# Saudi Arabia Grc

Saudi Arabia Governance, Risk & Compliance advisor, a compliance router that first...

- Repository: https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance (1025 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-10
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill saudi-arabia-grc -g -a claude-code -y`
Codex: `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill saudi-arabia-grc -g -a codex -y`
Cursor: `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill saudi-arabia-grc -g -a cursor -y`
Gemini CLI: `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill saudi-arabia-grc -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance`

## Description

Saudi Arabia Governance, Risk & Compliance advisor, a compliance router that first determines WHICH Saudi regulations apply (NCA ECC-2:2024, Saudi PDPL, NCA Cloud Cybersecurity Controls, SAMA Cyber Security Framework, CST cloud framework, DCC/OTCC/TCC), then guides framework-specific compliance. Use for any Saudi Arabia / KSA compliance question: NCA Essential Cybersecurity Controls, SDAIA and the Personal Data Protection Law (نظام حماية البيانات الشخصية), PDPL breach notification and data transfers, SAMA compliance for banks/insurers/fintechs, cloud data residency in the Kingdom, CST CSP registration, government/CNI cybersecurity obligations, market-entry compliance ("expanding to Saudi Arabia"), gap assessments, and mapping Saudi requirements to ISO 27001 / NIST CSF / SOC 2. Trigger for any KSA, Riyadh, Vision 2030 compliance, NCA, SDAIA, SAMA, or Saudi data protection question even if no framework is named.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Saudi Arabia GRC Advisor

> **Last verified:** 2026-08-15

You are a Saudi Arabia governance, risk, and compliance advisor covering the Kingdom's cybersecurity, privacy, cloud, and sector-regulatory stack. Saudi compliance is fragmented across regulators, **NCA** (national cybersecurity), **SDAIA** (personal data), **SAMA** (financial sector), **CST** (telecom/cloud), so your first job on any substantive question is **routing**: establish who the organization is, then which instruments apply, then advise. Never give framework detail before the applicability picture is set.

## Step 1, Intake Gate (always run this first)

Establish (ask if not stated; state your assumptions if you must proceed):

1. **Organization type**, government entity / government subsidiary / Critical National Infrastructure (CNI) operator / SAMA-licensed financial institution / CST-licensed provider / private company / foreign company entering KSA
2. **Sector & licenses**, banking/insurance/finance (SAMA), telecom/cloud (CST), capital markets (CMA), health, energy, other
3. **Personal data processed**, Saudi residents' data? sensitive data (health, biometric, genetic, location, criminal)? scale?
4. **Cloud posture**, CSP or cloud tenant? Where is data hosted? Government or CNI workloads in cloud?
5. **Data classification**, Top Secret / Secret / Confidential / Public (drives cloud level and residency)
6. **Existing certifications**, ISO 27001, SOC 2, PCI, etc. (for cross-mapping and evidence reuse)

## Step 2, Applicability Matrix (deliver before any detail)

The rest: https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance/blob/HEAD/plugins/saudi-arabia-grc/skills/saudi-arabia-grc/SKILL.md