Enabling your resilience. Protecting you from regulatory fines.
Governance, risk and compliance, delivered by Kerberogate and powered by Ihkaam.
Three disciplines. One resilient organisation.
Clear accountability.
Everyone knows who decides and who owns what.
See it before it costs you.
Identify, score and treat risk within your appetite.
No surprises from regulators.
Meet every obligation, with the evidence ready.
Govern with confidence.
See Ihkaam in 72 seconds.
Ihkaam. Your GRC in one platform.
Governance, risk, compliance and continuity in one place. Arabic and English. Cloud or on-premises.
Book an Ihkaam demoCurrent risk posture exceeds the approved risk appetite and requires management attention.
| Item | Due | Status |
|---|---|---|
| Information Security Policy v4 | Oct 2026 | Approved |
| Risk appetite statement 2027 | Nov 2026 | Awaiting board |
| Supplier risk treatment plan | Nov 2026 | In review |
| Data retention standard | Sep 2026 | Overdue |
| BCM policy annual review | Dec 2026 | Scheduled |
- Hover or tab through the grid to see which risks sit where.
| Function | RTO | RPO | Result |
|---|---|---|---|
| Customer service | 4h | 1h | Passed |
| Core ERP | 8h | 4h | Passed |
| Payments | 2h | 15m | Findings open |
| Email & collaboration | 24h | 4h | Not exercised |
Everything you need to stay compliant.
Five modules. One source of truth.
-
Know who decides, who owns what, and prove every approval.
See governance in a demoIncludes
- Committees and roles
- Approval workflows
- Full decision history
-
Spot risks early and treat them before they become losses.
See risk management in a demoIncludes
- AI-assisted risk entry
- ISO 31000-aligned scoring
- Treatment plans and heat maps
-
Meet every requirement and walk into audits prepared.
See compliance & audit in a demoIncludes
- Arabic and English regulatory library
- One-click compliance checks
- Evidence linked to controls
-
Know your critical functions and prove you can recover them.
See business continuity in a demoIncludes
- Business impact analysis
- Tests and exercises
- Regulator-ready reports
-
Ask in plain language. See what changed and what needs attention.
See AI assistant & analytics in a demoIncludes
- GRC assistant
- KPIs and KRIs
- Executive dashboards
Every regulator. One platform.
Assess once. Report everywhere you operate.
| Country | Data protection law | Maximum fine |
|---|---|---|
| Oman | PDPL, Royal Decree 6/2022 | OMR 500,000 |
| Saudi Arabia | PDPL, Royal Decree M/19 | SAR 5M |
| UAE | PDPL, Decree-Law 45/2021 | AED 5M |
| Qatar | PDPPL, Law 13/2016 | QAR 5M |
| Bahrain | PDPL, Law 30/2018 | BD 20,000 |
| Kuwait | DPPR, CITRA Res. 26/2024 | KWD 20,000 |
| Instrument | Key exposure |
|---|---|
| NIST CSF 2.0 | De facto benchmark for reasonable security |
| SEC cyber disclosure | Material incidents disclosed in 4 business days |
| HIPAA | $16M largest settlement |
| CCPA / CPRA | Up to $7,988 per violation |
| GLBA Safeguards Rule | Breaches reported to the FTC within 30 days |
| NYDFS 23 NYCRR 500 | Mandatory cybersecurity programme |
| CIRCIA | 72-hour incident reporting, final rule pending |
| Instrument | Key exposure |
|---|---|
| UK GDPR & DPA 2018 | £17.5M or 4% of global turnover |
| Data (Use and Access) Act 2025 | Amends UK GDPR in stages |
| Cyber Security & Resilience Bill | 24-hour initial notification, in Parliament |
| FCA / PRA operational resilience | Stay within impact tolerances |
| Cyber Essentials / Plus | Required for relevant contracts |
| Instrument | Key exposure |
|---|---|
| GDPR | €20M or 4% of global turnover |
| NIS2 | €10M or 2%; 24-hour early warning |
| DORA | Applicable since 17 January 2025 |
| AI Act | High-risk deadline December 2027 |
| Cyber Resilience Act | Reporting from 11 September 2026 |
- 93ISO/IEC 27001:2022Annex A controls
- 6NIST CSF 2.0Functions, from Govern to Recover
- 12PCI DSS v4.0.1Core requirements for card data
- 5SOC 2Trust Services Criteria
- CIS Controls v8Prioritised controls in three implementation groups
- COBIT 2019Enterprise IT governance
- ISO/IEC 27701Privacy on top of your ISMS
- ISO/IEC 42001:2023AI management system
Source: Kerberogate Global Regulatory Atlas, 2026. Ceilings as cited; enforcement varies by regulator.
Built for regulated organisations.
Your GRC data stays confidential.
Role-based access
People see only what their role allows.
Full audit trails
Every action is recorded.
Cloud or on-premises
Deployed the way your policy requires.
Arabic and English
Bilingual by design.
Prefer email? Write to Info@kerberogate.com.
Meet us in Muscat.
In-person demos and workshops at our office in Bawshar.
Muscat, P.C. 133
Sultanate of Oman 23.5984° N · 58.4272° E