Industry

Government and public sector

Secure citizen services, identity, procurement, and legacy modernisation for government entities and public enterprises. Accessibility, transparency, and continuity documentation are prepared to withstand oversight, budget review, and audit.

Shaded arcade of pointed stone arches in a heritage Gulf building

How we run public sector programmes

We embed delivery leads who understand budget cycles, security approval timelines, and continuity requirements, not just agile ceremonies. Programmes rest on shared control documentation, named authority contacts, and well-rehearsed cutovers, so citizen-facing services stay available through funding and leadership changes. In Saudi Arabia that means working to Digital Government Authority (DGA) standards, the NCA Essential Cybersecurity Controls (ECC), and the Personal Data Protection Law (PDPL), with tenders through Etimad and citizen sign-in through Nafath; in the UAE, to TDRA guidance and UAE PASS digital identity.

Restored mud-brick Najdi heritage walls with triangular crenellations in Riyadh

Phased offerings from assessment to operations

Structured phases with artefacts that procurement, security, and programme offices can reuse across re-tenders and oversight cycles.

  • Assessment

    A map of legacy dependencies, identity posture, and citizen journey pain points, with a prioritised remediation backlog.

  • Strategy and planning

    Investment cases, migration sequencing, and risk registers aligned to budget approvals and security approval gates.

  • Governance and design

    Control mapping, accessibility criteria, and architecture decisions recorded for continuity and audit.

  • Build, migration, and cutover

    Test packs, parallel operations, and rollback criteria signed off before traffic moves for critical services.

Expert-led

Architecture and compliance reviews

Agreed

Incident response times, set in the statement of work

Middle East

Delivery aligned to local regulation

Programmes in government and public sector succeed when product, risk, and operations work from a shared understanding. We embed bilingual leads who connect engineering backlogs with supervisory expectations. Regulated programmes often map security evidence to baselines such as ISO/IEC 27001 alongside sector-specific obligations.

Our accelerators include industry data models, integration blueprints, and test packs, always customised to your vendors and geography.

From first workshop to production cutover, we align success metrics with the regulatory and commercial outcomes your board cares about, not only technical milestones on a Gantt chart.

When regulators or internal audit ask for evidence, we help you point to configuration, tickets, and test results instead of narrative-only decks, so remediation stays proportional and traceable.

Public sector IT modernisation, citizen services, and accessibility

Public sector technology modernisation must satisfy accessibility standards, public procurement rules, and operational continuity expectations while modernising sprawling legacy estates. Hosn Al Tomoh delivers citizen service portals, digital identity credentialing programmes, and shared services architectures with documentation that satisfies oversight committees throughout delivery. That alignment between technical work and governance expectations is what allows programmes to sustain funding across political transitions and oversight rotations that inevitably occur during multi-year modernisation efforts.

E-government platform migration, sovereign cloud deployment, and grants management modernisation each carry jurisdiction-specific considerations. Hosn Al Tomoh adapts reference patterns to your legislative framework, oversight model, and procurement vehicle rather than applying generic templates. That adaptation matters because public sector delivery varies across regions and levels of government. Programmes that ignore local context meet resistance when vendor assumptions seem to override familiar procedures or published guidance. In Saudi Arabia, for example, delivery is aligned with Digital Government Authority (DGA) standards, the NCA Essential Cybersecurity Controls (ECC), and the Personal Data Protection Law (PDPL), with government tenders running through Etimad. In the UAE, it is aligned with Telecommunications and Digital Government Regulatory Authority (TDRA) guidance and the priorities of We the UAE 2031.

Change management in public sector modernisation engages both civil servants whose work changes and citizens whose services depend on new platforms. Hosn Al Tomoh plans communication, training, and support for both groups because skipping either tends to produce disappointment at launch. Frontline workers need confidence in new tools before citizens rely on them, and citizens need clear guidance when interacting with updated services. That dual engagement is what produces modernisation that actually improves service delivery rather than simply replacing underlying technology.

Data residency, lawful access, and vendor exit strategies are foundational architectural concerns for public sector cloud adoption. Hosn Al Tomoh designs these elements into landing zones from the start rather than as follow-on projects. Exit plans include tested procedures for moving workloads between providers or back on-premises if commercial or policy circumstances require. That preparedness protects public institutions from long-term dependency on commercial terms that might shift in ways inconsistent with governmental sovereignty and fiduciary duties.

Digital identity for citizens requires balance between security, privacy, and accessibility. Hosn Al Tomoh implements identity systems that respect enrolment and verification requirements while handling assisted digital support and non-digital alternatives. Representatives and carers often need delegated access, and offline channels remain essential for citizens who cannot or prefer not to transact online. That comprehensive design ensures digital services do not inadvertently exclude citizens whose circumstances differ from the typical internet user profile. In the Gulf, citizens usually sign in through national digital identity services such as Nafath (the National Single Sign-On) in Saudi Arabia and UAE PASS in the UAE, so identity designs start from those services.

Benefits administration, grants distribution, and emergency response platforms share the requirement for operational reliability with dignified user experience. Hosn Al Tomoh implements these systems with clear service level commitments, transparent status reporting, and accessible design so citizens accessing public support receive it efficiently. Administrative workflows, case management, and appeals processes integrate with the frontend so staff and citizens operate in coordinated rather than parallel systems across the life of each case or application.

Government and public sector: common questions

Agency CIOs, programme directors, and procurement teams.

Public sector delivery phases

Discovery through steady operations with citizen impact in view.

  1. Policy and journey discovery

    Services, eligibility rules, and channel preferences are mapped with equity and accessibility notes.

  2. Alpha and beta with users

    Feedback loops include civil servants and citizens before mandatory cutovers.

  3. Hardened production

    Security monitoring, DR drills, and support rosters meet continuity requirements.

  4. Continuous improvement

    Continuous improvements to service design, informed by analytics, follow the change procedures agreed in your contract.

Modernisation spans web, cloud, data, security, and governed departmental platforms.

  • Digital Governance

    Departmental software, EA registers, GRC, and records with procurement-ready evidence.

    Digital Governance
  • Cloud and DevOps

    Sovereign and hybrid patterns for sensitive workloads.

    Cloud and DevOps
  • Data and AI

    Open data and analytics with governance suitable for agencies.

    Data and AI
  • Management consulting

    Operating model and change management for large-scale public programmes.

    Management consulting

Plan your first phase with us

We run a joint session with your business sponsors and control teams to order the backlog, then set out dependencies, compliance checkpoints, and the smallest release that proves value, with an owner and a date for each item your steering committee can track.

Meet an industry principal