Cybersecurity Assessment
Cybersecurity Risk and Gap Assessment for Saudi Companies
Not sure where your real cyber risks are? Waves Telecom reviews your people, processes and technology, scores where you stand against NCA ECC, PDPL and Aramco SACS-210 where they apply, and gives you a prioritised fix list and roadmap you can actually budget for.
- People, process and technology review
- Scored against NCA ECC, PDPL and SACS-210
- Prioritised roadmap with budget options
10 yearsin cybersecurity
150+companies passed supplier cybersecurity audits with our help
Gold PartnerSophos & Fortinet
Why start with a risk assessment?
Most companies buy security one product at a time: a firewall after a virus scare, MFA after a customer asks for it, a backup tool after a disk fails. Years later nobody can say whether the whole picture is safe, or where the next riyal should be spent.
A cybersecurity risk assessment answers three simple questions. Where are we exposed today? Which gaps matter most for our business and our customers? What should we fix first, and what will it take?
It is also the fastest way to prepare for a supplier audit, a customer questionnaire or an NCA ECC review. Instead of guessing, you see each gap, its risk and the effort to close it.
- A clear picture of your current security level
- Gaps ranked by real business risk, not by vendor hype
- A plan your management can approve and fund
What we review in your environment
Our engineers look at how your company really works, not just at the paperwork. We talk to IT, management and a few end users, check configurations and walk through key processes. The review covers the areas where attackers usually get in and where audits usually fail:
- Firewall and network: rules, remote access, VPN, segmentation and firmware
- Endpoints and servers: antivirus or EDR coverage, admin rights, unsupported systems such as Windows 10
- Email: filtering, SPF, DKIM and DMARC, phishing exposure
- Identity and MFA: user accounts, privileged accounts, leavers, MFA on email, cloud and remote access
- Patching: how fast updates reach Windows, servers, firewalls and third-party apps
- Backups: what is backed up, where copies are kept and whether restores are tested
- Logging: which logs are collected, how long they are kept and who looks at them
- Policies and awareness: security policies, incident procedures and staff training
What’s included
Technical review
Hands-on checks of firewall, endpoints, Microsoft 365 or email, identity, patching and backups.
People and process review
Short interviews with IT and management on how access, changes, incidents and suppliers are handled.
Compliance gap scoring
Each area scored against NCA ECC, PDPL and SACS-210 where they apply to your business.
Risk-rated findings
Every gap rated by likelihood and business impact, written in plain language.
Prioritised fix list
Quick wins you can do this month, then medium- and longer-term items in a clear order.
Roadmap with budget options
A phased plan with options, such as using tools you already own versus adding new ones.
How it works
Scoping call
We agree which sites, systems and regulations are in scope, and who we need to speak to.
Information gathering
You share basic documents and admin access for read-only checks. We interview key people.
Technical checks
Our engineers review configurations and settings remotely or on site, without disrupting work.
Analysis and scoring
We rate each gap, map it to the relevant controls and build the fix list and roadmap.
Report and walkthrough
We present the findings to IT and management and answer questions on each recommendation.
Mapped to Saudi compliance requirements
The assessment shows how ready you are for the rules that apply to you. We only score against the frameworks that are relevant to your business. If a customer or supplier audit is coming up, the report shows exactly which gaps to close first and what evidence the auditor will expect to see.
- NCA Essential Cybersecurity Controls (ECC): for government bodies, critical sectors and their suppliers. We check governance, risk management, vulnerability and patch management, identity and access, incident management and awareness.
- Saudi PDPL: we look at where personal data is stored, who can access it, and whether you could detect and report a personal data breach to SDAIA.
- Aramco SACS-210: for Aramco suppliers we check MFA on remote access, cloud, email and privileged accounts, SPF/DKIM/DMARC, incident notification within 24 hours, log retention of at least one year, monthly vulnerability scans, tested backups and yearly awareness training.
Products we use
The assessment is vendor-neutral: we often recommend making better use of tools you already own. Where new controls are needed, we usually work with Sophos and Fortinet for firewalls and endpoint protection, Microsoft Defender, Entra, Intune and Purview for Microsoft 365, Cisco for networking and KnowBe4 for awareness training.
Frequently asked questions
Is the risk assessment really free?
Yes. The initial risk assessment is free and has a fixed scope, so you know exactly what you will get. If you later need a deeper review, such as several sites or a full audit-ready gap assessment, we agree the scope and send a quote before any work starts.
How is this different from a penetration test?
A penetration test tries to break into specific systems. A risk assessment looks at the whole picture: technology, processes and people. Many companies start with the risk assessment and then run a VAPT on the systems it flags.
Will the assessment disrupt our work?
No. Technical checks are read-only and interviews are short. We plan any on-site time with your IT team so daily work continues normally.
Do we need admin passwords for the review?
We need read-only or supervised access to view settings. Your IT team stays in control of accounts and can remove access as soon as the review is finished.
What do we receive at the end?
A short management summary, a detailed list of findings with risk ratings, compliance scores for the relevant frameworks, a prioritised fix list and a phased roadmap with budget options. We walk you through it in a meeting.
Do we have to use Waves to fix the gaps?
No. The report is yours and your team or any provider can use it. If you want help, we can quote for the fixes or support you with an ongoing virtual CISO service.
Book a free cybersecurity risk assessment
Tell us about your company and we will arrange a short scoping call. Based in Al Khobar, we work with companies in Dammam, Dhahran, Jubail, Riyadh and across the Kingdom.
- 📞 +966 58 236 5619
- 💬 +966 58 236 5619
- ✉️ info@wavestelecom.net
- 📍 3266 Adh Dhahran – Al Aqrabiyah Dist, Al Khobar 34446
