Build the cybersecurity awareness programme that NCA ECC 2:2024
domain 1-10 asks for: simulations, role-based training, certificates and
an effectiveness scorecard, in Arabic and English, with evidence filed
to the control.
Request a
demonstration · See the GRCLens
Saudi Arabia page
Who this is for in Saudi
Arabia
Organisations in Riyadh, Jeddah and Dammam that must show a regulator
or auditor that staff awareness is tested, trained and recorded:
government entities and critical infrastructure under NCA ECC,
SAMA-regulated banks and insurers, CST-licensed telecoms, and healthcare
and education providers handling personal data.
Which Saudi
Arabia frameworks PhishLens evidences
PhishLens runs on the shared control model of GRCLens, so evidence
captured once is mapped to every framework you are assessed against. In
Saudi Arabia that means:
| Framework | Awareness and training requirement it evidences |
|---|---|
| NCA Essential Cybersecurity Controls (ECC 2:2024) | domain 1-10, cybersecurity awareness and training programme, including periodic awareness, role-based training and measurement of effectiveness |
| SAMA Cyber Security Framework | staff awareness and training for financial institutions |
| NCA OTCC and CCC | awareness for operational technology and cloud environments |
| Saudi PDPL (SDAIA) | training for staff who process personal data |
| CST Cybersecurity Regulatory Framework | awareness obligations for telecom and ICT providers |
| ISO 27001:2022 | A.6.3 information security awareness, education and training |
Built for Saudi Arabia
The NCA now offers a free phishing simulation service through Haseen,
which is a good baseline. What it does not give you is the rest of the
programme domain 1-10 asks for: training records, role-based modules
before access, certificates, and the periodic evaluation of
effectiveness. PhishLens adds those and files each result to the ECC
control, with the ar-SA locale, optional Hijri dates and terminology
checked against NCA usage.
What PhishLens does, in brief
For a Saudi entity, PhishLens supplies the pieces that sit around a phishing test: Arabic and English courses by role, automatic enrolment of new joiners, an executive dashboard and operations queues, the programme scorecard that evidences periodic evaluation, certificates with a verification page, and every figure filed to the ECC control. Full details are on the PhishLens product page.
Frequently asked questions
Does PhishLens cover
ECC 2:2024 domain 1-10?
Yes. Campaign results and training completion are filed as evidence
against the awareness and training controls in ECC 2:2024, which GRCLens
holds with Arabic text, and the quarterly KPI snapshot evidences the
periodic review of the programme.
We
already use the NCA phishing simulation service. Why add PhishLens?
Keep it as a baseline if you like. PhishLens adds the training
programme, role-based modules, certificates, the executive scorecard and
the evidence trail, which a simulation service alone does not
provide.
Is the Arabic
suitable for a Saudi audience?
Written text is Modern Standard Arabic with Saudi forms selected by
the ar-SA locale, and Hijri dates can be shown. Every Arabic string is
reviewed by a Saudi native reviewer before release.
Can PhishLens
run on premise inside the Kingdom?
Yes. GRCLens and PhishLens deploy on premise for entities with data
localisation requirements.
Talk to us about PhishLens
Request a demonstration and we will run a baseline simulation design
for your organisation, show the executive dashboard with demo data, and
map the evidence to the frameworks you are assessed against.
Looking for professional certification courses (lead auditor, implementer, regulator-specific classes) rather than a staff awareness programme? See our NCA ECC and Saudi compliance training courses.
Request a
demonstration · Explore
the GRCLens platform · On-premise
deployment
