Reviewers ask for the policy, then for the procedure that implements it, then for evidence that people follow it. We write all three layers so they connect, and so each document has a clear owner and review date.
Every document is mapped control by control to SAMA CSF, NCA ECC and the other frameworks that apply, so you can show coverage at a glance.
Why it matters
Policy hierarchy and document control
Framework-mapped policies
Technical standards and baselines
Operational procedures and forms
Bilingual drafting
How the engagement runs
- 1InventoryExisting documents, gaps and overlaps
- 2DraftPolicies, standards and procedures in both languages
- 3ValidateWorkshops with owners to make sure each document can be followed
- 4ApproveApproval support and document-control setup
What you receive
- Policy set (typically 15–25 policies)
- Standards and secure baselines
- Procedures with workflows
- Control mapping matrix
- Document control register
Questions
Can you update our existing documents instead of starting again?
Yes. We keep what works, close the gaps against the frameworks, and harmonize the style and structure.