What you'll learn
- Explain how governance, risk, and compliance work together as one cybersecurity management system
- Identify which NCA, SAMA, SDAIA, and CST requirements apply to your organization
- Interpret the structure of the NCA Essential Cybersecurity Controls (ECC-2:2024) and its four domains
- Distinguish between ECC, CSCC, CCC, TCC, OTCC, DCC, NCNICC, and SAMA CSF, and know when each applies
- Build a cybersecurity governance structure, strategy, policy set, and KPI dashboard
- Run a complete cybersecurity risk assessment, from asset inventory to risk register and treatment plan
- Perform a gap assessment, collect audit-ready evidence, and prepare for regulator assessments
- Apply the Personal Data Protection Law (PDPL) alongside cybersecurity requirements
- Govern third-party, cloud, incident response, and business continuity risks
- Map Saudi requirements to ISO/IEC 27001 and NIST CSF, and plan your GRC career path
Course overview
Saudi Arabia's digital economy is growing fast under Vision 2030, and with it, the number of regulations that organizations must follow. The National Cybersecurity Authority (NCA) issues the Essential Cybersecurity Controls and several related frameworks. SAMA, SDAIA, and CST add sector and data requirements on top. For many professionals, the real challenge is not understanding one framework but making all of them work together without duplicating effort.
This intermediate course teaches Cybersecurity Governance, Risk and Compliance from a Saudi perspective. It starts with GRC fundamentals and the Saudi regulatory landscape, then goes deep into the NCA ECC-2:2024 structure and the wider NCA framework family, including NCNICC, CSCC, CCC, TCC, OTCC, and DCC. You will also learn how SAMA's Cyber Security Framework fits alongside NCA requirements.
The second half focuses on practice. You will learn how to design governance and strategy, run risk assessments, perform gap assessments, collect evidence, prepare for audits, and close findings with proper remediation plans. Dedicated modules cover PDPL compliance, third-party and cloud governance, incident and continuity governance, and international standards such as ISO/IEC 27001 and NIST CSF.
Each module ends with a 10-question quiz, and the course closes with a 40-question final assessment. The lessons also include practical tools you can adapt at work, such as risk register fields, a gap assessment method, audit preparation and cloud governance checklists, and a 30-60-90 day action plan.
Course curriculum
Module 1: Foundations of Cybersecurity GRC — 55 min
- 1.1 What GRC Is and Why It Matters7 min
- 1.2 How Governance, Risk, and Compliance Connect7 min
- 1.3 Key Roles: CISO, Risk Owner, Compliance Officer, Internal Auditor7 min
- 1.4 The Three Lines of Defense Model7 min
- 1.5 Overview of the Saudi Cybersecurity Landscape7 min
- Module 1 quiz: Foundations of Cybersecurity GRC10 questions
Module 2: Saudi Cybersecurity Regulatory Landscape — 55 min
- 2.1 Role of the National Cybersecurity Authority (NCA)7 min
- 2.2 Cybersecurity Law and Vision 2030 Digital Transformation7 min
- 2.3 Other Regulators: SAMA, CST, CMA, SDAIA, MoH7 min
- 2.4 Who Must Comply: Government, CNI, and Private Sector7 min
- 2.5 How the Regulators Overlap and Interact7 min
- Module 2 quiz: Saudi Cybersecurity Regulatory Landscape10 questions
Module 3: NCA Essential Cybersecurity Controls (ECC-2:2024) — 62 min
- 3.1 ECC-2:2024 Structure: Domains, Subdomains, and Control Coding7 min
- 3.2 What Changed from ECC-1:2018 to ECC-2:20247 min
- 3.3 Domain 1: Cybersecurity Governance7 min
- 3.4 Domain 2: Cybersecurity Defense7 min
