RSA Archer NCA ECC Checklist | Sahl
The Short Answer
Archer, formerly known as RSA Archer, is a configurable governance, risk, and compliance (GRC) platform. But for Saudi organizations, the key question is not simply whether a platform can support compliance. It is whether the required regulatory frameworks are available as maintained content, how easily evidence can be reused, and how much ongoing configuration your team must manage.
If your organization needs to manage NCA Essential Cybersecurity Controls (ECC), the SAMA Cyber Security Framework (CSF), and applicable Personal Data Protection Law (PDPL) obligations, use this checklist to evaluate Archer and compare it with other GRC platforms, including Sahl.
Always confirm framework versions, licensing, available content, and update commitments directly with each vendor before making a decision.
Why Saudi Compliance Requirements Matter
Saudi organizations may need to manage overlapping cybersecurity, risk, privacy, and audit obligations. However, each framework has its own structure and assessment requirements.
- NCA ECC-2:2024: The updated Essential Cybersecurity Controls introduce changes to the control structure and scope compared with ECC-1:2018. Confirm that your platform supports the applicable edition and maps controls to the correct requirements.
- SAMA CSF: Organizations subject to the framework need visibility into control implementation and maturity, including gaps against their target maturity levels.
- PDPL: Privacy compliance involves obligations relating to personal data processing, data subject rights, consent where applicable, and personal data breach management.
These requirements can overlap in areas such as access control, incident management, and logging. Mapping shared controls across frameworks can reduce duplicated work, improve visibility, and help teams prepare for assessments more efficiently.
The goal is to maintain traceable evidence for each applicable requirement—not simply to store a list of controls in a dashboard.
The Seven-Point GRC Platform Verification Checklist
Use these questions during your Archer demo or when evaluating any alternative GRC platform.
1. Verify Framework Content and Versioning
Ask the vendor:
- Are NCA ECC-2:2024, SAMA CSF, and applicable PDPL requirements available as ready-to-use content?
- Are the mappings maintained when regulatory requirements change?
- Can the platform identify which framework version a control is mapped against?
- Are framework content and updates included in the quoted license, or do they require additional services?
What to look for: A clear explanation of content availability, version management, update frequency, and any implementation work required from your team.
2. Check Control-Level Visibility
A framework dashboard is useful, but compliance teams also need to investigate individual controls.
Verify whether a single control view displays:
- Control owner and implementation status
- Applicable framework requirements
- Linked policies and procedures
- Supporting evidence and review dates
- Identified gaps and remediation actions
What to look for: A traceable connection between the requirement, the responsible owner, the supporting evidence, and the latest assessment.
3. Test Evidence Collection and Automation
Evidence collection can become a major operational burden when teams rely on spreadsheets, email requests, and repeated manual uploads.
Ask the vendor to demonstrate:
- Which evidence sources can be connected automatically
- Which integrations are available out of the box
- Which evidence must be uploaded or reviewed manually
- How evidence freshness, ownership, and collection failures are tracked
What to look for: A live demonstration using your own evidence samples rather than a generic automation overview.
4. Evaluate SAMA CSF Maturity Tracking
If SAMA CSF applies to your organization, confirm that the platform supports the maturity assessment process your team needs.
Ask whether you can:
- Record maturity assessments by domain
- Set target maturity levels
- Identify gaps between current and target maturity
- Assign remediation actions and track progress
- Generate reports for management and relevant stakeholders
What to look for: A practical view of current maturity, target maturity, and outstanding actions—not merely a percentage-complete indicator.
5. Confirm Cross-Framework Control Reuse
A single implemented control may support requirements across several applicable frameworks. Without proper mapping, teams can end up maintaining separate records and requesting the same evidence repeatedly.
Ask the vendor to demonstrate how one control and its evidence can be mapped to multiple requirements across NCA ECC, SAMA CSF, and PDPL.
What to look for: Shared evidence with clear framework-specific mappings, while preserving the distinct assessment criteria and obligations of each framework.
6. Review Audit Exports and Evidence History
A platform should help your team explain not only whether a control is implemented, but also how that conclusion was reached.
Verify whether it can export an audit-ready evidence package containing:
- Relevant controls and framework mappings
- Supporting evidence and timestamps
- Control ownership and assessment status
- Review history and remediation records
- A clear record of outstanding gaps
What to look for: Reports that auditors and internal stakeholders can understand without extensive manual formatting.
7. Measure Implementation and Ongoing Effort
A platform’s feature list does not tell you how much work your team will need to keep it running.
Ask:
- Who configures and maintains the framework mappings?
- What technical or specialist resources are required?
- How much effort is needed to onboard the first set of controls?
- What ongoing work is required for updates, evidence reviews, and reporting?
