Cybersecurity & Data Protection Award

Evaluation

100% automatic, from the data and evidence you submit

Minimum score to win

75 / 100

Measurement period

The last full financial year before nominations open (2025), compared with 2024 for growth measures

Who can apply

• A licensed financial institution for its own security programme, or a cybersecurity solution or service provider serving licensed financial institutions
• A provider reports its indicators for the financial clients it monitors or protects, with written consent from at least two clients
• An independent information security function and a security policy approved by the board or senior management
• No final material regulatory or judicial sanction against the nominee during the measurement period

Indicators and weights

1. Mean time to detect

   Average hours between the start of a confirmed security incident (medium severity or above) and its detection during 2025, with the start time set by the forensic analysis; red or purple-team exercise scenarios are added to the incidents, and an entity with no confirmed incident reports the detection time measured in the exercise alone

   15%
   Show points and evidenceHide

   Points

   • ≥ 168 hours 10
   • 24 – < 168 hours 40
   • 1 – < 24 hours 75
   • 0 – < 1 hours 100

   Evidence

   Security operations centre report from the SIEM or incident system, and the exercise report

2. Mean time to contain

   Average hours between detecting a confirmed security incident (medium severity or above) and containing it during 2025, with the same rule for using exercise scenarios when there were no incidents

   15%
   Show points and evidenceHide

   Points

   • ≥ 72 hours 10
   • 24 – < 72 hours 40
   • 4 – < 24 hours 70
   • 0 – < 4 hours 100

   Evidence

   Incident response log with timestamps, and the exercise report

3. Critical vulnerability remediation

   Share of critical vulnerabilities found on internet-facing systems in 2025 that were remediated within 15 days of discovery

   15%
   Show points and evidenceHide

   Points

   • 90 – < 100 % 100
   • 75 – < 90 % 80
   • 50 – < 75 % 50
   • 0 – < 50 % 20

   Evidence

   Vulnerability management system report with discovery and fix dates

4. Material breaches

   Number of data breaches or material cyber incidents reportable to the regulator during 2025

   15%
   Show points and evidenceHide

   Points

   • ≥ 2 0
   • 1 – < 2 50
   • 0 – < 1 100

   Evidence

   Declaration by the CISO and the log of reports filed with the regulator

5. Independent assessment result

   Result of the latest independent assessment within 24 months against the regulator's cybersecurity framework or ISO/IEC 27001

   15%
   Show points and evidenceHide

   Points

   • Compliant with no major non-conformity100
   • Minor findings only, being remediated70
   • Major non-conformity open0

   Evidence

   Assessment report or certificate with the assessor's letter

6. Red-team exercise

   An advanced attack simulation by an independent firm during 2025, with all critical findings closed

   15%
   Show points and evidenceHide

   Points

   • Exercise done and critical findings closed100
   • Not done or critical findings open0

   Evidence

   Exercise report summary from the firm and closure certificate

7. Phishing simulation click rate

   Share of staff who clicked the link in the last phishing simulation covering all staff in 2025

   10%
   Show points and evidenceHide

   Points

   • 15 – < 100 % 10
   • 8 – < 15 % 40
   • 3 – < 8 % 70
   • 0 – < 3 % 100

   Evidence

   Simulation platform report with targets and clicks

Each indicator gives 0 to 100 points; its share of the total is its weight. Ties are decided by the indicators listed first in the scorecard; payment or package never affects the score.

1. Done

   Nominations open

   26 October 2026 · 13:10

2. Upcoming

   Nominations close

   27 November 2026 · 01:10

3. Upcoming

   Judging starts

   27 November 2026 · 01:11

4. Upcoming

   Judging ends

   4 December 2026 · 13:00

5. Upcoming

   Results announced

   4 December 2026 · 13:10

Times are in Asia/Riyadh (UTC+03:00).