For heads of IT, IT risk and security · Oman
You will run it. You do not want to build it.
Sastrum runs as SaaS, in your own cloud account or in your data centre, with the AI model you choose, roles and approval chains you configure in the browser, and a record that answers the CBO Cyber Security & Resilience Framework questions without a project.
Your situation
Every GRC tool promises integration. You end up owning the glue.
Problems
- Controls, evidence and policies sit in tools that do not talk to each other, and you are the one asked to reconcile them.
- the CBO Cyber Security & Resilience Framework wants evidence that is current; what you have is a folder from the last audit.
- The PDPL gives 72 hours to notify MTCIT of a breach, and the CBO framework expects incident handling to be evidenced.
Needs
- A deployment choice that fits the policy: SaaS, your own cloud account, or on-premise, the same product in each case.
- Roles, separation of duties and approval chains you configure yourself, without a change request to the vendor.
- A way to load what you already have: registers, controls and incidents, by file, not by re-keying.
Desires
- An AI assistant that drafts controls and policies but never publishes without a named approver.
- An audit trail you can hand to the auditor as it is, filtered by module, actor and date.
What you would love
- A system the business runs itself, where you are consulted and not paged.
- Sensitive work routed to a model inside your perimeter, and everything else to the cloud, by rule.
Three things that are different
Yours to run, not yours to build.
- 01
Deploy it your way, including the AI.
SaaS, private cloud in your account, or on-premise with the models inside. Hosting in or near Oman is stated in the contract, and the on-premise option keeps everything, including the AI models, in your data centre. Per-task routing keeps high-sensitivity work on the model you choose; keys are encrypted at rest and masked on screen.
- 02
Configure, do not customise.
Nine permission areas, custom roles from a permission matrix, conflict rules for separation of duties, and review chains and templates set in the browser. What you change is recorded, not patched.
- 03
A record built for the CBO Cyber Security & Resilience Framework.
Every change in an immutable trail, including requests to Lumina. Maker, checker and head of department on every approval, with an SLA clock, so the evidence for the auditor is the system itself.
Coverage for Oman
The standards you are measured against, already mapped.
The CBO Cyber Security & Resilience Framework, the PDPL and the Banking Law of 2025 are mapped, alongside ISO 27001 and the other global standards your controls already follow. The chip colour says whether each is in the product today or comes as a content pack.
Your regulators
Frameworks for you
- CBO Cyber Security & Resilience Framework
- Personal Data Protection Law (Royal Decree 6/2022)
- Banking Law (Royal Decree 2/2025)
- FSA capital market and insurance regulations
- ISO/IEC 27001
- NIST CSF
- PCI-DSS
Your industry pack
Banking and financeComing
Banks, finance and leasing companies, insurers, capital market firms
CBO CS&RF, Banking Law 2025, PDPL, FSA regulations
Why this matters now
The obligations are dated and the penalties are public.
Omani figures, each linked to its source.
USD 8m
average cost of a data breach in the Middle East, 2026; USD 10.67m in financial services
OMR 500,000
maximum fine under the PDPL, for unlawful cross-border transfer of personal data
OMR 200,000
maximum administrative fine the CBO can impose on a bank under the Banking Law of 2025
72 hours
to notify MTCIT of a personal data breach under the PDPL executive regulation
Bring your questions. We open on the admin console.
Sixty minutes with the product team: the role matrix, the approval chain, the audit trail, model routing and the deployment options, on a sample Omani tenant.