For procurement, vendor management and compliance · Oman
You have to clear us before anyone can buy us.
Sastrum is built to pass an Omani regulated firm's outsourcing assessment: deployment your way, a security pack on request, and a contract written for regulated firms.
Your situation
A cloud vendor is an outsourcing decision, and the regulator will ask to see it.
Problems
- The CBO framework's third-party supply chain domain and the PDPL's rules on cross-border transfer make a cloud vendor a documented decision.
- Most vendors answer the security questionnaire slowly, partially, or with marketing.
- Data residency, access and exit terms get settled late, after the business has already chosen.
Needs
- Clear hosting options and regions, stated once and not changed in the sales cycle.
- A security pack that answers the questionnaire: data handling, access, continuity, testing, what is certified and what is not.
- A price model with no surprises, and a contract that fits the outsourcing policy.
Desires
- Clear a vendor in weeks, not months, with the documents already in hand.
- One contact who answers the same day.
What you would love
- A vendor who sends the due-diligence answers before you ask for them.
- An exit plan written into the contract from the start.
Three things that are different
Built to be assessed, not just bought.
- 01
Deployment your way.
SaaS, private cloud in your own account, or on-premise, the same product in each case. Hosting in or near Oman is stated in the contract, and the on-premise option keeps everything, including the AI models, in your data centre.
- 02
A security pack on request.
Data handling, hosting, access control, business continuity, a penetration test summary, and the certifications SecurEyes holds. Nothing is claimed that the pack cannot show.
- 03
A vendor you can assess.
SecurEyes, which serves Oman from its Saudi and Indian offices, is a cyber security consultancy of twenty years that stands behind the product and the contract, and answers your due-diligence questionnaire itself.
Coverage for Oman
The standards your assessment will check against.
The frameworks your own firm answers to are mapped in the product, which is also what your assessment of us will measure.
Your regulators
Frameworks for you
- CBO Cyber Security & Resilience Framework
- Personal Data Protection Law (Royal Decree 6/2022)
- Banking Law (Royal Decree 2/2025)
- FSA capital market and insurance regulations
- ISO/IEC 27001
- NIST CSF
- PCI-DSS
Your industry pack
Banking and financeComing
Banks, finance and leasing companies, insurers, capital market firms
CBO CS&RF, Banking Law 2025, PDPL, FSA regulations
Why this matters now
The obligations are dated and the penalties are public.
Omani figures, each linked to its source.
USD 8m
average cost of a data breach in the Middle East, 2026; USD 10.67m in financial services
OMR 500,000
maximum fine under the PDPL, for unlawful cross-border transfer of personal data
OMR 200,000
maximum administrative fine the CBO can impose on a bank under the Banking Law of 2025
72 hours
to notify MTCIT of a personal data breach under the PDPL executive regulation
Start the assessment with the pack in hand.
Tell us which questionnaire you use and we will answer it, with the hosting options and a draft contract.