Secure Public Funding.
Cyber Security Grant Applications in Riyadh.

The State of Cyber Security Procurement in Riyadh

Updated 14 May 2026

## Validating NCA and NTDP Eligibility Parameters for Cyber Grants Securing funding through the National Technology Development Program (NTDP) requires strict adherence to the National Cybersecurity Authority (NCA) Essential Cybersecurity Controls (ECC-1:2018). Grant writers targeting the 15,000,000 SAR TechChampions cyber-incubator fund must validate their applicant's commercial registration against the Ministry of Commerce database while simultaneously confirming active registration on the Etimad portal. When evaluating a recent 4,500,000 SAR zero-trust architecture grant issued by the Ministry of Communications and Information Technology (MCIT), applicants faced immediate disqualification if their proposed cryptographic modules lacked Saudi Arabian Standards Organization (SASO) certification. Furthermore, applications for the 2,000,000 SAR Riyadh Smart City Innovation Grant must explicitly demonstrate compliance with the Saudi Data and Artificial Intelligence Authority (SDAIA) IoT security baseline before passing the initial administrative screening. Lucius AI utilizes a Gemini-extracted eligibility matrix to parse the 120-page NTDP funding guidelines, instantly flagging whether a proposed endpoint detection and response (EDR) project meets the specific Tier 3 data localization mandates under the Personal Data Protection Law (PDPL). By deploying the Files API caching feature, grant writers can permanently store the applicant's historical Communications, Space and Technology Commission (CST) licenses, ensuring subsequent eligibility checks against the Government Tenders and Procurement Law Article 17 occur without redundant document uploads.

## Constructing a PDPL-Compliant Theory of Change for Threat Intelligence Mapping activities to outcomes for a Saudi Data and Artificial Intelligence Authority (SDAIA) smart-city grant demands a rigid Theory of Change aligned with the National Strategy for Data and AI (NSDAI). A successful 8,200,000 SAR proposal for a Riyadh-based municipal Security Operations Center (SOC) must explicitly link the deployment of SIEM log-aggregation activities to the output of 99.9% threat-detection rates across Ministry of Municipal and Rural Affairs (MOMRA) networks. This logical progression must culminate in a measurable impact metric, such as a 40% reduction in ransomware dwell time across King Abdullah Financial District (KAFD) infrastructure by Q4 2025. If the grant targets the mitigation of Advanced Persistent Threat (APT) groups targeting the Saudi energy sector, the outcomes must align with the specific threat intelligence sharing protocols mandated by the Ministry of Energy Cyber Security Directorate. Lucius AI’s Deep Think contradiction audit evaluates the narrative chain connecting these SOC deployment activities to the final KAFD impact metrics, identifying logical gaps that violate the Saudi Arabian Monetary Authority (SAMA) Cyber Security Framework reporting requirements. Grant writers rely on this audit to ensure their proposed incident response outcomes strictly mirror the mandatory recovery time objectives (RTO) dictated by the Cloud Cybersecurity Controls (CCC-1:2020) before submitting the final dossier to the King Abdulaziz City for Science and Technology (KACST) review board.

## Curating an Evidence-of-Impact Library for ECC-1:2018 Deployments Substantiating past performance for a National Cybersecurity Authority (NCA) capacity-building grant requires a meticulously indexed repository of third-party penetration testing reports and ISO/IEC 27001:2022 certification audits. When applying for the 12,000,000 SAR Cybersecurity Workforce Development Initiative, grant writers must provide verifiable beneficiary data demonstrating that previous training cohorts achieved an 85% pass rate on the Global Information Assurance Certification (GIAC) exams within Riyadh test centers. A recent submission to the Saudi Information Technology Company (SITE) required exact citations from previous vulnerability assessment contracts executed under the Government Tenders and Procurement Law Article 23. Grant evaluators at the National Technology Development Program (NTDP) heavily weight proposals that include sanitized incident response logs from previous deployments of Palo Alto Cortex XDR within Saudi government ministries. Lucius AI accelerates this curation through File Search citations across the bid library, automatically extracting specific CVE (Common Vulnerabilities and Exposures) remediation metrics from past Ministry of Health (MoH) hospital network upgrades. This capability allows the grant writer to instantly embed a verified 2023 case study detailing the mitigation of Log4j vulnerabilities across 14 Riyadh clinics directly into the new Saudi Federation for Cyber Security and Programming (SAFCSP) funding application.

## Anchoring Budget Justifications to Etimad Portal Hardware Benchmarks Defending a 6,750,000 SAR hardware procurement budget within a King Abdulaziz City for Science and Technology (KACST) research grant requires line-item anchoring against historical pricing data published on the Etimad portal. If a grant writer proposes allocating 1,200,000 SAR for next-generation firewalls (NGFW) to secure a new Riyadh-based fintech sandbox, the justification must reference the exact Saudi Arabian Monetary Authority (SAMA) hardware depreciation schedules. Reviewers at the National Technology Development Program (NTDP) will reject any budget narrative that prices Tier 4 data center colocation services above the standard rates established by the Communications, Space and Technology Commission (CST) 2023 tariff guidelines. Similarly, when calculating the hourly rates for Level 3 SOC analysts, the budget must strictly adhere to the Ministry of Human Resources and Social Development (HRSD) Saudization wage brackets for specialized IT personnel. Lucius AI cross-references proposed line items against its Files API caching of previous Ministry of Finance (MoF) approved vendor catalogs, ensuring the requested 450,000 SAR for annual CrowdStrike Falcon licensing matches the current public-sector negotiated rate. The platform's Deep Think contradiction audit then scans the financial narrative to guarantee that all proposed capital expenditures (CAPEX) for cryptographic hardware security modules (HSM) comply with the strict funding caps outlined in the National Cybersecurity Authority (NCA) grant disbursement manual.

## Executing the Final SDAIA Submission Readiness and Governance Check The final validation phase for a Saudi Data and Artificial Intelligence Authority (SDAIA) AI-driven threat hunting grant mandates a rigorous audit of match-funding commitments and corporate governance structures. Grant writers must verify that the applicant's 2,500,000 SAR private match-funding pledge is backed by a formalized bank guarantee from a Saudi Central Bank (SAMA) regulated institution, as stipulated by the Government Tenders and Procurement Law Article 33. Furthermore, the submission must include a signed safeguarding policy that explicitly details how the project team will handle classified threat intelligence in accordance with the National Cybersecurity Authority (NCA) Data Classification Policy. Any proposal requesting over 5,000,000 SAR from the National Cybersecurity Authority (NCA) must also attach a preliminary audit plan drafted by a Big Four accounting firm registered with the Saudi Organization for Chartered and Professional Accountants (SOCPA). Lucius AI facilitates this critical phase by generating a Gemini-extracted eligibility matrix that maps the uploaded governance documents against the specific mandatory annexes required by the Etimad portal submission gateway. Before the final upload to the Ministry of Communications and Information Technology (MCIT) grant portal, File Search citations across the bid library confirm that the designated Project Director holds the mandatory Certified Information Systems Security Professional (CISSP) credential registered with the Saudi Council of Engineers (SCE).

Bidders into Riyadh cyber security contracts compete under Etimad and the Government Tenders and Procurement Law. Sector-specific compliance bars include penetration-testing accreditation, information-security certification (ISO 27001) and a recognised cyber-assessment framework. Lucius AI maps each one to your response with a page-cited audit trail, so legal review reads as fast as engineering review.