Turning API security requirements into evidence and closure
Assessment coordination for a Saudi lender’s Vahana Hub deployment.
- Market
- Saudi Arabia
- My work in this market
- Mortgage lending, API delivery and billing
Project brief
The Saudi deployment had to answer the client’s cybersecurity checklist and its SAMA API security assessment. Closing the assessment meant establishing which controls applied, what the platform already supported, and what engineering or the client’s teams needed to implement. I coordinated the responses and evidence so the review could progress requirement by requirement.
My role
I managed assessment tracking, product explanations, evidence collection and coordination with the client’s cybersecurity team. Engineering, infrastructure and the client’s teams implemented the controls.
- 7 of 7
- controls closed in the client’s SAMA API security assessment
Key decisions
- 01
Answer with evidence before building
The checklist asked for data masking and encryption at rest. I showed from the platform’s logs that it did not store customer personal data, so the requirement was closed with evidence instead of a new build.
- 02
Work with the client’s security environment
The client already ran its own security monitoring. I coordinated our response around it and brought the responsible teams together, instead of proposing a separate monitoring set-up on our side.
- 03
Make each requirement traceable
I organised the supporting material by control area, tracked unresolved items and set up an escalation matrix so each issue reached the right owner.
Outcome
Every requirement in the client’s SAMA API security assessment was closed.
Related work
More from Saudi Arabia
Get in touch.
Building something in FinTech, banking or consumer products? I’d like to hear about it.