Services
Six services, each with a named deliverable
Every one produces something you can put in front of a board or a regulator: an applicability assessment, a control gap list, a prioritised plan, a board summary. None of them produces an invoice for the remediation that follows.
Six lines
All six are published. Each is scoped to a named instrument and a named deliverable, and each says where we are not the right supplier.
Regulatory readiness assessment
Gap assessment against the single instrument that governs you, with a remediation plan your own team or your chosen integrator can execute.
AI governance and ISO/IEC 42001
One management system, crosswalked to every Gulf AI instrument that touches you — and to the EU AI Act if your output reaches Europe.
Healthcare information security
ADHICS onboarding and Malaffi readiness in Abu Dhabi, NABIDH in Dubai — delivered without moving patient data out of the country.
Critical infrastructure and OT
Segregation, asset inventory and control assessment for plant that cannot be taken offline for an audit.
Outsourced data protection officer
A named, qualified officer where the law requires one and the role cannot be filled internally — unconditional in Oman, register-gated in Bahrain.
Board cyber crisis simulation
A facilitated exercise for the board, not the SOC. Bilingual, and built around your sector's real failure modes.
The same boundary on every engagement
In scope
- Assessment, gap analysis and remediation planning.
- Board reporting written for a board rather than forwarded from a scanner.
- Policy and governance architecture the standard actually requires.
- Data protection and AI impact assessment.
- Sitting on your side of the table during someone else's audit.
Out of scope, permanently
- Product resale and vendor commission.
- Managed services.
- Delivering the remediation arising from our own report.
- Certification or accredited audit — where a framework requires a licensed assessor, we name one.
- Penetration testing and incident response for Dubai government and critical infrastructure, which is gated to Cyber Force certified firms.
Why the second column matters more than the first
Most firms selling readiness in this region also sell what follows it. That is not a scandal — it is the standard commercial model — but it means the assessment doubles as a proposal, and the incentive runs toward finding more rather than finding accurately. An assessment from a firm that cannot bid for the remediation is worth more to your board for exactly that reason, and it is worth less to us. We think that trade is the business.
Start with a scoping call
Twenty minutes, no preparation needed, and an honest answer about whether we are the right supplier.