Saudi cybersecurity compliance self-assessment

Saudi Cyber Security Compliance Check (THIQA - ثقة) by Niyyasoft

How compliant are you with Saudi cybersecurity regulations?

Covers 18 frameworks from NCA, SDAIA, CST, SAMA, CMA, DGA, MOH

Answer guided questions based on the official controls. Get a scored report with charts, a gap analysis and a remediation roadmap you can download as Word, PowerPoint or Excel.

Start free assessment How it works

Sign in with your free Niyyasoft account to save assessments and download reports, or continue as a guest (nothing is saved and downloads are off). · Works in English, Arabic, or both side by side, including the reports

What the platform does

Describe your organization

Sector, size and a few yes/no questions. Choose the regulators and frameworks to check against; we pre-select the ones that apply to you.

Answer the controls

For each control, choose Implemented, Partial, Not implemented or N/A. Tips explain what evidence auditors expect. Answers save automatically.

Get your report

See your overall score, scores by framework and domain, charts, prioritized gaps, a 12-month roadmap and your penalty exposure.

Word, PowerPoint & Excel

Download the report as an editable Word document, PowerPoint deck or Excel workbook, in English, Arabic or both.

Governance & risk

Define asset ownership and clear cybersecurity roles, run an independent cybersecurity function and do periodic risk assessments.

Data protection & encryption

Classify data, encrypt endpoints and data in transit, control external media and meet PDPL obligations.

Monitoring & incident response

Monitor continuously, manage vulnerabilities, report incidents to NCA and personal data breaches to SDAIA within 72 hours.

Penalties

PDPL violations can reach SAR 5 million. Under the Anti-Cyber Crime Law, the most serious offences carry up to SAR 5 million and 10 years in prison.

Requirements covered

Question banks are based on the official publications of each authority. Links to the original documents are on the Regulations page. Regulations →

NCA ECC · ECC-2:2024 NCA NCA NCNICC · NCNICC-1:2025 NCA NCA CSCC · CSCC-1:2019 NCA NCA CCC · CCC-2:2024 NCA NCA DCC · DCC-1:2022 NCA NCA OTCC · OTCC-1:2022 NCA NCA TCC · TCC-1:2021 NCA NCA OSMACC · OSMACC-1:2021 NCA NCA NCS · NCS-1:2020 NCA PDPL · Royal Decree M/19, amended M/148 SDAIA NDMO Data Standards · v1.5 (January 2021) SDAIA CST CRF · RT08, 2nd version, Oct 2023 CST CST CCRF · RS10, 4th version, Oct 2023 CST SAMA CSF · Version 1.0 (May 2017) SAMA SAMA BCM · Version 1.0 (February 2017) SAMA CMA Cybersecurity · Issued 2021 (current edition) CMA DGA Standards · ITG Controls v3.0 (2026) · RBC Controls v4.0 (2025) · DTS v5.0 (2026) DGA SeHE Policies · IS0303 v1.0 (April 2016) MOH

Ready to see where you stand?

Free with a Niyyasoft account, or try it as a guest with sample data to preview a full report.

Start assessment Create Niyyasoft account

A self-assessment tool based on public requirements from the National Cybersecurity Authority (NCA), CST and SDAIA. It is not an official NCA assessment or legal advice.