Skip to main content
ARKON Portal | بوابة أركون - ربط العملاء والمشاريع والشركاء
HCIS / SAIS Security Consultancy — Saudi Arabia

Engineer security compliance before it becomes a project constraint.

ARKON supports facility owners, developers, EPC contractors and project consultants with security risk, design assurance, SEC-directive mapping, authority submission readiness and operational closeout for industrial and critical-infrastructure projects across Saudi Arabia.

Independent consultancy. Traceable engineering. Authority-ready evidence.
Security design is treated as an integrated system of risk, physical protection, electronic systems, people, procedures, resilience and documented compliance.
SRA / STRAStages 1–4SEC-01 to SEC-19 mappingOperational readiness
Security assurance architectureAuthority-aligned review
Protected OperationRisk • Design • Evidence • Readiness
Authority & SEC basisPhysical protectionSystems & resilienceOperations & response
01–19Security directive mapping
4 stagesControlled approval workflow
5 stepsSRA logic chain
PoCEvidence-based compliance
SAIS / HCISCurrent authority terminology with legacy directive references handled correctly.
SEC FrameworkDirective applicability mapped to project type, classification and interfaces.
Engineering FirstRisk findings translated into physical, electronic and operational design decisions.
No Approval GuaranteeClassification, acceptance and approvals remain with the competent authority.

Four controlled security-project stages from risk basis to operational readiness.

The workflow is structured so each stage produces the technical basis and evidence required for the next decision gate, reducing late redesign, procurement risk and inspection surprises.

01

SRA & Conceptual Design

Establish the facility risk basis, critical assets, threat/vulnerability logic and the security concept.

  • Security Risk Assessment / STRA inputs
  • Concept of Design and security zoning
  • Classification and applicability basis
  • Initial organization / procedure concepts
02

Preliminary Design

Translate the approved concept into a coordinated preliminary package suitable for procurement planning.

  • Preliminary design criteria and layouts
  • Perimeter, gates and security-system architecture
  • Interface and specification development
  • Authority comments and waiver strategy
03

Detail Design

Review final construction-level security design, device selection, integration and directive compliance.

  • Detailed drawings and specifications
  • System integration, network, power and resilience
  • Proof-of-Compliance evidence structure
  • Comment closure and compliance certification support
04

Operational Readiness

Confirm that installed systems, operating procedures, training and closeout evidence are ready for handover.

  • Testing / commissioning and SAT evidence
  • SOPs, organization and manning
  • Training, maintenance and as-builts
  • Operational readiness / inspection support
Authority gate logic: design-stage documentation is managed before construction, procurement or installation; operational-readiness documentation closes the transition from installed systems to operating security.

Directive applicability mapped as one integrated security architecture.

Rather than treating the SEC documents as isolated checklists, ARKON maps governance, physical protection, systems, infrastructure and sector-specific overlays into a single project compliance register.

2017 Security Directives

SEC-01 through SEC-19

The applicable set depends on the facility type, classification, interfaces and authority direction. Electrical substations, for example, follow a functional-classification basis under the dedicated substation directive rather than the normal FSC route.

Governance, classification, project workflow and operations
Perimeter, gates, lighting, systems, devices and resilience
Sector overlays for rail, marine, pipelines, substations and industrial cities

Governance & Management

SEC-01General requirements & classification
SEC-14Security project management
SEC-15Facility security management
SEC-11Personnel identification

Physical Protection

SEC-02Security fencing systems
SEC-03Security gates
SEC-04Security lighting
SEC-09Security-equipment structures

Systems & Resilience

SEC-05Security systems at facilities
SEC-06Security devices
SEC-07Power supplies
SEC-08Security communications & networks
SEC-12Cybersecurity

Sector-Specific Overlays

SEC-10Railway operations
SEC-13Marine-interface facilities
SEC-16Pipelines & corridors
SEC-17Electrical power substations
SEC-18Industrial cities
SEC-19Residential compounds

Risk drives design; design drives evidence; evidence supports readiness.

The security package should demonstrate a traceable logic from asset and threat understanding through countermeasures, technical design, implementation evidence and operating procedures.

SEC-15 SRA structure

Five-step risk chain

A disciplined SRA avoids generic recommendations by linking site-specific assets, credible threats, vulnerabilities and risk rankings to prioritized countermeasures.

01Facility & AssetCharacterize critical areas and existing posture
02ThreatIdentify credible threat scenarios
03VulnerabilityAssess exposure and consequences
04RiskEvaluate and rank security risk
05RecommendationsPrioritized physical, technical and procedural measures
Layered protection model

One integrated security environment

Security systems are reviewed as coordinated layers rather than isolated equipment packages.

