Your posture against the frameworks the regulator actually asks for.
Upload the firewall, cloud, and identity configs you already run. CyberTwin scores them against the Kingdom’s and the Gulf’s binding frameworks — NCA ECC, CCC, CSCC and OTCC, SAMA CSF, PDPL, UAE IA and DESC — and builds the evidence your risk committee files, with every control labeled proven, observed or modeled.
Essential Cybersecurity Controls — the baseline for KSA government + CNI entities.
Cloud Cybersecurity Controls — for cloud service providers and tenants.
Critical Systems Cybersecurity Controls — the higher bar for critical systems.
Operational Technology Controls — plant-floor / ICS environments.
The central bank framework binding every KSA financial institution.
Saudi Arabia’s PDPL and the UAE’s PDPL (Federal Decree-Law 45/2021): two separate national data-protection laws, each scored on its own.
UAE Information Assurance standard for government + regulated entities.
Dubai Electronic Security Centre standard for Dubai government entities.
Part of the 24 frameworks CyberTwin scores. Every control is labeled proven from your config or modeled from a crosswalk — a score built only on derived mappings is capped, because a crosswalk never masquerades as an audit.
The evidence your risk committee files.
A quarterly posture summary built from your snapshot series — the document your risk committee files, not just a score on a dashboard.
WHICH PLAN SHIPS WHICH REPORTPer-control coverage with a proven-vs-modeled provenance stamp on every line, so an assessor sees show-me evidence, not a self-attestation.
SAMPLE AUDIT-EVIDENCE PACK (PDF)Building new or upgrading? Pick the NCA ECC or SAMA CSF starting point, declare your crown jewels, platform and budget, and get a plan to put in front of your committee: a target architecture with segmented zones, a check for attack paths through it, the controls it touches, the products to buy priced against your budget, and a draft FortiGate config your team reviews and applies. All of it is labeled modeled — an assessor still needs your process and evidence.
WHAT A DESIGN INCLUDESDollar-quantified exposure, the top moves, and the one thing — present it live or export the editable slide deck for the board.
SAMPLE BOARD PACK (PDF)Every finding points back to the file you uploaded, and every figure says whether it is proven, observed or modeled — so when an assessor asks “show me,” the answer is already on the page. Anyone can re-check a proof bundle at /verify.
RE-VERIFY A PROOF YOURSELFAll generated from configs you already have — 1,913 deterministic checks across 37 vendors. No agent, no live scan, nothing fabricated. Decision support for your compliance function — never a filing determination or an accreditation CyberTwin holds.