The regional regulatory stack, covered locally. ISONEX delivers the GCC's own cybersecurity and data-protection frameworks — the regimes global compliance firms barely address — from offices in Manama, Dubai, and Riyadh.
Beyond the international standards, the GCC has built its own binding frameworks — and meeting them is non-negotiable for regulated entities in the region. ISONEX delivers across the full regional stack.
In Saudi Arabia, that means the NCA Essential Cybersecurity Controls (ECC) mandated by the National Cybersecurity Authority, the SAMA Cyber Security Framework for entities regulated by the Saudi Central Bank, and the Saudi Personal Data Protection Law (PDPL).
Across the wider region we cover the Bahrain PDPL, and UAE frameworks including ADHICS for Abu Dhabi healthcare, DESC for Dubai government suppliers, and the UAE Information Assurance standards. This regional depth — in-region, and where needed in Arabic — is where ISONEX is strongest.
Organisations bound by NCA ECC or SAMA requirements.
International firms expanding into the region that must meet local mandates.
Businesses subject to Saudi, Bahrain, or UAE data-protection law.
Delivered directly by ISONEX from our regional offices. We know these frameworks, the regulators behind them, and how they map onto international standards like ISO 27001 — so you can satisfy a local mandate and a global certification from a single programme.
We define the boundary of your programme — systems, locations, and teams in scope — and agree the timeline and responsibilities up front, so there are no surprises later.
A structured assessment of your current posture against every requirement, producing a prioritised remediation plan with realistic effort estimates.
We write the policies, procedures, and controls, and work alongside your engineering team on a weekly cadence to implement them — not a stack of templates left for you to figure out.
The management system runs and generates evidence. We drive the internal audit and management review so the programme is demonstrably working before any external scrutiny.
We prepare the evidence package and sit alongside you through assessment, answering the assessor's questions directly rather than leaving you to defend the work alone.
If you sell software or services to banks, healthcare providers, government bodies or other regulated entities in the Gulf, their regulators expect those obligations to reach you as a supplier. Overseas providers usually meet them through contract terms, security questionnaires and audit rights, even when the regulation does not apply to them directly.
What typically comes up. Saudi customers may ask about the NCA Essential Cybersecurity Controls or SAMA requirements, data-protection questions under the Saudi PDPL and the Bahrain PDPL, and in the UAE frameworks such as ADHICS for healthcare or DESC for Dubai government suppliers. Which of them apply depends on the customer and the service.
Where ISONEX helps. ISONEX is based in Manama and delivers these regional frameworks alongside international standards, in English and, where needed, Arabic. We map the regional requirements to ISO 27001 and SOC 2, so evidence collected once serves more than one customer. See our ISO 27001 page and Custom Frameworks service.
Remote-first delivery. ISONEX works remotely with clients across the GCC, UK, EU and US, with calls scheduled around your working hours. This page is general information, not legal advice. Book a free advisory session.
It depends on your sector and regulator. NCA ECC applies broadly to organisations operating critical or sensitive systems; SAMA's framework applies to entities regulated by the Saudi Central Bank; and the PDPL governs personal data. We map your obligations precisely at the outset.
Yes — and that's usually the smart move. The GCC frameworks overlap substantially with ISO 27001, so a single well-designed programme can satisfy a local regulatory mandate and earn an international certificate at the same time.
Not always directly. It depends on whether you serve regulated entities in Saudi Arabia and what services you provide. In practice, the requirements reach suppliers through customer contracts and due diligence.
Our site lists the Saudi NCA ECC, the SAMA Cyber Security Framework, the Saudi PDPL, the Bahrain PDPL, and UAE frameworks including ADHICS, DESC and the UAE Information Assurance standards.
Yes. Mapping is a core part of the work, so overlapping controls and evidence are reused across frameworks.
Yes. ISONEX is a remote-first consultancy based in Manama and we work with clients in the UK, the EU, the US and the GCC.
Book a free advisory session and we'll map your fastest credible route to compliance.
Book a free advisory session