Middle East

Compliance automation for banks and critical infrastructure in the Gulf

Regulators in the Gulf publish some of the most specific cybersecurity frameworks in the world: the Saudi Central Bank’s Cyber Security Framework, the National Cybersecurity Authority’s Essential Cybersecurity Controls, and the Central Bank of the UAE’s information assurance requirements. DECIMA reads the controls they name from the systems that operate them, evaluates each one against the published requirement, and keeps a dated record a SAMA or NCA assessor can re-verify.

Built for institutions that answer to more than one Gulf regulator at once, in Arabic and English.

Mandates we cover in the Middle East

One evidence set, evaluated against each regulator’s rule set instead of assembled separately for each inspection.

• SAMA Cyber Security Framework

  Continuous evidence for the four domains of the Saudi Central Bank framework, with maturity tracked per control and the annual self-assessment produced from a year of dated reads.

  Open the framework page

• NCA Essential Cybersecurity Controls

  Every ECC control mapped to the system that operates it, so the compliance assessment reflects the environment as it runs rather than as it was documented.

  Open the framework page

• CBUAE information assurance requirements

  Control evidence for licensed financial institutions in the UAE, structured the way the Central Bank’s supervisory reviews request it.

• PCI DSS v4.0

  Cardholder-environment evidence collected while payments run, ready for the QSA and the acquiring bank’s attestation.

  Open the framework page

• SWIFT Customer Security Programme

  CSCF mandatory controls evidenced continuously for banks and payment institutions on the SWIFT network across the Gulf.

  Open the framework page

Why institutions in the Gulf choose DeshCyber

• Several regulators, one record

  A bank in Riyadh answers to SAMA, the NCA and its card schemes. DECIMA evaluates one evidence set against each rule set, so a control is proven once and reported to everyone who requires it.

• Arabic and English

  Consoles, reports and this site in both languages, so the record reads the same to the board, the regulator and the assessor.

• Proof the assessor can re-run

  Each verdict carries the raw observation, its timestamp and the published rule version, so a SAMA or NCA assessment receives evidence rather than assertions.

How we serve the Gulf

Engagements in the Middle East are run from New York with engineering in Dhaka, in Gulf working hours. Reach either office directly.

04

Questions from institutions in the Gulf

Short answers you can quote.