SERVICE 02
Cybersecurity & Compliance
Cybersecurity & Compliance
Controls readiness, data protection and audit — stated precisely, promising nothing that is not granted.
What this pillar is
Compliance in the Kingdom is not a badge to hang. The Essential Cybersecurity Controls are self-assessed and reported by the regulated entity itself, and the Personal Data Protection Law imposes continuous operational obligations rather than a one-off document. Our role is readiness: assessing the gap, building the evidence, and tying controls to auditable daily practice.
What this pillar covers
Essential Cybersecurity Controls readiness
Gap assessment against the controls, a remediation plan, and the evidence the entity needs at assessment time.
Data protection and PDPL compliance
Records of processing, the privacy policy, data-subject request workflows, and the breach-notification path.
Data classification and governance
Discovering data sources, classifying personal and sensitive fields, and linking them to processing purposes.
Audit and advisory
Periodic reviews, assessment of external processors, and documented results as presentable evidence.
Frequently asked
- Do you issue an Essential Controls compliance certificate?
- No, and nobody does. Compliance with the Essential Controls is self-assessed and reported by the regulated entity through official channels. What we provide is readiness, assessment and evidence-building services.
- How does this relate to the THIQ product?
- THIQ is the tool that turns the data-protection obligations into documented daily operations. The advisory service builds the content the tool then manages: the register, the policies and the request workflows.
We start by understanding your environment — not with a deck
One session with an engineer from the team that would run the service: we read what you have as it is, and say what can be delivered and when — and what cannot.