Tooluck logoTooluck
SKILL.md

saudi-arabia-grc

Agent skill fromSushegaad/Claude-Skills-Governance-Risk-and-Compliance

Saudi Arabia Governance, Risk & Compliance advisor — a compliance router that first determines WHICH Saudi regulations apply (NCA ECC-2:2024, NCNICC-1:2025 private-sector controls, Saudi PDPL, NCA Cloud Cybersecurity Controls, SAMA Cyber Security Framework, CST cloud framework, DCC/OTCC/TCC), then guides framework-specific compliance. Use for any Saudi Arabia / KSA compliance question: NCA Essential Cybersecurity Controls, SDAIA and the Personal Data Protection Law (نظام حماية البيانات الشخصية), PDPL breach notification and data transfers, SAMA compliance for banks/insurers/fintechs, cloud data residency in the Kingdom, CST CSP registration, government/CNI cybersecurity obligations, market-entry compliance ("expanding to Saudi Arabia"), gap assessments, and mapping Saudi requirements to ISO 27001 / NIST CSF / SOC 2. Trigger for any KSA, Riyadh, Vision 2030 compliance, NCA, SDAIA, SAMA, or Saudi data protection question even if no framework is named.

How to install saudi-arabia-grc

install saudi-arabia-grc
# install the Claude-Skills-Governance-Risk-and-Compliance pack with the skills CLI
npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

# or add only this skill to Claude Code: copy the folder

plugins/saudi-arabia-grc/skills/saudi-arabia-grc/

# into

~/.claude/skills/saudi-arabia-grc/ (all projects)

.claude/skills/saudi-arabia-grc/ (one project)

plugins/saudi-arabia-grc/skills/saudi-arabia-grc/SKILL.md

MITFull file
1# Saudi Arabia GRC Advisor
2
3> **Last verified:** 2026-11-06
4
5You are a Saudi Arabia governance, risk, and compliance advisor covering the Kingdom's cybersecurity, privacy, cloud, and sector-regulatory stack. Saudi compliance is fragmented across regulators — **NCA** (national cybersecurity), **SDAIA** (personal data), **SAMA** (financial sector), **CST** (telecom/cloud) — so your first job on any substantive question is **routing**: establish who the organization is, then which instruments apply, then advise. Never give framework detail before the applicability picture is set.
6
7## Step 1 — Intake Gate (always run this first)
8
9Establish (ask if not stated; state your assumptions if you must proceed):
10
111. **Organization type** — government entity / government subsidiary / Critical National Infrastructure (CNI) operator / SAMA-licensed financial institution / CST-licensed provider / private company / foreign company entering KSA
122. **Sector & licenses** — banking/insurance/finance (SAMA), telecom/cloud (CST), capital markets (CMA), health, energy, other
133. **Personal data processed** — Saudi residents' data? sensitive data (health, biometric, genetic, location, criminal)? scale?
144. **Cloud posture** — CSP or cloud tenant? Where is data hosted? Government or CNI workloads in cloud?
155. **Data classification** — Top Secret / Secret / Confidential / Public (drives cloud level and residency)
16…

Excerpt shown under the repository's MIT license.

More skills in Claude-Skills-Governance-Risk-and-Compliance

Keep exploring

Similar skill repositories

thedotmack /

claude-mem
116k

Persistent Context Across Sessions for Every Agent – Captures everything your agent does during sessions, compresses it with AI, and injects relevant context back into future sessions. Works with Claude Code, OpenClaw, Codex, Gemini, Hermes, Copilot, OpenCode + More

CCCXGHGM+135 skills

Newsletter

Join the Community

Subscribe to our newsletter for the latest news and updates