Jethur for NCA ECC, SAMA CSF & PDPL: Saudi Checklist | Sahl
The Short Answer
Jethur is a broad GRC, cybersecurity, business continuity, and audit platform with Saudi roots. However, for Saudi organizations, the key consideration is how NCA ECC, SAMA CSF, and PDPL requirements are delivered and maintained.
Are these frameworks available as ready-to-use compliance content, or must your team build and maintain the relevant mappings?
This checklist helps you evaluate Jethur and other GRC platforms against your organization’s compliance needs. Before making a decision, confirm framework availability, supported versions, and licensing directly with each vendor.
Why the Saudi Details Matter
Saudi compliance requirements continue to evolve. Therefore, selecting a GRC platform requires more than checking whether it supports a particular framework.
- NCA ECC-2:2024: The updated Essential Cybersecurity Controls framework introduces a revised structure with four main domains and 108 main controls. It also excludes ICS/OT controls from the ECC framework. Consequently, organizations should verify that their compliance libraries reflect the current edition rather than relying on outdated mappings.
- SAMA CSF: The Saudi Central Bank’s Cyber Security Framework uses maturity-based assessments. As a result, organizations need visibility into maturity levels, domain-level gaps, and progress toward their target maturity.
- Saudi PDPL: The Personal Data Protection Law introduces obligations relating to consent, data subject rights, and personal data breach notifications. These requirements must connect with relevant privacy processes and security evidence.
Although these frameworks have different objectives, they overlap in areas such as access management, incident response, and logging. Therefore, reusable evidence and cross-framework mapping can help reduce repetitive compliance work.
The Seven-Point Verification Checklist
Before selecting a GRC platform, evaluate the following seven areas during a product demonstration.
1. Framework Content
Does the platform provide maintained content for NCA ECC-2:2024, SAMA CSF, and Saudi PDPL?
Additionally, ask how framework updates are delivered when regulatory requirements change. Determine whether updates are included in your subscription or require additional configuration.
2. Control-Level Visibility
Can your team view each control alongside its owner, implementation status, linked policy, and supporting evidence?
A centralized control-level view helps teams identify gaps and manage responsibilities more efficiently.
3. Evidence Automation
Which evidence sources does the platform collect automatically, and which require manual uploads?
For example, request a live demonstration of evidence collection from an actual system. This will help you understand the platform’s automation capabilities and the remaining manual workload.
4. SAMA Maturity Tracking
Does the platform track maturity by domain and compare current performance against your target maturity level?
Furthermore, check whether it provides clear visibility into maturity gaps and remediation progress.
5. Cross-Framework Evidence Reuse
Can one piece of evidence support multiple applicable frameworks?
For instance, evidence related to access management may support requirements across NCA ECC, SAMA CSF, and ISO 27001. Reusing this evidence can reduce duplication and simplify compliance reviews.
6. Audit-Ready Reporting
Can the platform export an auditor-ready package containing dated evidence, control mappings, and review history?
In addition, verify whether reports can be customized to meet your organization’s internal audit and regulatory reporting needs.
7. Implementation Effort and Scope
How long does it take to create the first useful control mapping?
Also, evaluate whether the platform includes modules beyond your immediate compliance requirements. A broader platform may offer additional capabilities, but your organization should understand the implementation effort, licensing structure, and operational scope before committing.
Run a Proof of Concept on Your Own Controls
A structured proof of concept (PoC) provides a more practical evaluation than a standard product demonstration.
To make the comparison meaningful, give each shortlisted vendor the same ten controls and supporting evidence samples.
Then, measure:
- Initial setup and configuration time
- Accuracy of framework and control mappings
- Evidence collection and reuse capabilities
- Remaining manual work
- Reporting quality and audit readiness
This approach helps your team evaluate the actual workflow rather than relying solely on feature lists.
How Sahl Fits the Checklist
Sahl is an AI-powered GRC platform designed to help organizations manage compliance, cybersecurity risks, and regulatory requirements across Saudi Arabia and the wider MENA region.
For organizations evaluating Saudi framework coverage, Sahl offers:
- NCA ECC, SAMA CSF, and PDPL mapping: Pre-mapped compliance content, alongside ISO 27001 and SOC 2.
- Cross-framework mapping: Reuse relevant evidence across multiple applicable frameworks.
- Continuous evidence collection: Support compliance monitoring through evidence collection and real-time dashboards.
- AI DPO Assistant and built-in DAST scanner: Bring privacy assistance and application security testing capabilities into the same platform.
- Compliance-focused onboarding: Support a more streamlined implementation approach centered on compliance workflows.
These capabilities make Sahl an option worth evaluating for teams prioritizing Saudi framework alignment and compliance management.
Jethur vs Sahl: Saudi Compliance Checklist
The following table highlights areas Saudi organizations should evaluate when comparing Jethur and Sahl.
| Checklist Item | Jethur | Sahl |
|---|---|---|
| Saudi framework content | Verify availability | Native, pre-mapped |
| Current ECC version | Confirm ECC-2:2024 coverage | ECC-2:2024 aligned |
| Evidence automation | Verify available integrations | Continuous evidence collection |
| Cross-framework reuse | Verify during demo | Supported |
| Audit pack export | Confirm capabilities | Supported |
| Platform scope | Broad GRC and cybersecurity | Compliance-focused GRC |
Note: Confirm the latest framework coverage, integrations, and feature availability directly with the respective vendors before making a purchasing decision.
For a broader comparison, see Jethur vs Sahl. You can also explore the NCA ECC-2:2024 guide.
Frequently Asked Questions
Organizations evaluating Jethur should confirm whether NCA ECC-2:2024 is available as ready-to-use framework content. Additionally, ask how control mappings and framework updates are maintained.
Verify SAMA CSF and PDPL coverage directly with the vendor. During the demonstration, ask to see maturity tracking, privacy-related workflows, and evidence reuse using your organization’s own controls.
Run a proof of concept using the same ten controls and evidence samples across shortlisted platforms. Compare setup time, mapping accuracy, evidence automation, and the amount of manual work required.
Sahl provides native NCA ECC mapping aligned with ECC-2:2024. Organizations can evaluate its framework coverage, evidence workflows, and compliance management capabilities during a product demonstration.
Evaluate Your Saudi Compliance Requirements with Sahl
Choosing a GRC platform involves more than reviewing its feature list. Saudi organizations should verify framework versions, evidence reuse, maturity tracking, and implementation effort before making a decision.
Use this checklist during your next vendor demonstration to understand how well the platform supports your compliance requirements.
Book a Demo with Sahl and evaluate the checklist using your own controls and evidence.
