Saudi Contractors Authority
Project charter
SCA Cybersecurity Programme
APPROVEDV2Approved 2025-01-31
1Project identity
Required at this stage- Project name
- SCA Cybersecurity Programme
- Project code
- PRJ-2026-005
- Project sponsor
- Eng. Majed S. Al-RasheedEng. Majed S. Al-RasheedHead, Digital Transformation SectorP-011m.alrasheed@sca.sa
- Project manager
- Eng. Yasser M. Al-ZahraniEng. Yasser M. Al-ZahraniDirector, CybersecurityP-026y.alzahrani@sca.sa
- Project owner
- Eng. Nayef H. Al-BuqamiEng. Nayef H. Al-BuqamiDirector General, Information TechnologyP-017n.albuqami@sca.sa
- Portfolio & programme
- Technology & Enterprise Systems PortfolioDigital Infrastructure & Security Programme
- Type & methodology
- IT · Waterfall
- Current phase
- 4Execution
2Background & rationale
Required at this stageA security operations centre, identity & access management and full ECC compliance.
3Objectives
Required at this stage- 1Strong technical capabilities
Serves the strategic objectives:SO-4.1Strong technical capabilities
4Scope
Required at this stageIn scope
- A security operations centre, identity & access management and full ECC compliance.
- Migration from legacy systems
- ERP integration
Out of scope
- Operation and maintenance after the warranty period
- Work outside the approved site or system boundary
5High-level requirements
Required at this stage- 1Migration from legacy systems
- 2ERP integration
- 3Essential cybersecurity controls
6Deliverables
Required at this stage| 1 | Project management plan | 2025-03-01 |
| 2 | Main deliverable — stage 1 | 2026-01-16 |
| 3 | Main deliverable — final stage | 2026-09-11 |
| 4 | Final report | 2026-12-15 |
7Key milestones
Required at this stage- Charter approved2025-01-31
- Contract signed2025-05-22
- 50% of works complete2026-01-16
- Provisional acceptance2026-10-22
- Closure2026-12-15
8Budget
Required at this stage- Main contract72.0%27.8M
- Supervision & consulting14.0%5.4M
- Internal team9.1%3.5M
- Contingency reserve (5%)4.9%1.9M
The owning sector’s approved budgetTotal38.6M
9Timeline
Required at this stage10Key risks
Required at this stage- MediumUndetected vulnerabilities in legacy systems before SOC onboarding
11Constraints
Required at this stage- Stay within the approved budget
- Comply with the Government Tenders & Procurement Law
12Assumptions
Required at this stage- Named internal staff available throughout
- Approvals land within the workflow’s action time limits
13Stakeholders
Required at this stage- Project sponsorDecisions and funding
- Project ownerAccepts deliverables, owns benefits
- Project Management Office (PMO)Governance and compliance
14Success criteria
Required at this stage- 1Delivered within the approved budget
- 2On the approved date ±5%
- 3Target benefits within 12 months
15Governance structure
Required at this stage- Change Control BoardApproves scope, cost and schedule changesWeekly
- PMO CommitteeMethodology compliance, data quality, stage gatesFortnightly
- Project management teamDay-to-day control, risks, impediments, the periodic update cardWeekly