Yes. Most frameworks overlap heavily, so each control is written once and mapped to every requirement it meets.
Jeddah Services
Best GRC and compliance advisory company in Jeddah
One control library mapped to every framework you report against, with evidence collected as you go. Hosn Al Tomoh works with organisations in Jeddah on governance, risk and compliance, agreeing scope, responsibilities and proof of completion for each phase from the start.
GRC work turns laws and standards into controls people can run: policies, owners, tests and the evidence that each control works. It also covers third-party risk, because many findings now come from suppliers.
Saudi programmes usually have to account for the Essential Cybersecurity Controls of the National Cybersecurity Authority (NCA), the Personal Data Protection Law overseen by SDAIA and, for government entities, the standards of the Digital Government Authority. Banks answer to SAMA, and insurers to the Insurance Authority. We plan hosting, data classification and evidence around these from the start, and quote in Saudi riyals.
Work runs in short phases you can review. We strengthen your team with specialist people where you need them, and each phase closes with a demonstration and a decision on what comes next.
Where you already work with systems integrators or vendors, we can deliver in partnership with them, with each party's responsibilities written into the contract.
What has to go right
These are the factors that usually decide whether the programme meets its goals.
- One control library mapped to every framework you report against.
- Control owners and test schedules agreed with internal audit.
- Third-party risk tiers that set how deeply each supplier is assessed.
What we check first
Compliance becomes expensive when evidence is gathered by hand before every audit. We map overlapping requirements once, such as national cyber security controls, data protection law and ISO/IEC 27001, and automate evidence where systems allow.
At the end of each phase we provide the proof your risk and audit teams need to file: test results, access reviews and signed handover documents.
Before you start
Practical questions from IT and procurement teams.
Each phase is scoped and priced separately, with the team, the deliverables and the acceptance criteria written down, and you receive an itemised quote before work starts.
Your team, unless you choose managed services. We name who is responsible for each component before launch, hand over the runbooks and train your people.
How the work runs
Four stages, each with clear criteria for moving to the next.
Discover
We document the current set-up, the people involved and the constraints, and agree what success looks like.
Design and plan
We set the target design, phases, test approach and acceptance criteria, and review them with your architects and risk team.
Build and test in stages
We deliver in increments, testing and demonstrating each one before the next begins.
Hand over
We hand over runbooks, train your team and support the launch, then formally transfer responsibility to the people you nominate.
Ready to mature your operations?
Book a technical consultation with our principal engineers to map out your architecture and transition plan.