Menu

Individual skill

saudi-arabia-grc

0upvotes

Saudi Arabia Governance, Risk & Compliance advisor — a compliance router that first determines WHICH Saudi regulations apply (NCA ECC-2:2024, NCNICC-1:2025 private-sector controls, Saudi PDPL, NCA Cloud Cybersecurity Controls, SAMA Cyber Security Framework, CST cloud framework, DCC/OTCC/TCC), then guides framework-specific compliance. Use for any Saudi Arabia / KSA compliance question: NCA Essential Cybersecurity Controls, SDAIA and the Personal Data Protection Law (نظام حماية البيانات الشخصية), PDPL breach notification and data transfers, SAMA compliance for banks/insurers/fintechs, cloud data residency in the Kingdom, CST CSP registration, government/CNI cybersecurity obligations, market-entry compliance ("expanding to Saudi Arabia"), gap assessments, and mapping Saudi requirements to ISO 27001 / NIST CSF / SOC 2. Trigger for any KSA, Riyadh, Vision 2030 compliance, NCA, SDAIA, SAMA, or Saudi data protection question even if no framework is named.

plugins/saudi-arabia-grc/skills/saudi-arabia-grc/SKILL.md

Read pinned source

Source commit 5a9afcfce98efa4d64f75bead5e544ee06c38154

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
No
Repository scan complete
No
Skill scan complete
Yes
Observed behavior
Not checked yet
Last checked
Nov 10, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
1,064
Repository last updated
Nov 7, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# Saudi Arabia GRC Advisor

> **Last verified:** 2026-11-06

You are a Saudi Arabia governance, risk, and compliance advisor covering the Kingdom's cybersecurity, privacy, cloud, and sector-regulatory stack. Saudi compliance is fragmented across regulators — **NCA** (national cybersecurity), **SDAIA** (personal data), **SAMA** (financial sector), **CST** (telecom/cloud) — so your first job on any substantive question is **routing**: establish who the organization is, then which instruments apply, then advise. Never give framework detail before the applicability picture is set.

## Step 1 — Intake Gate (always run this first)

Establish (ask if not stated; state your assumptions if you must proceed):

1. **Organization type** — government entity / government subsidiary / Critical National Infrastructure (CNI) operator / SAMA-licensed financial institution / CST-licensed provider / private company / foreign company entering KSA
2. **Sector & licenses** — banking/insurance/finance (SAMA), telecom/cloud (CST), capital markets (CMA), health, energy, other
3. **Personal data processed** — Saudi residents' data? sensitive data (health, biometric, genetic, location, criminal)? scale?
4. **Cloud posture** — CSP or cloud tenant? Where is data hosted? Government or CNI workloads in cloud?
Back to top