Our practitioners read the controls document in Arabic and applied it in real Saudi entities.
This site uses cookies to improve your experience and analyze visits.
We apply the National Data Management Office controls: 15 domains, 77 controls, 191 specifications.
The National Data Management Office (NDMO) controls from the Saudi Data and AI Authority (SDAIA) govern how an entity runs its data. We start with a gap diagnostic against the 77 controls, then deliver policies that get enforced and DAM artifacts written in SDAIA's technical language. We run data classification at the four levels and walk the entity through the annual SDAIA audit to documented compliance.
Measure the entity against each of the 77 controls and flag missing documents.
Draft NDMO policies and stand up the data governance committee.
Inventory assets and classify them across the four levels.
Document current-state, future-state, and data flows.
Simulate the SDAIA assessment and assemble the annual evidence file.
Our practitioners read the controls document in Arabic and applied it in real Saudi entities.
The Data Reference Model (DRM) in NORA is handled by the same team, eliminating duplicated work.
Every DAM artifact references its control number, slotting straight into the SDAIA evidence file.
An entity starting from zero takes 16 to 24 weeks. An entity with old, unenforced policies takes 10 to 14 weeks. DAM artifacts alone run 8 to 16 weeks.
PDPL is a general law covering anyone who processes personal data. NDMO controls are a technical document for government entities covering 15 domains, 77 controls, and 191 specifications.
No. The two tracks are formally independent. But the Data Reference Model in NORA covers a real chunk of NDMO requirements, so running them in parallel removes major duplication.
An annual assessment in three stages: a self-assessment file, a technical document review, and sometimes an on-site visit. Results yield a compliance level per control and gaps to remediate.
No. We focus year one on the core domains: governance, classification, personal data protection, and data architecture and modeling. The rest goes into a documented roadmap.
A working session that walks through the NDMO controls one by one. You leave with a realistic gap list and a remediation timeline before the next SDAIA cycle opens.
Back to all services