- Which services or integrations incur additional costs?
What to look for: A realistic implementation plan, clearly defined responsibilities, and a transparent view of recurring operational effort.
Run a Proof of Concept Before You Decide
The most useful way to compare Archer with another GRC platform is to test both against the same requirements.
Choose ten representative controls from your environment and provide each shortlisted vendor with the same sample evidence.
Evaluate each platform against these criteria:
| Test | What to Measure |
|---|---|
| Framework mapping | Accuracy and completeness of requirement mappings |
| Setup effort | Time and specialist input required |
| Evidence reuse | Whether shared evidence supports multiple mappings |
| Automation | Which collection tasks run automatically |
| Gap tracking | How clearly outstanding actions are identified |
| Reporting | Effort required to produce a usable audit package |
| Maintenance | Work needed to keep mappings and evidence current |
Use the results to identify the platform that best fits your regulatory scope, internal capabilities, budget, and reporting needs.
How Sahl Fits These Requirements
Sahl is an AI-powered GRC platform built for organizations operating across the Middle East and North Africa. For Saudi teams evaluating alternatives to Archer, the focus is on managing compliance requirements, risk visibility, and evidence in one platform.
Sahl’s relevant capabilities include:
- Saudi framework mapping: Pre-mapped NCA ECC, SAMA CSF, and PDPL requirements, alongside frameworks such as ISO 27001 and SOC 2.
- Cross-framework mapping: Connect shared controls with relevant requirements to reduce duplicate evidence handling.
- Evidence collection and dashboards: Improve visibility into compliance status, evidence, and outstanding gaps.
- AI DPO assistant: Support privacy-related workflows and data protection activities.
- Built-in DAST scanner: Support application security testing as part of a broader risk and compliance workflow.
- Centralized compliance management: Give teams a shared view of controls, risks, and compliance activities.
The right fit still depends on your organization’s regulatory scope, existing tools, integration needs, and implementation requirements. During a Sahl demo, ask the team to walk through your actual controls and demonstrate how the required mappings, evidence workflows, and reports operate.
Archer vs Sahl: Saudi Compliance Evaluation
| Evaluation Area | Archer | Sahl |
|---|---|---|
| Saudi framework content | Confirm availability, versions, and licensing | Pre-mapped Saudi frameworks; verify the required scope |
| NCA ECC-2:2024 alignment | Confirm current content and mapping | ECC-2:2024-aligned mapping |
| SAMA CSF maturity tracking | Validate during a demo | Validate the required maturity workflow |
| PDPL requirements | Confirm ready-to-use content or configuration needs | Pre-mapped PDPL requirements |
| Evidence collection | Confirm available integrations and automation | Continuous evidence collection capabilities |
| Cross-framework mapping | Test with shared controls | Cross-framework mapping capabilities |
| Audit reporting | Test exports and review history | Audit reporting capabilities |
| Implementation effort | Assess configuration and resource needs | Assess onboarding and operational effort |
Important: Features, integrations, framework content, and licensing can vary by edition and implementation. Validate each item with the vendor and test it against your organization’s requirements before making a purchasing decision.
Frequently Asked Questions
Archer is a configurable GRC platform. Before purchasing, confirm whether the specific NCA ECC edition your organization requires is available as maintained content or needs to be configured and mapped separately.
Ask the vendor to demonstrate how the proposed solution represents SAMA CSF requirements, records assessments, tracks maturity where applicable, and reports gaps against target levels.
A configurable GRC platform can be used to model privacy requirements, but the level of ready-to-use PDPL content varies. Confirm the available mappings, update process, and privacy workflows rather than assuming that general configuration equals a maintained compliance content pack.
Start by confirming framework versioning, control-level traceability, evidence collection, cross-framework mapping, audit reporting, and ongoing maintenance effort. Then run a proof of concept using representative controls from your environment.
Sahl provides NCA ECC mapping aligned with ECC-2:2024. Ask for a demonstration of the specific controls and mappings relevant to your organization, and verify that the available coverage meets your compliance scope.
Not necessarily. The decision depends on your existing investment, current configuration, internal expertise, regulatory requirements, and total cost of ownership. Compare the effort of maintaining your existing environment with the capabilities and implementation needs of the alternatives.
Final Thoughts
For Saudi compliance teams, choosing a GRC platform is about more than a framework checklist. The platform must support accurate regulatory mappings, traceable evidence, meaningful assessments, and manageable ongoing work.
Whether you choose Archer or evaluate Sahl, test the solution against your own NCA ECC, SAMA CSF, and PDPL requirements before committing.
Ready to see how Sahl fits your compliance workflow? Book a demo with Sahl and evaluate the platform against your own controls.
