Riyadh · Karachi · Delaware soon 07:00 – 15:00 UTC  ·  contact@coalescence.me

Solutions

Cybersecurity & Compliance

Security assessment, remediation and certification support for NCA ECC, UAE Information Assurance, ISO 27001 and PDPL.

Frameworks
NCA ECC · UAE IA · ISO 27001 · PDPL
Testing
Scoped, with written stop conditions
Findings
Reported to you directly

The approach

Evidence a regulator will accept.

Findings are prioritised by exploitability within your specific environment and remediated in that order. Each engagement produces the documentation set required by regulators, insurers and enterprise customers during due diligence.

NCA ECCUAE IAISO 27001SOC 2PDPLOWASP ASVSMicrosoft DefenderEntra IDBurp SuiteSnykHashiCorp VaultSIEM integration
assurance — control coverage
Programme Gap analysis Findings Remediation Evidence Submission Admin Users & rolesAudit log
4Frameworks
DirectReporting
AgreedStop conditions

Capabilities

What the practice covers

  1. 01

    Security assessment

    Application, network and cloud configuration review, with findings ranked by exploitability in your environment.

  2. 02

    Penetration testing

    Authorised testing of web, mobile and API surfaces, reported with reproduction steps suitable for developer action.

  3. 03

    System hardening

    Baseline configuration, secrets management, least-privilege identity design and removal of unaudited standing access.

  4. 04

    Compliance readiness

    Gap analysis and remediation against Saudi NCA Essential Cybersecurity Controls, UAE Information Assurance, ISO 27001, SOC 2 and PDPL.

  5. 05

    Secure development

    Threat modelling, dependency scanning and security gates integrated into CI, so defects are identified at pull request stage.

  6. 06

    Incident response

    Response playbooks, tabletop exercises and forensic readiness, rehearsed with the teams who will execute them.

On handover

What you receive

Every engagement ends with the client holding the artefacts needed to run, extend and re-tender the system without us.

Discuss a project
  • Prioritised findings report suitable for both board and engineering audiences
  • Remediation plan with named owners, effort estimates and sequencing
  • Hardened baselines applied and confirmed by retest
  • Evidence pack aligned to your target certification

Common questions

Frequently asked

Do you support Saudi NCA and UAE IA compliance?
Yes. We deliver gap analysis against NCA Essential Cybersecurity Controls and the UAE Information Assurance standard, manage remediation, and prepare the documentation required for submission.
Will penetration testing affect production systems?
Testing is scoped and scheduled to avoid production impact, and we prefer a staging environment that mirrors production. Any production testing is agreed in writing with defined limits and stop conditions.
What are the penalties under UAE PDPL?
Administrative penalties reach AED 5 million. For public-facing services, the operational and reputational consequences of a breach typically exceed the financial penalty.
Can you work alongside our existing IT provider?
Yes. Findings are reported to your organisation directly, and your incumbent provider can retain ownership of remediation where that is the preferred arrangement.

Related

Practices that usually travel with this

All solutions

Web Application Development

Enterprise portals, workflow platforms and line-of-business systems, supported by dedicated offshore engineering teams.

Web Applications

E-Government Solutions New

Public-sector engineering on national infrastructure: Nafath and Elm platforms in Saudi Arabia, work on an economic zone client management system in the UAE, and on passenger wayfinding at Hamad International Airport.

E-Government

Cloud & Infrastructure Services

Landing zone design, workload migration and managed operations on Azure and AWS, with data residency and cost governance established from the outset.

Cloud

Begin with a two-week discovery

Discovery produces a domain model, a risk register and a written estimate, retained by the client regardless of whether the build proceeds.

Start a conversation