Insights

Expert guides for regulated organisations in Saudi Arabia.

Plain-English guidance on NCA ECC-2:2024, the SAMA framework, the PDPL, Microsoft 365 governance, third-party risk and audit readiness.

How we write these guides

Sourced, dated and written by a named expert

Each guide cites the regulator’s own text or another primary source, states when it was last reviewed, and is written under the name of a Cre8 IT specialist rather than a faceless team.

They describe what regulators expect and how firms can meet it. They are not legal advice, and where the rules are a matter of judgement we say so.

What every guide includes

A short answer you can act on straight away
Links to the regulator’s own rules
A review date, so you know how current it is
Answers to the questions people actually ask
A named author and how to reach us

All guides

Topics regulated firms ask us about

NCA ECC

NCA Essential Cybersecurity Controls (ECC-2:2024): what Saudi organisations need to evidence

A plain-English guide to the NCA’s ECC-2:2024: who it applies to, its four domains, what changed from ECC-1:2018 and the IT evidence to keep.

6 min read · Reviewed 20 September 2026

SAMA

SAMA Cyber Security Framework: what Saudi financial institutions need to evidence

Who the SAMA Cyber Security Framework applies to, its four domains, the maturity level SAMA expects and the IT evidence a member organisation keeps.

3 min read · Reviewed 20 September 2026

PDPL

Saudi PDPL: an IT checklist for the Personal Data Protection Law

What the Saudi PDPL means for IT: enforced since September 2024, the 72-hour breach notice to SDAIA, the penalties and the technical measures needed.

4 min read · Reviewed 20 September 2026

Cloud and Microsoft 365

Microsoft 365 and cloud governance for Saudi organisations

What the NCA’s cloud controls say, where data localisation now sits, what Microsoft has announced for Saudi Arabia and the Microsoft 365 settings to keep.

3 min read · Reviewed 20 September 2026

Third-party risk

Choosing and overseeing an IT provider in Saudi Arabia: third-party risk

What NCA ECC and the SAMA framework expect of your IT provider contracts, the in-Kingdom rule for remote monitoring centres and the questions to ask.

3 min read · Reviewed 20 September 2026

Audit readiness

Audit readiness for NCA and SAMA reviews: the IT evidence checklist

How the NCA assesses ECC compliance, what control 1-8 requires, the evidence pack to build and how ISO 27001:2022 fits alongside.

3 min read · Reviewed 20 September 2026

Talk to a specialist about your obligations

Tell us about your firm and your regulator, and we will suggest a practical first step, whether that is a gap assessment or ongoing support.