For CEOs, CFOs, CROs and CISOs · Saudi Arabia
You answer to SAMA, the CMA and the Insurance Authority and the board. Your GRC lives in spreadsheets.
Sastrum puts risk, compliance and audit on one record, with SAMA CSF, NCA ECC and the PDPL already mapped, at a size and price that fits a bank, finance company, insurer or capital market institution.
Your situation
The regulator's list is long. Your team is not.
Problems
- A new circular or standard every quarter, and a register that cannot keep up.
- Risk in one spreadsheet, compliance in another, audit findings in email.
- SAMA, NCA and SDAIA each expect their own evidence, and the PDPL has been fully enforceable since September 2024.
Needs
- One view of risk and compliance across the firm, in SAMA, the CMA and the Insurance Authority's own terms.
- Reports in the format the regulator and the board expect, without a scramble.
- A cost and a project size that fit a firm your size.
Desires
- Walk into the board meeting and the inspection with a dashboard, not a binder.
- Know today, not at year end, where the gaps are and who owns them.
What you would love
- The next circular is already mapped before anyone asks.
- A regulator's request answered the same day, from the system, with the trail attached.
Three things that are different
Built the way a regulator reads it, sized the way you buy it.
- 01
Risk-first, as SAMA reads it.
Onboarding starts with a risk profile scoped to your sector and SAMA CSF, NCA ECC and the PDPL, and compliance follows from it. Most GRC tools start from a checklist; Sastrum starts from what could go wrong at your firm.
- 02
Sized for a small team.
Enterprise GRC without the enterprise project. Packs for your regulator make implementation configuration, not a build, and Lumina drafts policies and controls for a named person to sign.
- 03
A record the regulator can trust.
Maker, checker and head of department on every change, an immutable audit trail, and dashboards for each leadership role. SecurEyes, which has served Saudi regulated firms from Riyadh for years, stands behind the product.
Coverage for Saudi Arabia
Your regulators and standards, already mapped.
SAMA CSF, NCA ECC and the PDPL are mapped to controls, risks, policies and audit tests, alongside the global standards your auditors ask about. The chip colour says whether each is in the product today or comes as a content pack.
Your regulators
Frameworks for you
- SAMA Cyber Security Framework
- NCA Essential Cybersecurity Controls (ECC-2:2024)
- Personal Data Protection Law (PDPL)
- ISO/IEC 27001
- NIST CSF
- PCI-DSS
Your industry pack
Banking and finance
Banks, finance companies, insurers, capital market institutions
SAMA CSF, NCA ECC, PDPL, CMA
Why this matters now
The cost of getting it wrong is public.
Saudi figures, each linked to its source.
SAR 27m
average cost of a data breach in Saudi Arabia, 2026
SAR 5m
maximum fine for a PDPL violation, doubled for repeat offences
SAR 3m
maximum fine for disclosing sensitive personal data, with up to two years' prison
72 hours
to notify SDAIA of a personal data breach
Thirty minutes, opened on your regulators.
We open the demo on a Saudi risk universe scoped to SAMA, the CMA and the Insurance Authority. Bring your register; we will show you where it lands.