Guides, Checklists & Whitepapers.
Free resources built for Saudi and UAE compliance teams. Practical guides for NCA-ECC, PDPL, ISO 27001, and ISO 42001 — written by GRC practitioners who've worked inside GCC institutions.
The Complete NCA-ECC Compliance Playbook for Saudi Organisations
A practitioner's guide to all 29 NCA-ECC controls across 5 domains — with evidence requirements, common gaps, and automation checkpoints for each.
NCA-ECC Gap Assessment Checklist
Use this checklist to identify your current compliance gaps across all 5 NCA-ECC domains before starting your formal assessment.
PDPL Data Inventory & Consent Audit Checklist
Map every data category your organisation processes against PDPL's 7 obligation areas. Includes consent language samples.
ISO 27001 Statement of Applicability (SoA) Template
A pre-filled SoA template for GCC organisations covering all 114 controls — with GCC-specific notes on Annex A applicability.
ISO 42001 Readiness Guide for GCC Entities
Everything GCC organisations need to know about the AI Management System standard — with SDAIA alignment notes.
ALE-Based Risk Quantification for Saudi Financial Institutions
How to calculate Annual Loss Expectancy using NIST SP 800-30 with GCC sector multipliers. Includes worked example.
72-Hour NDMO Breach Notification Checklist
Step-by-step incident response checklist aligned with PDPL Article 29 — from detection to NDMO submission.
Evidence Collection Guide: What Auditors Actually Want
A domain-by-domain guide to acceptable evidence formats for each NCA-ECC control — with common rejection reasons.
Information Security Policy Pack (GCC Edition)
12 pre-written ISMS policies adapted for Saudi and UAE organisations — ready for your audit file.
AI Governance for GCC Boards: A Non-Technical Briefing
A plain-language briefing on ISO 42001 and emerging GCC AI regulations for board members and audit committees.
New Resources Drop Monthly.
New NCA-ECC updates, PDPL enforcement actions, ISO revisions — we track every GCC regulatory change and translate it into practical guidance.
No marketing. New resources only. Unsubscribe any time.
Resources Are Just the Start.
See how DeepNotch automates the evidence collection these guides describe.