For heads of IT, IT risk and security · Saudi Arabia
You will run it. You do not want to build it.
Sastrum runs as SaaS, in your own cloud account or in your data centre, with the AI model you choose, roles and approval chains you configure in the browser, and a record that answers the SAMA Cyber Security Framework questions without a project.
Your situation
Every GRC tool promises integration. You end up owning the glue.
Problems
- Controls, evidence and policies sit in tools that do not talk to each other, and you are the one asked to reconcile them.
- the SAMA Cyber Security Framework wants evidence that is current; what you have is a folder from the last audit.
- The PDPL gives 72 hours to notify SDAIA of a breach, and SAMA expects incident reporting on its own clock.
Needs
- A deployment choice that fits the policy: SaaS, your own cloud account, or on-premise, the same product in each case.
- Roles, separation of duties and approval chains you configure yourself, without a change request to the vendor.
- A way to load what you already have: registers, controls and incidents, by file, not by re-keying.
Desires
- An AI assistant that drafts controls and policies but never publishes without a named approver.
- An audit trail you can hand to the auditor as it is, filtered by module, actor and date.
What you would love
- A system the business runs itself, where you are consulted and not paged.
- Sensitive work routed to a model inside your perimeter, and everything else to the cloud, by rule.
Three things that are different
Yours to run, not yours to build.
- 01
Deploy it your way, including the AI.
SaaS, private cloud in your account, or on-premise with the models inside. Hosting in a Saudi region is stated in the contract, and the on-premise option keeps everything, including the AI models, inside the Kingdom. Per-task routing keeps high-sensitivity work on the model you choose; keys are encrypted at rest and masked on screen.
- 02
Configure, do not customise.
Nine permission areas, custom roles from a permission matrix, conflict rules for separation of duties, and review chains and templates set in the browser. What you change is recorded, not patched.
- 03
A record built for the SAMA Cyber Security Framework.
Every change in an immutable trail, including requests to Lumina. Maker, checker and head of department on every approval, with an SLA clock, so the evidence for the auditor is the system itself.
Coverage for Saudi Arabia
The standards you are measured against, already mapped.
SAMA CSF, NCA ECC and the PDPL are mapped, alongside ISO 27001 and the other global standards your controls already follow. The chip colour says whether each is in the product today or comes as a content pack.
Your regulators
Frameworks for you
- SAMA Cyber Security Framework
- NCA Essential Cybersecurity Controls (ECC-2:2024)
- Personal Data Protection Law (PDPL)
- ISO/IEC 27001
- NIST CSF
- PCI-DSS
Your industry pack
Banking and finance
Banks, finance companies, insurers, capital market institutions
SAMA CSF, NCA ECC, PDPL, CMA
Why this matters now
The obligations are dated and the penalties are public.
Saudi figures, each linked to its source.
SAR 27m
average cost of a data breach in Saudi Arabia, 2026
SAR 5m
maximum fine for a PDPL violation, doubled for repeat offences
SAR 3m
maximum fine for disclosing sensitive personal data, with up to two years' prison
72 hours
to notify SDAIA of a personal data breach
Bring your questions. We open on the admin console.
Sixty minutes with the product team: the role matrix, the approval chain, the audit trail, model routing and the deployment options, on a sample Saudi tenant.