- 3.5 Domain 3: Cybersecurity Resilience7 min
- 3.6 Domain 4: Third-Party and Cloud Computing Cybersecurity7 min
- Module 3 quiz: NCA Essential Cybersecurity Controls (ECC-2:2024)10 questions
Module 4: The Wider NCA Framework Family and SAMA — 76 min
- 4.1 Which Framework Applies to Your Organization7 min
- 4.2 NCNICC-1:2025: Controls for Non-CNI Private-Sector Entities7 min
- 4.3 Critical Systems Cybersecurity Controls (CSCC)7 min
- 4.4 Cloud Cybersecurity Controls (CCC) and Telework Cybersecurity Controls (TCC)7 min
- 4.5 Operational Technology Cybersecurity Controls (OTCC)7 min
- 4.6 Data Cybersecurity Controls (DCC)7 min
- 4.7 SAMA Cyber Security Framework for the Financial Sector7 min
- 4.8 Mapping SAMA and NCA Requirements to Avoid Duplicated Effort7 min
- Module 4 quiz: The Wider NCA Framework Family and SAMA10 questions
Module 5: Cybersecurity Governance and Strategy — 55 min
- 5.1 Building a Cybersecurity Governance Structure7 min
- 5.2 Cybersecurity Strategy Aligned to Business Goals7 min
- 5.3 Policies, Standards, and Procedures7 min
- 5.4 Roadmaps and Steering Committees7 min
- 5.5 Metrics, KPIs, and Reporting to Leadership7 min
- Module 5 quiz: Cybersecurity Governance and Strategy10 questions
Module 6: Cybersecurity Risk Management — 69 min
- 6.1 Risk Management Lifecycle7 min
- 6.2 Asset Identification and Classification7 min
- 6.3 Threat and Vulnerability Identification7 min
- 6.4 Qualitative and Quantitative Risk Assessment7 min
- 6.5 Risk Treatment: Mitigate, Transfer, Accept, Avoid7 min
- 6.6 Risk Registers and Risk Appetite7 min
- 6.7 Using ISO 27005 and NIST RMF Alongside NCA Requirements7 min
- Module 6 quiz: Cybersecurity Risk Management10 questions
Module 7: Compliance Management, Evidence, and Audit Readiness — 69 min
- 7.1 Building a Compliance Program7 min
- 7.2 Gap Assessments Against ECC-2:20247 min
- 7.3 Maturity Levels and What "Operating Effectively" Means7 min
- 7.4 Evidence Collection and Documentation7 min
- 7.5 Continuous Compliance Monitoring7 min
- 7.6 Preparing for NCA Audits and Assessments7 min
- 7.7 Remediation Plans and Corrective Actions7 min
- Module 7 quiz: Compliance Management, Evidence, and Audit Readiness10 questions
Module 8: Data Protection and Privacy Compliance — 62 min
- 8.1 Overview of the Personal Data Protection Law (PDPL)7 min
- 8.2 Data Classification and Handling7 min
- 8.3 Data Subject Rights and Controller Responsibilities7 min
- 8.4 Cross-Border Data Transfer Requirements7 min
- 8.5 Breach Notification Obligations7 min
- 8.6 Aligning Privacy and Cybersecurity Programs7 min
- Module 8 quiz: Data Protection and Privacy Compliance10 questions
Module 9: Third-Party, Cloud, and Incident Governance — 55 min
- 9.1 Third-Party and Supply Chain Risk Management7 min
- 9.2 Cloud Governance and Data Residency in Saudi Arabia7 min
- 9.3 Incident Response Governance and Reporting to Authorities7 min
- 9.4 Business Continuity and Disaster Recovery Governance7 min
- 9.5 Feeding Incident Lessons Back into the Risk Register7 min
- Module 9 quiz: Third-Party, Cloud, and Incident Governance10 questions
Module 10: International Standards, Tools, and Career Path — 62 min
- 10.1 ISO/IEC 27001 and Mapping It to NCA ECC7 min
- 10.2 NIST CSF and COBIT in Saudi Organizations7 min
- 10.3 Internal and External Audit Practices7 min
- 10.4 GRC Tools and Automation7 min
- 10.5 GRC Career Paths and Certifications7 min
- 10.6 Course Wrap-Up and Final Knowledge Check7 min
- Module 10 quiz: International Standards, Tools, and Career Path10 questions
Final assessment — 60 min
- Final assessment: Cybersecurity Governance, Risk and Compliance (GRC)40 questions
Who is this course for?
