Aligned to NCA · SAMA · PDPL
Cybersecurity & PDPL Compliance for Saudi Companies
Audit-Ready in Days, Not Months
NCA, SAMA, SDAIA, your partner banks and your largest clients all ask for the same thing: written evidence of compliance, meaning gap assessments, policies and procedures. We write it for your company against NCA, SAMA and PDPL requirements, at a fixed price, delivered in 7 to 28 days.
Fixed USD pricing · Reply within 2 business hours · US-registered company
Maximum Fine Under NCA Rules
25,000,000
SAR + Licence or Activity Suspension + Public Disclosure
vs. our NCNICC package
Your Investment
$5,000
Less than 0.08% of your potential fine exposure
✓ Any auditor finding on our documents within 12 months is fixed free
Why Compliance Matters
The Difference Compliance Makes
Without a Compliance File
✗Fines up to SAR 25 million under NCA rules
✗Licence or activity suspension
✗Lost tenders and clients that require proof of compliance
✗Public disclosure of violations
✗Stalled bank and partner security reviews
✗PDPL fines up to SAR 5 million, doubled for repeat violations
With WaqiSec
✓Documented evidence when a regulator inspects or asks
✓A ready file for tender requirements and vendor reviews
✓Organized, audit-ready documentation
✓Delivered in 7 to 28 days, depending on the package
✓Higher trust from clients and investors
✓Free fixes for any audit finding within 12 months
Our Proprietary Methodology
The 5-Phase Cyber Sentinel System™
We don't sell generic templates. Every document is built for your company against the exact NCA, SAMA or PDPL requirements that apply to you.
01
Days 1-3
Sentinel Scan™
Map the exact frameworks that apply to your company (NCA, SAMA, PDPL)
02
Days 3-6
Threat Blueprint™
Gap analysis across every applicable control, scored red, amber or green
03
Days 5-10
Compliance Forge™
Build all policy documents customized for your company
04
Days 8-12
Shield Deployment™
Remediation roadmap and staff training deck delivered
05
Days 12-14
Audit Armor™
Complete compliance dossier and audit readiness letter
Packages
Choose the Right Package
Fixed transparent pricing. No custom quotes. No surprises. WhatsApp us to confirm your company size and right package before payment.
★ Start Here
Personal Data Protection Law
PDPL Starter
For any company in Saudi Arabia that collects customer or employee personal data · All sectors
$1,500
Fixed price · 7-day delivery · Arabic + English included
⚡ Delivered in 7 days
The fastest way to cover the core requirements of Saudi Arabia's Personal Data Protection Law (PDPL), and a natural first step before a full compliance bundle.
- ✓Public privacy notice for your website or app (PDPL-aligned)
- ✓Records of Processing Activities (RoPA)
- ✓Personal data breach procedure, including 72-hour SDAIA notification
- ✓Data subject rights procedure (access, correction, deletion)
- ★FREE: All documents in both Arabic and English
Or choose a full compliance bundle
Private Sector
NCNICC Bundle
Private companies in Category B: 6–249 employees · All sectors
$5,000
Fixed price · Up to 249 employees · Single location · Starts within 24 hours
⚡ SUPERFAST DELIVERY — Half the time!
7 days instead of 14 — at double price
✓ New price: $10,000 · Delivery: 7 days
⚡ Guaranteed 14-day delivery
📄 All documents delivered in English — Arabic translation available as add-on
- ✓NCNICC-1:2025 Gap Analysis Report (comprehensive, all controls)
- ✓Information Security Policy (CEO-signed)
- ✓Acceptable Use Policy
- ✓Incident Response Plan
- ✓90-Day Remediation Roadmap (week-by-week)
- ✓Staff Security Awareness Training Deck (25 slides)
- ✓WaqiSec compliance status letter for tender files
- ★FREE: 12-month NCA regulatory update alerts
- ★FREE: 30-min implementation kickoff call after delivery
⭐ Best for Tenders
Critical Infrastructure
ECC Bundle
Government entities · Critical infrastructure operators and their suppliers · Up to 500 employees
$10,000
Above 500 employees or 2+ locations: custom pricing via WhatsApp
⚡ SUPERFAST DELIVERY — Half the time!
