Practice 03
Governance, Risk & Compliance (GRC)
A security program, a risk register, and the evidence an auditor or a customer will ask to see.
Why it matters
A regulator, customer, or auditor wants evidence, and the program exists mostly on paper.
Compliance work fails when it is a binder nobody uses. We build the governance, the risk process, and the control evidence so the same documents serve the review and the people who run the company.
The work is implementation and audit readiness for the frameworks listed on this page. When a certificate is required, an accredited certification body issues it. We do not certify you.
Where a technical test is the fastest way to know if a control is real, the assessment practice does that test. The paperwork does not outrun the facts.
Who it is for
Leaders preparing for an audit, a customer security questionnaire that has become a project, or the first version of a program that has to last.
Risks it addresses
- An audit or regulator deadline without the evidence to meet it
- Policies that exist on paper but are not followed
- Risk decisions without named owners
What is in scope
- vCISO
- Cyber risk assessment
- Gap assessment and audit readiness
- Policy and procedure development
- Third-party risk
- Business continuity and DR planning
- Internal ISMS audit
- PCI DSS compliance
International
- ISO/IEC 27001
- ISO/IEC 27701
- ISO 22301
- PCI DSS
- SOC 2
- NIST CSF
- CIS Controls
- GDPR
Egyptian obligations
- Central Bank of Egypt cybersecurity framework
- Personal Data Protection Law 151 of 2020
- FRA requirements
- NTRA requirements
Saudi frameworks
- NCA Essential Cybersecurity Controls (ECC)
- NCA Cloud Cybersecurity Controls (CCC)
- SAMA Cyber Security Framework
- Saudi PDPL (SDAIA)
Certifications held by members of our team
These certifications are held by members of our team. They are not company accreditations.
- OSCP
- OSEP
- OSWE
- OSCE
- CEH
- ECSA
- LPT
- eWAPTx
- CRTP
- CRTE
- CRTO
- CISA
- CISM
- CRISC
- ISO 27001 Lead Auditor
Cybersecurity for Banks, Government & Industry
Banking, payments, and fintech
Controls and evidence for payment and banking environments, including the Central Bank of Egypt cybersecurity framework, PCI DSS, and SAMA CSF where those obligations apply.
Technology and SaaS
A security program that can pass a customer review without burying a small team. ISO 27001 is the usual framework, and SOC 2 is named when a customer requires it.
Government and public sector
Governance, monitoring, and training for public bodies. The NCA Essential Cybersecurity Controls are named where that obligation applies.
Healthcare
Systems that hold personal data, including Egypt's Personal Data Protection Law where that obligation applies.
Oil, gas, and energy
Testing and monitoring for operational environments, including OT/ICS where that is in scope.
Insurance and non-bank finance
Governance and testing where FRA requirements apply, alongside the applications those firms run.
Retail and e-commerce
Customer-facing stores and payment flows, including PCI DSS where card data is in scope.
Methodology
How it runs
- 01
Obligation
Which framework, which customer, which deadline, and which systems are actually in scope.
- 02
Gap
What exists, what is paper only, and what is missing.
- 03
Build
Policies, risk decisions, and the controls that close the gaps that matter.
- 04
Show
Evidence packs, and someone in the room while the review is underway.
What you receive
A program, a risk register, and evidence that serve both the review and the people who run the company.
- A gap assessment against the framework in scope
- Policies and standards written so staff can follow them
- A risk register with owners and treatment decisions
- Evidence collection and support during the review
- A remediation plan with dates and names
After the engagement
Remediation plan and audit support
You receive a remediation plan with dates and names. Where a technical test is the fastest way to prove a control is real, the assessment practice performs it, and we stay with you while the review is underway.
How we stand behind the work
Commitments that apply to this practice.
Scope in writing
Systems, rules of engagement, and what done means are agreed before testing or monitoring starts.
Evidence over volume
Findings name the system, the condition, and the business consequence. A long list with no order is not a result.
No surprise in production
Assessment and defensive work is scheduled so operations stay up. Sensitive findings get a live channel, not a surprise in the final PDF.
Handover, not a drop
Briefings, retests, and retained support are part of the engagement. The report is not the end of the conversation.
Questions
Frequently asked questions
Which frameworks do you work with?
The frameworks are the international, Egyptian, and Saudi lists on this page. We prepare implementation and audit readiness. Certification is issued by an accredited body.
Do you just provide templates?
No. Policies and standards are written so your staff can follow them, and controls are checked against the facts.
Can you support us during the audit?
Yes. We prepare evidence packs and can be in the room while the review is underway.
Talk to our security experts
Discuss Governance, Risk & Compliance with a specialist.
A short brief is enough: the environment, the deadline, and whether you need a test, a control program, or coverage for the team.