Guide · International frameworks
ISO 27001, SOC 2, PCI DSS and GDPR alongside Saudi rules
For Saudi firms with foreign clients: which international frameworks appear next to the NCA controls and the PDPL, and how to run one program instead of five.
Last verified against official sources: 26 September 2026
| Framework | What it is | When it matters for a Saudi firm |
|---|---|---|
| ISO/IEC 27001 | A certifiable standard for an information security management system | European, regional and enterprise clients that expect certification. It maps well to the ECC but does not replace it. |
| SOC 2 | A US attestation against the AICPA Trust Services Criteria | Selling software or services to North American buyers |
| PCI DSS | The card industry's data security standard | Any entity that stores, processes or transmits cardholder data. The SAMA framework requires banks to comply with PCI DSS, EMV and the SWIFT Customer Security Controls Framework, and other SAMA-regulated institutions to apply PCI DSS where they handle cardholder data. |
| NIST CSF 2.0 | A US framework organized as Govern, Identify, Protect, Detect, Respond and Recover | A common language with US partners and parent companies |
| EU GDPR | The European Union's data protection regulation | Offering goods or services to people in the EU, or monitoring their behavior. You may be subject to both the GDPR and the PDPL. |
| EU DORA | Digital operational resilience rules for EU financial entities | Serving EU financial institutions as an ICT provider, usually through contract terms |
Run one program, not five
Each framework asks for many of the same things: governance, access control, supplier management, incident response and evidence. Build one control set, map it to every framework you must meet, and collect each piece of evidence once. When a new client asks for SOC 2 or ISO/IEC 27001, most of the work is already done.
A sensible order
- Meet the Saudi requirements that apply to you first: the Personal Data Protection Law, and the NCA or SAMA frameworks if you are in scope.
- Add the international framework your largest clients ask for, mapped to the same controls.
- Keep one evidence library and one calendar for reviews, audits and renewals.
AccuSights is an independent cybersecurity and compliance firm. We are not affiliated with, endorsed by, or acting for the NCA, SDAIA, SAMA, CST, DGA or any other authority. This site is general information, not legal advice. The regulator has the final say on what a rule requires and whether you meet it; we help you interpret, scope, close gaps and stay ready. Always confirm current requirements against the official source.
Sources
- ISO, ISO/IEC 27001 information security management (opens in a new tab)
- AICPA, System and Organization Controls reports, including SOC 2 (opens in a new tab)
- PCI Security Standards Council, PCI DSS (opens in a new tab)
- NIST, Cybersecurity Framework 2.0 (opens in a new tab)
- EUR-Lex, General Data Protection Regulation (EU) 2016/679 (opens in a new tab)
- EUR-Lex, Digital Operational Resilience Act (EU) 2022/2554 (opens in a new tab)
- NCA, Essential Cybersecurity Controls (ECC-2:2024) (opens in a new tab)
- SAMA Rulebook, Cyber Security Framework (opens in a new tab)