10 days instead of 21 — at double price
✓ New price: $20,000 · Delivery: 10 days
⚡ Guaranteed 21-day delivery
📄 All documents delivered in English — Arabic translation available as add-on
- ✓Everything in NCNICC Bundle (7 documents)
- ✓NCA ECC-2:2024 Gap Analysis — all 108 main controls across 4 domains
- ✓Data Classification Policy
- ✓Access Control Policy (MFA + user lifecycle)
- ✓Vendor Risk Management Policy
- ✓Business Continuity Policy
- ✓Remote Work Security Policy
- ★FREE: Vendor Risk Questionnaire for top 5 suppliers
Financial Sector
SAMA Bundle
Fintechs · Payment and finance companies · SAMA sandbox participants · Up to 200 employees
$15,000
Above 200 employees or 2+ locations: custom pricing via WhatsApp
⚡ SUPERFAST DELIVERY — Half the time!
14 days instead of 28 — at double price
✓ New price: $30,000 · Delivery: 14 days
⚡ Guaranteed 28-day delivery
📄 All documents delivered in English — Arabic translation available as add-on
- ✓Everything in NCNICC & ECC Bundles (15 documents)
- ✓SAMA CSF Gap Analysis — all 4 domains
- ✓SAMA Cybersecurity Controls Checklist
- ✓Third-Party Risk Assessment Questionnaire (40 questions)
- ✓Customer Data Protection Procedures
- ✓SAMA Incident Reporting Procedure
- ✓Data Retention and Deletion Policy
- ✓60-Day Post-Delivery Support Retainer
- ★FREE: Priority SAMA regulatory update alerts
Optional Add-Ons
Add-Ons Available for Any Bundle
Full Arabic Translation Package
Professional Gulf Arabic translation of all bundle documents — one flat fee covering all documents regardless of quantity.
$1,000
PDPL Compliance Add-On
The 4 PDPL Starter documents at a reduced price when added to any bundle: privacy notice + processing records + breach procedure + data subject rights.
$1,000 instead of $1,500
AI Governance Policy
AI usage policy + risk assessment + human oversight procedures. Aligned to SDAIA framework.
$800
Quarterly Review Retainer
Every 3 months: regulatory update review, document updates, and management status report.
$500 / quarter
Incident Response Simulation
Tabletop exercise scenario testing your incident response plan. Includes facilitator guide and debrief template.
$400
Extra Location Pack
For companies with multiple offices or branches — location-specific policy addendums for each site.
$300 /location
Employee Security Cards
One-page security reference card per role type (IT, Finance, General Staff, Management).
$200
Written Guarantees
The Triple Shield Guarantee™
Three clear guarantees with fixed time limits, so you can decide with confidence.
SHIELD 01 · 12 MONTHS
The Compliance Fix Guarantee™
If, within 12 months of delivery, an auditor or regulator (NCA, SAMA or SDAIA) finds that any document we delivered doesn't meet the agreed framework's requirements, we correct and redeliver it free within 10 business days.
SHIELD 02 · 90 DAYS
The Rapid Response Guarantee™
If you receive a regulator's inquiry or notice within 90 days of delivery that relates to the documents we prepared, we prepare the documentation updates and responses you need, free, within 3 business days.
SHIELD 03 · 14 DAYS
The Satisfaction Revision Guarantee™
Review the package within 14 days of delivery. We revise anything you flag, free, for up to 2 revision rounds, each returned within 5 business days.
Guarantees cover the documents within the agreed scope. They don't cover implementing technical controls or regulators' decisions.
How It Works
4 Simple Steps to Full Compliance
01
WhatsApp Us
Tell us your employee count and sector. We confirm the right package for free within 2 hours.
02
Pay Deposit & Complete Intake
50% deposit via your custom payment link. You receive the company intake questionnaire.
03
We Start Within 24 Hours
45-min kickoff call then our team starts immediately. Weekly WhatsApp progress updates.
