Cybersecurity compliance guides for the GCC, Africa and Europe
How to use these guides
Each guide sets out who a rule applies to, what it requires, the deadlines and penalties it sets, and where operational evidence helps, with links to the official text it is based on. Start with the rules that apply to your sector and country, then check the details against the source.
Vigilbase helps you produce evidence and operate controls. Vigilbase OS keeps the logs and events from the security tools you already pay for auditable and queryable in one place, and records each investigation, approved action and verification. Managed Cloudflare runs WAF and DDoS controls within an agreed scope.
Vigilbase does not certify compliance, and these guides are not legal advice. Your legal and compliance owners decide which rules apply to you and whether a control is met.
Saudi Arabia
What are the NCA Essential Cybersecurity Controls (ECC)?
NCA ECC-2:2024 sets 108 main controls in four domains for Saudi government entities and CNI operators. Scope, domains, assessment and evidence.
Read the guideWhat are the NCA Critical Systems Cybersecurity Controls (CSCC)?
NCA CSCC-1:2019 adds 32 main controls to the ECC for Saudi critical systems. Who it applies to, how systems are identified, and what it adds.
Read the guideWhat is the SAMA Cyber Security Framework?
The SAMA Cyber Security Framework sets four domains and a maturity model for Saudi banks, insurers and finance companies. Scope, domains and evidence.
Read the guideWhat is Saudi Arabia's Personal Data Protection Law (PDPL)?
Saudi Arabia's PDPL has applied since 14 September 2023, with SDAIA as regulator. Scope, obligations, 72-hour breach notice, transfers and penalties.
Read the guide
United Arab Emirates
What is the UAE Personal Data Protection Law (PDPL)?
The UAE PDPL, Federal Decree-Law No. 45 of 2021, has applied since 2 January 2022. Scope, exclusions, obligations, breach reporting and penalties.
Read the guideWhat is the UAE Information Assurance Standard (formerly NESA)?
The UAE Cybersecurity Council's IA Standard v2.1 sets 134 controls in 15 families for federal entities and critical infrastructure. Scope and structure.
Read the guideWhat is the Dubai Information Security Regulation (DESC ISR)?
The DESC Information Security Regulation sets minimum security controls for Dubai Government entities and their contractors. Scope, domains and audits.
Read the guideWhat is ADHICS, the Abu Dhabi Healthcare Information and Cyber Security Standard?
ADHICS V2, effective August 2024, sets health information and cyber security controls for Abu Dhabi healthcare entities. Scope, domains and audits.
Read the guideWhat do CBUAE rules say about cyber security and outsourcing?
How CBUAE rules cover cyber risk, incident reporting, outsourcing and cloud for UAE banks and licensed financial institutions, from the CBUAE Rulebook.
Read the guideHow to choose an MSSP in the UAE
What to check before you hire an MSSP or cybersecurity company in Dubai, Abu Dhabi or elsewhere in the UAE: regulatory fit, SLA terms, SOC or MDR.
Read the guide
Africa
What is POPIA? South Africa's Protection of Personal Information Act
POPIA, South Africa's Protection of Personal Information Act 4 of 2013: who it applies to, security safeguards, breach notification and penalties.
Read the guideNigeria Data Protection Act 2023: the NDPA, the NDPR and the GAID
The Nigeria Data Protection Act 2023, the NDPR and the GAID: who the NDPA applies to, NDPC registration, 72-hour breach notice and penalties.
Read the guideKenya Data Protection Act 2019: what it requires
Kenya's Data Protection Act 2019: who it applies to, ODPC registration, security measures, 72-hour breach notification and penalties.
Read the guide
Europe and Portugal
NIS2 in Portugal: What Decree-Law 125/2025 Requires
Portugal transposed NIS2 with Decree-Law 125/2025, in force since 3 April 2026. Who is covered, CNCS registration, incident deadlines and fines.
Read the guideDORA Compliance: What the Digital Operational Resilience Act Requires
DORA, Regulation (EU) 2022/2554, has applied since 17 January 2025. Who it covers, the five pillars, incident reporting deadlines and ICT third-party risk.
Read the guide
Payments
More compliance guides
Operate the controls behind the evidence
Managed SOC
Security operations on Vigilbase OS and the tools you already pay for. The Vigil agent investigates high-severity incidents, Vigilbase analysts handle exceptions, and each action and verification is recorded.
Learn moreManaged Cloudflare
Vigilbase operates your Cloudflare account after go-live: WAF, DDoS, bot and DNS settings, within an agreed scope and change control.
Learn more
Scope the work against the rules that apply to you
Tell us which regulations you have identified and which systems are in scope. We confirm what an engagement can support, and record anything it cannot, before onboarding.