GRC for Omani regulated firms
GRC,simplified.
One GRC platform for banks, finance and leasing companies, insurers and capital market firms regulated by the Central Bank of Oman and the Financial Services Authority.
Start where you are
Which of these is you?
Sastrum reads differently depending on your job. Pick yours and we will skip what does not apply.
- CEO, CFO, CRO or CISOI answer for risk and complianceThe board and the regulator ask questions the spreadsheet cannot answer.
- Head of IT, IT risk or securityI will run the systemControls, evidence and policies live in tools that do not talk to each other.
- Procurement, vendor management or complianceI am assessing vendorsClearing a cloud vendor means an outsourcing assessment and a security pack.
- PartnersI am a consultancy or integratorPartner with us: regulator packs make implementation configuration, not a build.
Who it is for
Same regulations. Smaller teams. Smaller budgets.
- Banks
- Finance and leasing companies
- Insurance companies and brokers
- Capital market firms
- The CBO's Cyber Security & Resilience Framework sets minimum controls across six domains, from governance to third-party supply chain, that licensed firms must evidence.
- The Personal Data Protection Law has been enforceable since the executive regulation's grace period ended in January 2025, with breach notice to MTCIT within 72 hours.
- The Banking Law of 2025 gives the CBO wider powers, including fines up to OMR 200,000 for banks, and firms answer to the FSA for insurance and capital market business at the same time.
Same CBO framework. Same PDPL deadlines. Same penalties.
A fraction of the team and budget.
Our aim Affordable, easy-to-use, enterprise-grade GRC for every small and mid-size firm.
Industry content packs
Packs for the industries we serve in Oman.
A pack is the regulations, controls, risks, policies and audit tests for one industry, mapped before you start. Banking and finance ships today; the rest follow.
- Coming
Banking and finance
Banks, finance and leasing companies, insurers, capital market firms
Maps to CBO CS&RF, Banking Law 2025, PDPL, FSA regulations
- Coming
IT and ITES
Software, cloud and managed service providers
Maps to PDPL, ISO 27001, SOC 2
- Coming
Telecom
TRA licensees and network providers
Maps to Telecommunications Act, PDPL, ISO 27001
- Coming
Manufacturing
Industrial and process plants
Maps to ISO 27001, IEC 62443, PDPL
- Coming
Energy and utilities
Oil and gas, power and water operators
Maps to ISO 27001, IEC 62443, PDPL
Why this matters now
GRC failures now cost real money, not just audit points.
- USD 8m
average cost of a data breach in the Middle East, 2026; USD 10.67m in financial services
IBM Cost of a Data Breach, 2026 (opens in a new tab) - OMR 500,000
maximum fine under the PDPL, for unlawful cross-border transfer of personal data
PDPL, via CMS (opens in a new tab) - OMR 200,000
maximum administrative fine the CBO can impose on a bank under the Banking Law of 2025
Banking Law, via Al Tamimi (opens in a new tab) - 72 hours
to notify MTCIT of a personal data breach under the PDPL executive regulation
Executive Regulation 34/2024, via Trowers & Hamlins (opens in a new tab)
Omani and regional figures, each linked to its source.
What makes it different
Same breadth as the global suites. Built for smaller firms.
One control library that every framework maps to, with six things the global suites do not give a smaller firm.
Your regulator, already inside.
The CBO Cyber Security & Resilience Framework, the PDPL and the Banking Law are mapped as content packs, alongside ISO 27001, NIST CSF and PCI DSS in the product.
See the frameworksLive in minutes.
Describe your organisation. Sastrum scopes your risk universe, suggests your controls and drafts your first policies, the same day.
See risk scopingAI a regulator can audit.
Lumina suggests and drafts, and shows the clauses it relied on. A named person approves every decision, and every AI action is logged.
Lumina drafts. People sign.
How Lumina worksOne record, separate lanes.
Risk, compliance and audit share the same controls and evidence. Each keeps its own data and approvals. The board sees one view across three lines of defence.
Explore the platformOne licence.
Governance, compliance, audit and incidents under one licence. In our cloud, your private cloud or on your premises, with the same features.
Security and deploymentPlatform plus people.
With the product come our services: virtual CISO, managed GRC and security testing.
Talk to us
Our experience, built into the product
20years of GRC advisory and regulatory audits
We did not start from a blank page. Every lesson from those years has gone into the product, so you buy the learning with the software.
- GRC advisory
- Regulatory audits
- Learning, built in
Built with a national bank against 300 tendered requirements.
What we are working on now
This is just the start.
Board
Board-level risk simulation
Coming soon
Chief Risk Officer
Risk quantification and predictive risk
Coming soon
Chief Compliance Officer
Continuous compliance and regulation-change impact simulation
Coming soon · Q4 2026
CISO
Continuous control monitoring and quantum computing impact simulation
Coming soon
Chief Internal Auditor
Automatic work papers
Coming soon
Data Protection Officer
Continuous data protection
Coming soon
Build the next chapter with us.
See Sastrum run on your own regulators, help shape it for your sector, or join as a founding customer.
See it running
Thirty minutes, opened on a risk universe already scoped to your sector and regulators.
Partners
Design partners shape the content for their sector or country. Consultants, integrators and regulatory experts take Sastrum to each launch market.
Founding customers
Founding-customer terms and a seat on our product council.
Born in India. Built for the world.