Government and sovereign

National standards with classification models, sovereignty constraints on where data may sit, and — for sovereign funds and holding companies — an oversight problem across portfolio companies that each run their own security function.

SECTOR PACK ADDS: Regulation, loss scenarios, indicators and control emphasis
SCENARIOS IN THIS PACK: 6 quantifiable loss scenarios
BUILT ON: The same control library and the same five pillars

What makes this sector different

The platform does not change. The regulation, the scenarios and the emphasis do.

Classification drives everything. Hosting, control depth and sharing all follow the data classification, which has to be settled before design rather than after.
Sovereignty is not negotiable. In-country hosting and controlled processing are gating requirements for most government workloads.
Portfolio oversight is the harder problem. A sovereign fund or holding company answers for entities it does not operate, with no consistent basis for comparison between them.
National reporting obligations. Incident notification into national coordination bodies on defined timescales.
Public scrutiny. The consequence of an incident carries a political dimension that does not appear in a standard loss model.

Regulation and standards in scope

Indicative, and additional to the market pack for the jurisdictions you operate in. Applicability is confirmed per client during scoping.

UAE Information Assurance Standards
DESC Information Security Regulation
NCA ECC-2:2024
NCA CSCC and DCC
NDMO data management standards
NCSA Qatar National Information Assurance
Qatar CIIP
Oman national cyber security framework
Bahrain NCSC standards
CITRA Cyber Security Framework
UK NCSC CAF
ISO/IEC 27001:2022

Market packs by jurisdiction

Loss scenarios in the sector pack

Each arrives with FAIR parameters and calibration guidance, so it can be quantified in USD rather than described.

Classified data exposure

Loss of information above a classification threshold, with national reporting and consequences that are not primarily financial.

Portfolio company incident

An entity you own but do not operate suffers a breach, and the group carries the reputational and oversight consequence.

Citizen service disruption

A public-facing service becomes unavailable, with coordination obligations into national bodies.

Shared supplier compromise

A supplier used across several entities becomes the common route into all of them.

Residency or sovereignty failure

Data found to be processed outside permitted boundaries, discovered during examination rather than by design.

Insider access misuse

Privileged access in an environment where the data is sensitive for reasons that have nothing to do with money.

How quantification works

Where the emphasis falls

Group and entity tenancy so a fund sees consolidated exposure alongside per-entity position; classification-driven control sets in Comply; national notification clocks in Withstand; and a comparable maturity basis across portfolio companies in Assure.

How sector packs sit in the architecture · How it reaches the business

Talk through your sector position

We will walk the regulation that applies to you, the scenarios worth quantifying first, and what a realistic first ninety days looks like.

Book a working session