Local depth, global coverage
A maintained library of 14 frameworks that leads with Saudi and GCC regulation: the NCA suite and SAMA's financial-sector frameworks, alongside the international standards you already report against.
Every framework, regulator by regulator
National Cybersecurity Authority
Saudi Arabia's national cybersecurity regulator.
- ECC
NCA-ECC (Essential Cybersecurity Controls)
RegulationNCA Essential Cybersecurity Controls (ECC) - Comprehensive baseline cybersecurity controls framework issued by the National Cybersecurity Authority of Saudi Arabia covering governance, defense, resilience, third-party, cloud, and ICS security.
- DCC
NCA-DCC (Data Cybersecurity Controls)
RegulationNCA Data Cybersecurity Controls (DCC) - Specialized framework issued by the National Cybersecurity Authority of Saudi Arabia for protecting sensitive data across its lifecycle, covering governance, defense, and third-party data security.
- CSCC
NCA-CSCC (Cybersecurity Controls for Critical Systems)
RegulationNCA Cybersecurity Controls for Critical Systems (CSCC) - Framework for protecting critical systems issued by the National Cybersecurity Authority of Saudi Arabia, complementing the Essential Cybersecurity Controls (ECC).
- CCC · Service Provider
NCA-CCC-ServiceProvider (Cloud Cybersecurity Controls - Service Provider)
RegulationNCA Cloud Cybersecurity Controls (CCC) for Cloud Service Providers - Controls framework issued by the National Cybersecurity Authority of Saudi Arabia for organizations providing cloud services.
- CCC · Tenant
NCA-CCC-Tenant (Cloud Cybersecurity Controls - Tenant)
RegulationNCA Cloud Cybersecurity Controls (CCC) for Cloud Service Tenants - Controls framework issued by the National Cybersecurity Authority of Saudi Arabia for organizations using cloud services as tenants.
- TCC
NCA-TCC (Telework Cybersecurity Controls)
RegulationThird-Party Cybersecurity Controls (TCC) framework issued by the National Cybersecurity Authority of Saudi Arabia, outlining cybersecurity requirements and best practices for managing third-party and vendor relationships to ensure supply chain security.
- OSMACC
NCA-OSMACC (Organizations' Social Media Accounts Cybersecurity Controls)
RegulationOperational Security Model and Associated Cybersecurity Controls (OSMACC) framework issued by the National Cybersecurity Authority of Saudi Arabia, providing operational guidelines and control requirements for securing organizational environments.
- NCS
NCA-NCS (National Cybersecurity Strategy)
RegulationNational Cybersecurity Strategy (NCS) developed by the National Cybersecurity Authority of Saudi Arabia to strengthen cybersecurity governance, resilience, and innovation across the Kingdom.
Saudi Central Bank (SAMA)
Cyber, fraud and IT governance for regulated financial institutions.
- CSF
SAMA-CSF (Cyber Security Framework)
RegulationControls extracted from the provided SAMA-CSF self-assessment tracker CSV. Domains/subdomains are taken from the file with leading numeric prefixes removed; titles are short mid-level themes derived from each control description.
- CFF
SAMA-CFF (Counter Fraud Framework)
RegulationSAMA Counter-Fraud Framework (CFF) - Comprehensive framework covering governance, prevention, detection, and response to fraud risks in financial institutions.
- ITGF
SAMA-ITGF (Information Technology governance Framework)
RegulationIT Governance Framework
ISO / IEC
International information-security standards.
- ISO/IEC 27001
ISO/IEC 27001 (Information Security Management System)
StandardThis standard specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS).
PCI Security Standards Council
The global standard for protecting cardholder data.
- PCI-DSS
PCI-DSS (Data Security Standard)
StandardThis standard sets out the criteria for protecting cardholder data.
SWIFT
Security controls for the global financial-messaging network.
- SWIFT CSCF
SWIFT Customer Security Programme (CSP) - Customer Security Controls Framework (CSCF)
StandardThis framework sets out the mandatory and advisory security controls for SWIFT users to secure their local SWIFT environment and protect against cyber threats.
Need a framework we don't list yet?
Amantra's AI can extract controls straight from a standard's PDF, so custom and emerging frameworks are quick to onboard.
Report with confidence
See how Amantra maps your controls, evidence and gaps to the exact frameworks you're assessed against.·your team driving
Amantra·A real consultant in a box