Cyber security standards
Plain-language guides to the standards, frameworks and laws behind most security programmes, from Pakistan, Saudi Arabia and the wider Gulf, plus the international standards that connect them.
ISO/IEC 27001:2022
The certifiable standard for an information security management system (ISMS).
InternationalISO/IEC 27002:2022
Practical guidance for implementing the controls listed in ISO/IEC 27001 Annex A.
InternationalISO/IEC 27005:2022
Guidance on managing information security risk within an ISMS.
InternationalISO/IEC 27017
Security controls for cloud services, for both providers and customers.
InternationalISO/IEC 27701
A privacy information management extension for the security management system.
InternationalISO 22301:2019
Requirements for a business continuity management system.
InternationalNIST Cybersecurity Framework 2.0
A flexible outcome-based framework published in 2024 for managing cyber risk.
InternationalNIST SP 800-53 Rev. 5
A detailed catalogue of security and privacy controls.
InternationalCIS Critical Security Controls v8
A prioritised set of 18 control groups aimed at the most common attacks.
InternationalPCI DSS v4.0.1
Security requirements for organisations that store, process or transmit payment card data.
InternationalSOC 2
An attestation report on controls for security, availability, confidentiality, processing integrity and privacy.
InternationalEU GDPR
The European Union regulation on processing personal data.
InternationalIEC 62443
A series of standards for securing industrial automation and control systems.
InternationalMITRE ATT&CK
A public knowledge base of real-world adversary tactics and techniques.
InternationalPakistan Information Security Framework (PISF)
The national information security framework issued by the National Cyber Emergency Response Team.
PakistanNational Cyber Security Policy
Pakistan’s national policy direction for securing cyberspace and critical information infrastructure.
PakistanPakistan Cloud First Policy
The policy that sets how government workloads move to cloud and how cloud providers are assessed.
PakistanPrevention of Electronic Crimes Act, 2016
The law that defines cyber offences and powers to investigate them.
PakistanPersonal Data Protection Bill
Pakistan’s draft data protection legislation. Confirm current status before relying on it.
PakistanSBP technology and cyber risk frameworks
Technology governance and cyber risk requirements for banks and financial institutions.
PakistanNCA Essential Cybersecurity Controls (ECC-2:2024)
Saudi Arabia’s baseline cybersecurity controls, issued by the National Cybersecurity Authority and revised in 2024.
Saudi ArabiaNCA Cloud Cybersecurity Controls (CCC-2:2024)
Controls for cloud services that extend the ECC, for both cloud service providers and their customers.
Saudi ArabiaNCA Critical Systems Cybersecurity Controls (CSCC)
Additional controls for systems whose failure would seriously affect national interests.
Saudi ArabiaNCA Operational Technology Cybersecurity Controls (OTCC-1:2022)
Controls for industrial and operational technology environments.
Saudi ArabiaNCA Data Cybersecurity Controls (DCC-1:2022)
Controls for protecting data through its life cycle, including classification, encryption and retention.
Saudi ArabiaNCA Telework Cybersecurity Controls (TCC)
Controls for securing remote working arrangements.
Saudi ArabiaNCA controls for private companies outside critical infrastructure (NCNICC-1:2025)
A control set issued in 2025 for private-sector companies that are not critical national infrastructure. Confirm scope with the NCA.
Saudi ArabiaSAMA Cyber Security Framework
Cybersecurity requirements for banks, insurers and other institutions regulated by the Saudi Central Bank.
Saudi ArabiaSaudi Personal Data Protection Law (PDPL)
Saudi Arabia’s data protection law, supervised by the Saudi Data and AI Authority.
Saudi ArabiaNDMO data management standards
Data governance, classification and localisation standards from the National Data Management Office.
Saudi ArabiaCloud Computing Regulatory Framework (CST)
Rules for cloud service providers and customers, including data classification and provider obligations. Confirm the current edition.
Saudi ArabiaUAE Information Assurance Regulation
The UAE national information assurance regulation for government entities and critical infrastructure operators.
GulfQatar National Information Assurance (NIA)
Qatar’s information assurance standard for government entities and critical information infrastructure.
GulfGulf data protection laws
The UAE, Bahrain, Oman and Qatar each have their own data protection law, with different rules on consent and cross-border transfer.
Gulf