Control frameworks
- NCA Essential Cybersecurity Controls
- ISO/IEC 27001
- PDPL and PCI-DSS considerations
Governance, Risk & Compliance
Build a practical cybersecurity governance programme, understand obligations and make risk visible to decision-makers.
Last reviewed:
What is this service?
Cybersecurity governance, risk and compliance connects security decisions with business responsibilities and applicable obligations. A control framework is a reference, not proof that a control operates. JODOR examines how policies, ownership, risk decisions and supporting evidence fit together. The aim is a programme your management can explain, maintain and challenge, rather than a folder of policies that nobody uses.
Who needs it?
This service suits management teams preparing for a regulatory review, organisations building their first governance programme and established businesses with fragmented control ownership. We first confirm the legal entity, sector and obligations; a financial institution, cloud provider and private commercial company should not automatically receive the same compliance scope.
JODOR perspective
Compliance is not enough
Written policies are a starting point. See why practical controls, tested systems and clear evidence matter.
In Arabic, with English and Arabic captionsRead the transcript
You have written policies and a clean audit report. But if someone tried to break in today, would your systems really be secure? Compliance says the controls are in place… but on paper. Cybersecurity means they work when you need them. At JODOR, we start with real risks in your day-to-day work, then connect them to controls and regulations. We test your systems the way an attacker would, then test again after remediation, to make sure the vulnerabilities have really been closed. You become compliant and secure—not one at the expense of the other. JODOR. Cybersecurity.
TECHNOLOGY ALLIANCES
Technologies we deploy for this service
What we cover
Scope options
Governance
- Cybersecurity policies
- Operating procedures
- Governance frameworks
Risk oversight
- Enterprise risk register
- Third-party risk assessment
- Board reporting
How we deliver
Delivery starts with an agreed scope, named asset owners, access permissions, evidence requirements and a communication plan. For this service, the discussion includes NCA Essential Cybersecurity Controls, ISO/IEC 27001, PDPL and PCI-DSS considerations, Cybersecurity policies. Observations are connected to their source and business context, and assumptions are checked with the relevant owners. Work outside the agreement is raised explicitly rather than silently added. Review points and escalation arrangements help your team understand what has been completed, what remains uncertain and which actions depend on information or authorisation from you.
01
Scope
Confirm business context, applicable controls, stakeholders and the evidence required.02
Assess
Review policies, processes and control evidence against the agreed scope.03
Report
Present gaps, risk priorities and practical remediation actions.04
Assure
Validate agreed actions and provide an updated view of control status.Deliverables
Deliverables connect the findings to the agreed business objective rather than simply export tool output. Recommendations identify rationale, relative priority, proposed ownership and dependencies on other teams or technologies. We distinguish verified observations from items requiring further evidence, and explain limitations that affect confidence. Sensitive material is handled under the agreed arrangements. A readout gives your team an opportunity to challenge conclusions and clarify next steps. Implementation, retesting and continued oversight are included only where the proposal explicitly defines them.
- Control and evidence review
- Prioritised gap register
- Cybersecurity risk register
- Remediation roadmap and management report
Timeline
Timing is agreed after scoping and checking evidence readiness, system access and stakeholder availability. A bounded assessment may take several weeks; implementation or ongoing support needs a separate phased plan. The proposal identifies assumptions, dependencies and review points. Changes to assets, permissions or access can change the schedule. An indicative duration is not a universal delivery promise or a substitute for confirming your actual environment.
Frequently asked questions
Is a gap assessment the same as a compliance certification?
No. A gap assessment compares an agreed scope and available evidence against selected requirements. It identifies missing or weak controls and proposes actions, but does not issue regulatory approval or certification. Management remains responsible for implementation and any required submission. Where an independent audit or accredited certification is needed, its scope and decision process must be arranged separately.
What should we prepare before the engagement?
Prepare asset and service ownership details, relevant policies, available records and an approved way to share evidence. We discuss NCA Essential Cybersecurity Controls, ISO/IEC 27001, PDPL and PCI-DSS considerations, Cybersecurity policies. Access must be authorised before any intrusive or privileged activity begins. Missing information is recorded as a limitation and prioritised with your team, rather than automatically interpreted as proof that a control either exists or has failed.
How does the team turn findings into practical actions?
Findings should connect the observation, relevant risk and required control to a proposed owner and verifiable outcome. Management resolves competing priorities and decides whether to treat or accept risk within its authority. Closing a ticket alone does not prove that an issue has been removed. We explain suitable verification, with retesting or continued tracking included only when explicitly agreed in scope.
How long does delivery take, and is the schedule guaranteed?
Timing is agreed after scoping and checking evidence readiness, system access and stakeholder availability. A bounded assessment may take several weeks; implementation or ongoing support needs a separate phased plan. The proposal identifies assumptions, dependencies and review points. Changes to assets, permissions or access can change the schedule. An indicative duration is not a universal delivery promise or a substitute for confirming your actual environment.
Does this service guarantee compliance or prevent every incident?
No. The service supports assessment, improvement and evidence within an agreed scope; it cannot prevent every incident or confer regulatory approval. Applicable obligations depend on your activities, supervising authority and the requirements in force. Management retains responsibility for implementation, risk decisions and any formal submission. We describe what was and was not assessed so that a scoped finding is not mistaken for an organisation-wide guarantee.
Related services
Explore SAMA regulatory compliance guidance for this service
Request a proposal
Fill out the form and we'll get back to you soon
We reply within one business day.