Cybersecurity controls
Introduction
Advising on the cybersecurity controls that apply to a business, and on the legal side of governance, contracts and incident response.
The National Cybersecurity Authority sets the main framework, including the Essential Cybersecurity Controls and specific controls for critical systems, cloud services and data. They bind government entities and operators of critical national infrastructure, and increasingly reach their suppliers through contract terms. Banks and finance companies also follow the Saudi Central Bank's cybersecurity framework.
Cybersecurity is a board matter as well as a technical one. We help companies identify which controls apply, build governance and policies around them, and make sure supplier contracts, cloud agreements and outsourcing terms carry the obligations regulators expect.
When an incident happens, legal decisions come quickly: notifying regulators and affected people, preserving evidence, dealing with attackers' demands, and handling claims from customers and partners. We prepare response plans in advance and advise during the incident.
How we help
What the work covers
Applicability
Identifying which national and sector controls apply to the business.
Governance
Board oversight, policies and responsibilities for cybersecurity.
Supply chain
Cybersecurity terms in supplier, cloud and outsourcing contracts.
Incidents
Response plans, notifications, evidence and claims after an incident.
Contact