- Cybersecurity and information security analysts moving into governance, risk, or compliance roles
- IT managers and officers who are responsible for meeting NCA ECC requirements
- Compliance and risk officers who need to understand technical control requirements
- Internal auditors and external auditors preparing to assess cybersecurity controls
- Data protection officers and privacy professionals who work alongside the cybersecurity team
- Project and program managers delivering compliance or security programs
- Consultants supporting Saudi clients with NCA, SAMA, or PDPL projects
- Graduates and early-career professionals with basic IT or security knowledge who want a GRC career in the Kingdom
Prerequisites
Basic knowledge of cybersecurity concepts (confidentiality, integrity, availability, common threats, and basic controls). No prior GRC experience is required.
Assessment
A short quiz after each module and a final assessment. Pass mark: 70%, with up to 3 attempts.
Academy certificate of completion
Complete all lessons and pass the final assessment with 70% or more to receive a digital certificate in your name that you can download and share.
- Downloadable digital certificate
- Shows your name, the course title and completion date
- Suitable for training and CPD records
Frequently asked questions
Who is this course for?
This course is for cybersecurity, IT, risk, compliance, and audit professionals in Saudi Arabia who want to understand and apply Cybersecurity Governance, Risk and Compliance. It is also suitable for consultants, project managers, and early-career professionals with basic cybersecurity knowledge.
Do I need prior GRC experience?
No. You should understand basic cybersecurity concepts (confidentiality, integrity, availability, common threats, and basic controls). The course explains GRC concepts from the ground up at an intermediate level.
How long does the course take?
The course takes about 4 hours to complete, including lessons and quizzes. Because it is self-paced, you can split it across several days or weeks.
Is the course based on the current NCA ECC-2:2024?
Yes. The ECC module is built on ECC-2:2024, including its four-domain structure and what changed from ECC-1:2018. Because frameworks can be updated, the course also teaches you how to check the latest official version.
Is this course only for banks and the financial sector?
No. It covers general GRC for government, critical infrastructure, and private-sector organizations. The SAMA Cyber Security Framework is covered as a dedicated lesson for financial entities, and the mapping lesson shows how it works alongside NCA requirements.
Does the course cover private companies that are not critical national infrastructure?
Yes. Module 4 includes a lesson on NCNICC-1:2025, the NCA framework for non-CNI private-sector entities, along with guidance on how to scope and plan compliance.
Will I receive a certificate?
Yes. You receive a certificate of completion from Imtithal Academy after completing the course and passing the final assessment. The suggested passing score is 70%.
How are the quizzes and final assessment structured?
Each module ends with a 10-question quiz, and the course ends with a 40-question final assessment covering all modules. Questions are multiple choice, with explanations to help you learn from each answer.
Is this an official NCA, SAMA, or SDAIA course?
No. This is independent educational content from Imtithal Academy. It is based on publicly available frameworks and good practice. Always refer to the official publications of NCA, SAMA, SDAIA, CST, and other authorities for the latest binding requirements.
Will this course help me prepare for CISA, CISM, CRISC, or CGRC?
It gives you a strong foundation in governance, risk, and compliance concepts that overlap with those certifications, and Module 10 explains each pathway. However, it is not an exam-preparation course. For exams, use official study materials from the certification bodies.
What practical tools are included?
The lessons explain tools you can adapt at work: risk register fields, an ECC-2:2024 gap assessment method, an audit preparation checklist, a cloud governance checklist, a worked remediation plan example, and a 30-60-90 day action plan.
Is the course technical or hands-on with security tools?
The course focuses on governance, risk, and compliance management, not on configuring security tools. You will learn what controls are expected, how to assess them, and what evidence proves them, rather than how to set up firewalls or SIEM systems.
What happens if the regulations change after I finish?
Saudi frameworks are updated from time to time. The course teaches you how to verify requirements against official sources, re-map your controls, and update your gap assessments, so you can adapt to new versions.
Does this course replace legal advice or consulting?
No. The course provides education, not legal or regulatory advice. For specific decisions about legal obligations, consult qualified legal advisors or your regulator.
Can I use the course to build my organization's compliance program?
Yes. The lessons, tools, and 30-60-90 day action plan are designed to help you start a compliance program or improve an existing one. Adapt them to your organization's size, sector, and applicable requirements.
Training a team?
We offer company pricing with progress tracking for your staff and a certificate for every learner.