Governance and risk
Assessment, policies, risk register and roadmap. Deliverables: a treatment plan and a responsibility matrix.
Cybersecurity
Standalone services or a coordinated programme, matched to your organisation’s maturity.
ATAM’s cybersecurity offering can be taken as standalone services or as a coordinated programme, depending on the organisation’s maturity.
The programme is connected to applicable obligations and to the risks specific to each organisation, and is designed to be practical to operate.
Assessment, policies, risk register and roadmap. Deliverables: a treatment plan and a responsibility matrix.
Identity, network segmentation, hardening, cloud and applications. Deliverables: a target architecture and baseline configurations.
Audits, authorised penetration tests and remediation follow-up. Deliverables: a prioritised report and a verification retest.
Logging, SIEM, SOC processes and response procedures. Deliverables: detection use cases, tested alerts and playbooks.
Cyber Range, crisis exercises, backup and recovery. Deliverables: exercise results and an improvement plan.
Models, data, agents and tool interfaces. Deliverables: a risk assessment and tested safeguards.
The programme is connected to applicable obligations and organisation-specific risks. This support prepares the organisation for compliance; validation and certification remain with the competent authorities or bodies.
Identify relevant requirements, including NCA controls and sector obligations, and document an applicability matrix at the start of the engagement.
Map processing activities and access. Organise minimisation, retention, requests and incident handling under applicable requirements.
Link assets, threats, vulnerabilities and impacts. Assign risk owners and prioritise actions by business criticality.
Maintain policies, procedures, control evidence and remediation plans. Review gaps with management, with an owner and deadline for each.
Identify exploitable weaknesses and close gaps with accountable teams. Deliverables: management summary, actionable technical findings, remediation backlog and retest report.
Inventory exposed assets, domains, applications and interfaces, prioritised by exposure, data sensitivity and service criticality.
Configuration audits and web, API, mobile, network or cloud penetration tests within a defined mandate, window and rules of engagement.
Technical actions, an owner and a deadline for each correction. Risk is reassessed and the agreed scope retested after fixes.
Services from the partner ZIWIT may support audits and penetration tests, with its web protection tools selected according to needs and deployment conditions.
Detection capability designed for the client’s systems and organisation. Indicators: asset coverage, triage time, containment time and recurring incidents.
Prioritise log sources, quality and retention. Correlate identities, endpoints, networks, cloud and critical applications.
Design scenarios, reduce false positives and validate alerts through testing, with an owner and response procedure for each use case.
Triage, qualify and escalate incidents. Preserve evidence, coordinate teams and obtain approval for actions with operational impact.
A supported internal SOC, a co-managed service or a specialist partner, with coverage, on-call support, response times and responsibilities defined in the contract.
Protect availability and operational safety within equipment constraints, and verify that essential operations can resume under controlled conditions.
An ATAM offering under development
The Saudi Cyber Range is an ATAM offering under development: practical readiness that combines a platform, scenarios, exercise facilitation and assessment. It covers isolated labs for IT, OT and crisis-management teams, technical pathways from detection to recovery, and crisis simulations for leadership.
The offering is being developed around Quantum Vanguard’s portfolio, which presents Vanguard Omnirange and QVAcademy. Functions and scenarios are selected through agreed demonstrations and acceptance tests, and platform features and availability dates are confirmed for each project.
A business workshop to define priorities, solution scope and measurable results.