How an engagement runs
Scope first, your documents read before any interview, and nothing handed over that another supplier could not pick up.
- First step
- A written scope, yours to keep
- Steps
- Six, five of them ending in a document
- Stop points
- After the scope, and after the register
- Delivery
- Remote; on site in Saudi Arabia where needed
Every engagement starts with a written scope, reads what you already have before asking questions, then produces a register, the documents and a plan with owners. You can stop after the scope or after the register and keep what you hold. The same six steps sit under every Cyber service.
Where security engagements go wrong
Most of them go wrong before a single document is written: in the scope, or in the deadline.
A scope that says "the company" covers everything and proves nothing. A customer asking for ECC evidence usually wants it for the systems that touch its own orders. A scope that follows the contract clause is usually smaller, and it answers the question that was actually asked.
The policy pack with no owners is the next failure. It reads well in a folder and falls over the first time a reviewer asks who approved the last access review. Every document we hand over names its owner and the record that proves it runs.
Some deadlines cannot be met honestly. If the only way to hit a date is to write records of things that did not happen, we say so at the first call, and the plan puts the missing control on a dated line instead.
The six steps
The register changes with the service: controls for ECC, personal data for the PDPL, suppliers for vendor security, findings for a test. The steps do not.
| Step | What happens | What you hold |
|---|---|---|
| 1 Call | What prompted this, who asked for it, and by when. | Nothing yet, and no obligation |
| 2 Scope | Entities, systems, sites and exclusions agreed in writing. | The scope statement |
| 3 Read | Your existing documents, contracts and questionnaires, read before any interview. | A document index |
| 4 Register | Controls, suppliers, data or findings, each given a state and an owner. | The register |
| 5 Documents | Policies, plans and procedures drafted for your own approval route. | The document set |
| 6 Plan and walk-through | The gaps in order, with owners and dates, walked through with management. | The action plan |
Five documents, whichever service you buy
Scope statement
What is in, what is out, and why. Written so another supplier could work from it if you stop at step two.
Document index
What you already hold, listed before any interview, so the questions start from your documents rather than from a template.
The register
One line per control, supplier, data set or finding, with its state today and the person who owns it.
Document set
The policies, plans and procedures the register showed were missing or out of date, each with an owner and a review date.
Action plan
The remaining gaps in order, with owners and dates, walked through with management and written so another supplier could carry it out.
One engagement, step by step
A distribution company in Dammam supplies a government customer, which writes NCA ECC requirements into the renewal and asks for a current penetration test report.
The call establishes who wants what, and by when. At the scope we read the contract clause first, because it decides the scope: the customer wants ECC-2:2024 evidence for the systems that touch its orders, not for the whole company. The scope statement covers one legal entity, its ERP, its email and its customer portal.
Reading comes before any interview: the existing policies, the contracts and the questionnaires already answered for customers. The register then typically shows gaps that are partial rather than absent: access reviews that happen and leave no record, backups that run and have never been restored.
Missing policies are written and weak ones rewritten, each with an owner. The penetration testing controls cannot be met without a test, so the plan carries a written test scope. It goes to providers the company chooses, we compare their proposals with the company, and the company contracts one directly.
The company ends up holding a scope statement, a control register, a policy set with owners, an evidence map, the test scope and an action plan. When the provider's report arrives, its findings go into the same register and are tracked to the retest, so the customer could read one closure record.
Questions about the engagement
Can we stop after the scope?
Yes. The scope statement is yours at step two, written so another supplier could work from it. The same is true after the register.
Why read our documents before interviewing anyone?
Because most answers are already written down somewhere: in a policy, a contract or last year's questionnaire. Reading first means interview time goes on what the documents do not say.
Who needs to be involved on our side?
Whoever runs each control. A policy is drafted with the person who carries it out, and the action plan is walked through with management, because owners and dates need someone who can assign them.
Does the register look different for each service?
Its rows do. ECC readiness produces a control register, PDPL readiness a record of personal data, vendor security a supplier register, and test commissioning a findings register tracked to the retest. Every line still carries a state and an owner.
Can the work be done remotely?
Yes. Reading, drafting and walk-throughs run remotely, in English. Workshops and interviews are held on site in Saudi Arabia where they help.
Go from here
Every service
Nine services, filterable, each on its own page with its own register.
Read moreSaudiNCA ECC readiness
The engagement above, as a service: a control-by-control position against ECC-2:2024.
Read moreTestingCommissioning a penetration test
What happens when the register shows a control that only a test can answer.
Read moreFAQQuestions before you start
Who tests, where we work, certificates, and what you keep.
Read morePart of one system
Every division keeps records to the same standard, so the second one you need works the way the first one did.
The first step is a written scope
Tell us what prompted this and who asked. The scope comes first, and you keep it whatever you decide next.