Cybersecurity & Digital Resilience

Scope before control mapping

Cybersecurity analysis begins with scope. The entity, sector, system, information, service, supplier relationship and event determine which Saudi instrument or contractual requirement may apply. NCA’s Essential Cybersecurity Controls ECC-2:2024 and Cloud Cybersecurity Controls CCC-2:2024 are distinct official control sets; neither should be described as universally binding without the applicability analysis.

Sector regulators may add a separate layer. CST, for example, publishes a Cybersecurity Regulatory Framework for ICT service providers directed to organisations within its stated regulatory scope. We keep direct regulatory obligations, customer requirements and contractual flow-downs separate in the advice.

Governance, suppliers and resilience

The legal work connects authority, evidence and accountability. Governance should identify the risk owner, security decision-makers, exception process, supplier responsibilities, escalation routes and the evidence that management needs to assess performance.

Supplier and cloud contracts should allocate security measures, assurance, access, change, vulnerability handling, incident cooperation, notices, audit material, continuity, remediation, liability and exit. A certification or generic compliance warranty does not by itself prove that the contracted configuration meets the applicable requirement.

Digital resilience extends beyond containment. Recovery priorities, minimum service, alternative arrangements, communication authority, regulatory cooperation, evidence preservation and transition need to be agreed before the event.

Incident response and dispute readiness

During an incident, legal and technical work run together. We establish a verified chronology, preserve the decision record, identify affected services and data, map regulatory and contractual notification routes, control external communications and protect the evidence required for investigation, insurance, claims and later remediation.

No universal notification deadline is stated without checking the current instrument and the facts. A single event may engage privacy, cybersecurity, communications, sector, contract and evidence rules, but each conclusion must stand on its own source.

Our work

We advise on cybersecurity-instrument applicability, governance and accountability, supplier and cloud risk, security clauses and assurance, control-remediation programmes, digital resilience and continuity, incident playbooks, live incident coordination, notification analysis, evidence preservation, post-incident remediation and dispute readiness.