LAYER 01Boundary & standoffFence / clear zone
LAYER 02Controlled accessGates / screening / barriers
LAYER 03Detect & assessCCTV / VSS / IDS / PIDS
LAYER 04Command & responseSCC / communications / SOP
LAYER 05Resilience & evidencePower / network / PoC / records

Security consultancy built around decisions, interfaces and deliverable control.

Services are selected to suit project stage, facility type, authority route and available design maturity.

Authority & Compliance Strategy

Applicability review, approval route, submission responsibilities, compliance matrix, waiver strategy, authority comments and closure planning.

Security Risk Assessment

Asset characterization, threats, vulnerabilities, risk evaluation, critical-area logic, mitigation priorities and residual-risk positions.

Security Concept & Design Review

Security zoning, perimeter strategy, gates, access philosophy, CCTV/VSS, ACS, IDS/PIDS, lighting, SCC and integrated system architecture.

Network, Power & Resilience Review

Security communications, system segregation, field connectivity, UPS/standby power, resilience, time synchronization and cybersecurity interfaces.

Design Assurance & PoC

Drawings, specifications, calculations, schedules, data sheets, comment registers and Proof-of-Compliance evidence structured for traceability.

Operational Readiness

Testing evidence, SAT records, SOPs, security organization, manning, training, maintenance, as-builts and pre-inspection readiness support.

High-value deliverables are traceable, reviewable and authority-facing.

The objective is not more paperwork; it is a controlled evidence trail showing how security risk, design decisions, implementation and operating readiness are connected.

Typical Engineering Deliverables

Security Risk Assessment / STRA and risk register
Classification / applicability and authority-route note
Concept of Design, zoning and security philosophy
Preliminary / detailed design review reports
SEC compliance and Proof-of-Compliance registers
Waiver, deviation and authority comment registers
Testing, commissioning and readiness evidence review
SOP, manning, training and maintenance readiness review

Traceability Chain

01
RequirementDirective / authority / project basis
Mapped
02
Design responseDrawing / spec / calculation / system logic
Reviewed
03
EvidencePoC / datasheet / test / comment closure
Linked
04
ReadinessAs-built / SOP / training / inspection pack
Controlled

Security advisory for regulated and high-consequence facilities.

Project-specific directive applicability is confirmed at the start of each assignment.

01

Industrial & Manufacturing

Plants, process facilities, hazardous operations and production assets.

02

Utilities & Substations

Power, water, wastewater, substations and essential service infrastructure.

03

Data Centres & Technology

Campuses, critical rooms, layered access, resilience and security zoning.

04

Logistics & Infrastructure

Perimeters, yards, truck access, screening, transport and corridors.

05

Government & Major Developments

Government, semi-government, EPC, developer and consultant-led projects.

Quick project security assessment

Share the project stage. ARKON will identify the practical next security-consultancy step.

Provide the facility type, location, current design stage, authority correspondence and available security documents. The initial review helps define the likely compliance, design and submission route.

Project location, sector and facility type
Current stage: concept, FEED, detailed design, construction or operations
Available drawings, SRA, security reports or authority comments
Required support: risk, design, compliance, submission or readiness

ARKON HCIS / SAIS Security Project Check

Secure online assessment
01
Project profileFacility type, location, end user and project stage
02
Authority positionExisting correspondence, classification or security requirements
03
Available technical dataMasterplan, drawings, reports, SRA, comments or contractor submissions
04
Required decisionRisk assessment, design review, compliance, submission or readiness
Open Secure Project Check
Your information is used only for project review and follow-up.Open full form

Questions to resolve before security design becomes a delivery risk.

Final applicability depends on the facility, classification, project stage and competent-authority direction.

Does ARKON guarantee HCIS / SAIS approval?

No. ARKON provides consultancy, technical review, documentation, coordination and readiness support. Classification, acceptance and approval decisions remain with the competent authority.

What is the difference between HCIS and SAIS terminology?

Current authority terminology uses SAIS, while the 2017 Security Directives and many legacy project records use HCIS. Project documentation should recognize both terms correctly without treating them as unrelated frameworks.

Can an existing contractor or consultant design be reviewed?

Yes. Available reports, drawings, calculations, specifications, data sheets, compliance evidence and authority comments can be reviewed against the agreed project basis and applicable directives.

When should the security consultant be appointed?

Early appointment reduces redesign and unclear responsibilities, but support can also be provided during FEED, detailed design, construction, commissioning and operational-readiness stages.

Does ARKON supply or install security systems?

This page covers independent security consultancy and design-assurance services. Supply, installation and system integration remain contractor responsibilities unless separately contracted outside the consultancy role.

What information is needed for the first review?

Project location and sector, facility type, current design stage, masterplan/site information, available security documentation, authority correspondence and the specific technical or approval issue affecting the project.

Build a security position that is clear, traceable and inspection-defensible.

Start with a controlled review of authority applicability, risk basis, design maturity and evidence gaps.