Compliance programs in Saudi organizations rarely fail for lack of budget or intent. They fail in predictable patterns: the same eight, over and over. I have watched most of these from both sides of the
Read PostCybersecurity & GRC Notes
Live watch list
On the radar this week
- CRITICAL New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws
- HIGH Microsoft fixes Teams, Outlook launch failures on ARM Windows PCs
- CRITICAL September 2026 Microsoft Patch Tuesday
- HIGH ConnectWise ScreenConnect: Improper Privilege Management and Missing Authorization
- HIGH JFrog Artifactory: Incorrect Authorization
Blog
Where ICS Went When It Left the ECC
August 1, 2025 NCA
If you have been reading the ECC-2:2024 control list looking for the industrial control systems domain, stop looking. It is not there. ECC-1:2018 had five domains. ECC-2 has four: governance, defense, resilience, third party and
Read Post
معظم النصائح المكتوبة عن تقييمات الهيئة الوطنية للأمن السيبراني يكتبها من يستعدّ لتقييم. والقليل جداً منها يكتبه من جلس في المقعد المقابل، وقرأ حزمة الأدلة، ووازنها بنص الضابط.
Read Post
العربية Most of the advice written about NCA assessments is written by people preparing for one. Very little of it is written by people who have sat in the other chair, read the evidence pack,
Read Post
The NCA published ECC-2 in October 2024, superseding ECC-1:2018. Two years and an assessment cycle in, the change list is settled. The question now is which changes have practical effect.
Read Post