business scope, risk criteria, and decisions the assessment must support.
Discover
Review services, assets, architecture, dependencies, incidents, and control evidence.
Analyze
Develop plausible scenarios and evaluate inherent and residual risk.
Decide
Prioritize treatment, acceptance, transfer, or avoidance with named authority.
Implement
Move actions into governance, process, and engineering backlogs.
Review
Track exposure, evidence, exceptions, and overdue decisions over time.
What regulators expect from cyber risk management
Saudi regulators require cyber risk management as a documented, approved and working process. Every framework asks for the same core: an approved method, assessments at defined moments, named risk owners and a formal decision on every risk.
The National Cybersecurity Authority's Essential Cybersecurity Controls (NCA ECC-2:2024) cover it in subdomain 1-5. The cybersecurity department must define, document and approve a risk management methodology based on the confidentiality, integrity and availability of information and technology assets, then apply it. Risk assessments are required at least at the early stage of technology projects, before major changes to technology infrastructure, when planning to obtain third-party services, and before new technology services and products are released. The methodology is reviewed at planned intervals and whenever laws, regulations or standards change.
The Saudi Central Bank's Cyber Security Framework (SAMA CSF) sets the same expectation in subdomain 3.2.1. The process must be defined, approved, implemented and aligned with enterprise risk management. It covers risk identification, analysis, response, and monitoring and review. Risk appetite and risk tolerance must be clearly defined and formally approved, and business owners must accept and endorse assessment results.
ISO/IEC 27001:2022 makes risk the engine of the information security management system (ISMS). Clause 6.1.2 requires risk criteria, assessments that produce consistent and comparable results, and named risk owners. Clause 6.1.3 requires a treatment plan and a Statement of Applicability (SoA), with risk owners approving the plan and accepting the residual risk. Clauses 8.2 and 8.3 require assessments at planned intervals or when significant changes occur, and implementation of the treatment plan with documented results.
A risk register that drives decisions
- Risk scenario
- Written in business language as cause, event and consequence: 'A compromised vendor account reaches the core banking database and exposes customer data.' One scenario per entry.
- Affected services and assets
- The critical service, systems, data classes and third parties involved. This ties the risk to the asset inventory and the data classification.
- Risk owner
- A named executive with the authority and budget to decide. ISO 27001 clause 6.1.2 requires risk owners to be identified.
- Inherent and residual rating
- Likelihood and consequence scored against approved criteria, before and after existing controls, so the value of each control is visible.
- Existing controls and evidence
- The controls that reduce the risk today, each linked to current evidence and to its NCA ECC, SAMA CSF, ISO 27001 or PCI DSS reference.
- Treatment decision
- Mitigate, avoid, transfer or accept, with the approver, the date and the rationale recorded.
- Actions and dates
- Treatment tasks with owners, target dates and dependencies, tracked in the same system the delivery teams already use.
- Review trigger
- The next review date and the events that force an earlier one: an incident, a major change, a new vendor or a new product.
Risk assessment method
Limaz builds the method on ISO/IEC 27005:2022, the guidance that supports ISO 27001 risk management, and uses NIST Special Publication 800-30 Rev. 1 for threat and likelihood analysis.
Set criteria and appetite
Define likelihood and consequence scales, risk levels, acceptance criteria and who can accept which level of risk. The board or its delegate approves the risk appetite.
Establish context
List the critical services, the assets and data behind them, the third parties they rely on and the regulatory obligations attached to each.
Identify risk scenarios
Combine the two approaches in ISO/IEC 27005:2022: event-based scenarios for a strategic view of what could hurt the business, and asset-based analysis of threats and vulnerabilities for depth on critical systems.
Analyse
Score realistic likelihood and consequence using threat intelligence, incident history, vulnerability data and control test results, then set inherent and residual risk.
Evaluate
Compare each residual risk with the approved criteria and rank what needs treatment first.
Plan treatment
Select controls, check them against ISO 27001 Annex A, update the Statement of Applicability and obtain risk owner approval for the plan and the residual risk.
Monitor and reassess
Track actions and key risk indicators. Reassess at planned intervals and at every ECC trigger: new projects, major changes, new third parties and new products.
Treatment, acceptance and exceptions
Every risk ends in one of four decisions: mitigate it with controls, avoid it by changing or stopping the activity, transfer part of it through contracts or insurance, or accept it. SAMA CSF names the same four options and asks organisations to weigh the cost and feasibility of controls before choosing.
Acceptance is a formal decision. Under SAMA CSF, the business owner signs off, the accepted risk must sit within the approved risk appetite, and it is reported to the cyber security committee. ISO 27001 clause 6.1.3 requires risk owners to approve the treatment plan and accept the residual risk. Limaz records every acceptance with the approver, the rationale, the conditions and an expiry date.
An exception is a temporary acceptance for one control that cannot be met yet, such as a legacy system that cannot support multi-factor authentication. Each exception carries a compensating control, an owner, a remediation plan and an end date. When the end date arrives, the exception returns to the committee for a new decision, so it never turns permanent through neglect.
Reporting to the board
- Governance basis: SAMA CSF requires a cyber security governance structure endorsed by the board and a cyber security committee. NCA ECC control 1-2-3 requires a cybersecurity supervisory committee that includes the head of cybersecurity.
- Top risks against appetite: the ten highest residual risks, their trend, and whether each sits inside or outside the approved appetite.
