Skip to main content
back to List back
on this page

Integrated AI & Cyber GRC: Crosswalking the Frameworks That Matter

live online
price $3,200
Ahmed Essayed
Intermediate
5 Days
Sun 6 Dec - Thu 10 Dec
price $3,200
Register


Online, Available in English

Overview

Modern GRC leaders are running parallel compliance programs against a sprawling list of frameworks — ISO/IEC 27001, NIST CSF 2.0, COBIT, SOC 2, PCI DSS, HIPAA, GDPR, the EU AI Act, ISO/IEC 42001, NIST AI RMF — and on top of all of that, regional regimes such as NCA ECC, NCA CCC, NCA CSCC, SAMA, PDPL, and SDAIA AI Ethics. The result is duplicated control work, brittle evidence chains, audit fatigue, and a board that cannot tell whether the organisation is actually safer. 

This 5-day, executive-level course teaches GRC leaders, CISOs, and AI ethics officers how to build one integrated GRC operating model that satisfies the major IT, security, AI, privacy, and sector-specific frameworks simultaneously — with KSA and GCC regulatory requirements baked in from the start, and a critical-infrastructure lens applied throughout. The differentiator is crosswalking: a single control library, a single risk register, a single audit calendar — produced once, filed many times. 

Attendees leave with a working crosswalk matrix across all major frameworks, a reference integrated control library, an AI governance overlay that plugs into the cyber programme, and a 12-month roadmap they can present to their board the following week. No mock vendor decks — real worked examples on a critical-infrastructure scenario rooted in the regional regulatory landscape.

Topics:

  • Day 1 — The Integrated GRC Operating Model 

    • The crosswalking thesis: one control library, many frameworks; mapping the global framework landscape and the cost of running them in parallel. 

    • GRC operating model: board reporting, three-lines-of-defence, AI ethics committee, internal audit alignment, governance KPIs. 

    • Building the unified control library and risk taxonomy with an AI overlay; introduction of the week-long critical-infrastructure capstone scenario. 

    Day 2 — Integrated IT & Cyber Governance 

    • ISO/IEC 27001, NIST CSF 2.0, and COBIT 2019 combined into a single integrated IT and cyber governance stack. 

    • KSA regional alignment: NCA ECC, NCA CCC; audit overlap with SOC 2 Type II and PCI DSS 4.0 control mapping.

    • Crosswalk exercise: trace one control across five frameworks; build audit-ready evidence once and file it many times. 

    Day 3 — AI Governance 

    • ISO/IEC 42001 (AI management system), NIST AI RMF, MITRE ATLAS for GRC, and SDAIA AI Ethics Principles operationalised together. 

    • EU AI Act: risk classification, prohibited and high-risk obligations, general-purpose AI rules, and extraterritorial reach for KSA organisations selling into the EU. 

    • AI inventory, model lifecycle controls, AI ethics committee operations, and AI-specific incident response embedded in the existing cyber programme. 

    Day 4 — Privacy, Critical Infrastructure, and Sector Overlays 

    • Privacy stack: GDPR + ISO/IEC 27701 + KSA PDPL + HIPAA for cross-border health data; cross-border data and AI transfer obligations. 

    • Critical infrastructure and OT: IEC 62443, EU NIS2, NIST 800-53, NCA CSCC; operational resilience under DORA. 

    • Sector overlays: SAMA Cybersecurity Framework for financial services; PCI DSS 4.0 for payments; sector-specific evidence and audit considerations. 

    Day 5 — Operating the Integrated Programme (Capstone) 

    • Risk quantification with FAIR and ISO 31000; aligning cyber risk, AI risk, and operational risk on a single enterprise risk register. 

    • Multi-framework audit calendar; regulator engagement strategy (NCA, SAMA, EU authorities); board and CEO reporting that earns trust. 

    • Capstone: present an integrated 12-month GRC roadmap for the critical-infrastructure scenario, defended against simulated board and auditor challenge. 

Who should attend:

  • CISOs, deputy CISOs, and Heads of Information Security building or maturing a multi-framework GRC programme. 

  • Heads of GRC, risk officers, and compliance leads juggling multiple regulatory and certification regimes simultaneously. 

  • AI ethics officers and responsible-AI leads operationalising ISO/IEC 42001, NIST AI RMF, EU AI Act, and SDAIA AI Ethics. 

  • Data Protection Officers (DPOs) and privacy leads working across GDPR, KSA PDPL, HIPAA, and sector-specific privacy regimes. 

  • IT governance, internal audit, and compliance officers responsible for evidence, controls testing, and audit coordination. 

  • Security strategy consultants and board advisors who need a defensible, framework-agnostic operating model to recommend to clients.