04
Delivery & Full Walkthrough
Complete package delivered. 60-min walkthrough call. Pay the balance. You're audit-ready.
💬 How WhatsApp Communication Works
Step 1
Free Consultation
We identify your needs and send a customized quote
Step 2
Custom Invoice
We send a professional invoice with secure payment link (50% deposit)
Step 3
Regular Updates
Every Wednesday: progress update + any questions you have
Step 4
Final Delivery
Google Drive link + walkthrough call + balance invoice
Free Guides
Understand What Regulators Require Before You Spend Anything
NCA · 2025
NCNICC-1:2025: NCA Private-Sector Controls
Who must comply, Category A vs B, the 65 controls and penalties.
PDPL · SDAIA
Saudi PDPL Compliance Guide + Checklist
Privacy notice, records of processing, 72-hour breach notice and fines.
SAMA · FINTECH
SAMA Cyber Security Framework for Fintechs
4 domains, maturity Level 3 and sandbox requirements.
NCA · ECC
NCA ECC-2:2024: The Complete Guide
Who must comply, the 4 domains and what changed from 2018.
PDPL · PRIVACY
PDPL Privacy Policy Requirements
What your privacy notice must include, with a structure and common mistakes.
PDPL · 72 HOURS
PDPL Breach Notification: The 72-Hour Rule
When and how to report, what to include and a step-by-step procedure.
FAQ
Common Compliance & PDPL Questions
Is my company required to follow NCA cybersecurity controls?
▼Most likely. NCA's private-sector controls (NCNICC-1:2025) apply to private companies in Saudi Arabia that aren't classified as critical national infrastructure, in two categories. Category A (250+ employees or revenue above SAR 200M) applies all 65 controls. Category B (6–249 employees or SAR 3–200M revenue) applies 26 mandatory controls. Government entities and critical infrastructure operators follow ECC-2:2024 instead. Message us your headcount and sector and we'll confirm which applies within 2 hours.
What is the PDPL, and does it apply to my company?
▼Saudi Arabia's Personal Data Protection Law has been enforced since 14 September 2024 and covers any organization that processes personal data of individuals in the Kingdom: customers, employees or users. Fines reach SAR 5 million and double for repeat violations, and data breaches must be reported to SDAIA within 72 hours. Our PDPL Starter covers the core documents in 7 days.
Do I get an official compliance certificate?
▼No. NCNICC is not a certification scheme, and NCA doesn't issue certificates for it. What you need is documented evidence: the gap assessment, policies, procedures and records you show when NCA, a regulator, a partner bank or a major client asks. That is exactly what we deliver.
Do you implement technical controls, or only write documents?
▼We deliver the documentation and a prioritized remediation roadmap. Your IT team or provider implements the technical controls (such as MFA and monitoring), and we walk them through every step on the handover call.
You are a US company — can you serve Saudi companies?
▼Yes. WaqiSec is a trading name of Vintago LLC, a US-registered company. We work fully remotely: WhatsApp, email and video calls, with delivery through a secure Google Drive link. Remote advisory work for clients in the Kingdom is common practice among international consultancies.
Why not ask an audit firm to do the compliance directly?
▼Auditors assess your documents; they don't write them. The auditor is the examiner, we are the preparation course. Starting an assessment with your documentation in place means you begin with evidence, not a long list of gaps and extra follow-up visits.
What language are the documents in?
▼The PDPL Starter includes Arabic and English. NCNICC, ECC and SAMA bundles are delivered in English, with full Arabic translation available as a flat-fee add-on.
Do you work white-label for IT and consulting firms?
▼Yes. We prepare documents under your brand for your clients, and you keep the client relationship and the margin. WhatsApp us for partner pricing.
How can I pay and what are the terms?
▼WhatsApp us first. We confirm what you need and send an invoice with a secure payment link. You pay 50% before work starts and the balance on delivery, in USD by card or bank transfer. No price surprises.
Ready to Get Your Compliance File in Place?
Book a free WhatsApp consultation. We will tell you exactly which frameworks apply to your company, what is required, and how long it will take. No sales pressure — just complete clarity.
Typical response time: within 2 business hours