- Decisions needed: risks above appetite that need funding, acceptance or a change in business plans, each with a clear recommendation.
- Treatment progress: actions completed, actions overdue and the owners behind them.
- Accepted risks and exceptions: what was accepted, by whom, and what expires in the next quarter.
- Key risk indicators: measures such as critical vulnerabilities past their fix date, privileged accounts without a recent review, and third parties without a current assessment.
- Regulatory position: NCA ECC compliance status, SAMA CSF maturity against target, and open audit findings.
Third-party risk
Vendors, cloud providers and managed service partners extend your attack surface, and both Saudi regulators address them directly.
NCA ECC-2:2024 subdomain 4-1 requires cybersecurity clauses in third-party contracts: non-disclosure, secure removal of the entity's data at the end of service, communication procedures for cybersecurity incidents, and an obligation to follow the entity's policies and the relevant regulations. For IT or cybersecurity outsourcing and managed services, a cybersecurity risk assessment must happen before the contract is signed, and managed security operations centres that use remote access must be fully located in Saudi Arabia.
SAMA CSF domain 3.4 covers contract and vendor management, outsourcing and cloud computing. Approved cybersecurity requirements must be addressed before a contract is signed and monitored for its full term. Material outsourcing and the use of public or hybrid cloud services need SAMA approval first. For anyone handling card data, Requirement 12.8 of the Payment Card Industry Data Security Standard (PCI DSS v4.0.1) adds service provider risk management.
Limaz tiers vendors by the data and services they touch, runs due diligence matched to each tier, writes the required clauses into contracts and schedules reassessments. Third-party risks then sit in the same register as internal ones and reach the same committee.
Common gaps in cyber risk programmes
Scores without criteria
Likelihood and impact are rated by feel, so two assessors rate the same risk differently. ISO 27001 requires consistent, comparable results.
Missing controls logged as risks
Entries such as 'no data loss prevention tool' describe a control gap instead of a business risk, so executives cannot weigh them against appetite.
Assessments skipped at trigger points
New products, cloud migrations and vendor onboarding go live without the risk assessment that ECC control 1-5-3 requires.
Acceptances that never expire
Risks accepted years ago by people who have since left, with no review date and no compensating control.
Cyber risk outside enterprise risk
Cyber risk runs in a separate spreadsheet from the enterprise risk framework, although SAMA CSF requires the two to be aligned.
Connected delivery
Compliance and assurance
Assess controls against the frameworks that apply.
Security control implementation
Move treatment actions into working technical controls.
NCA ECC & CCC implementation
Map risk and governance work to NCA ECC.
SAMA CSF implementation
Build evidence and remediation for SAMA-supervised organizations.
Questions
Yes, for regulated organisations. NCA ECC-2:2024 subdomain 1-5 requires government entities and private operators of Critical National Infrastructure to document, approve and apply a cyber risk methodology. SAMA CSF 3.2.1 requires the same of banks, insurers, financing companies, credit bureaus and financial market infrastructure. ISO 27001 clause 6.1.2 makes risk assessment mandatory for certification, and PCI DSS v4.0.1 Requirement 12.3.1 requires documented targeted risk analyses.
Run a full assessment cycle at planned intervals, and Limaz recommends at least once a year. Reassess on events too. NCA ECC control 1-5-3 requires assessments at the early stage of technology projects, before major infrastructure changes, when planning third-party services and before releasing new services or products. ISO 27001 clause 8.2 adds significant changes. PCI DSS requires each targeted risk analysis to be reviewed at least once every 12 months.
Inherent risk is the exposure before existing controls are counted. Residual risk is what remains after them. The gap between the two shows what each control is worth. Regulators focus on residual risk: ISO 27001 requires risk owners to accept it formally, and SAMA CSF requires any accepted residual risk to sit within the approved risk appetite and be reported to the cyber security committee.
The business executive accountable for the affected service owns the risk. The CISO and the cybersecurity team run the method, analyse the risk and advise, while the owner decides on treatment and acceptance. SAMA CSF requires business owner sign-off on accepted risks and reporting to the cyber security committee. ISO 27001 requires risk owners to approve the treatment plan and accept the residual risk.
Neither regulator prescribes a named method. NCA ECC control 1-5-1 requires each entity to define, document and approve its own methodology based on the confidentiality, integrity and availability of its assets. SAMA CSF requires a defined and approved process aligned with enterprise risk management. ISO/IEC 27005:2022 and NIST SP 800-30 Rev. 1 give a sound foundation for both when the method is documented and applied consistently.
ISO/IEC 27005:2022 is guidance for managing information security risk inside an ISO 27001 ISMS. It covers context, identification, analysis, evaluation and treatment, and offers event-based and asset-based approaches. NIST SP 800-30 Rev. 1 focuses on conducting risk assessments, with detailed guidance on threat sources, vulnerabilities, likelihood and impact. Limaz uses ISO 27005 for the process and NIST SP 800-30 for analytical depth.
Each entry needs a risk scenario in business terms, the affected services and assets, a named risk owner, inherent and residual ratings against approved criteria, existing controls with evidence, the treatment decision, actions with dates, and a review date. Linking each risk to its NCA ECC, SAMA CSF, ISO 27001 or PCI DSS references lets one register serve audits, regulators and board reporting.
Discuss your requirements with Limaz
Tell us which system, control, or requirement you are working on. We’ll come back with a clear next step.