Raqmana
AR

Next-Gen Strategy

Information Security: Next-Gen Strategy

أمن المعلومات — استراتيجية الجيل القادم

Raqmana's proprietary methodology, developed and refined over six years: six security pillars working toward one goal, resilience and sustainability.

Book a strategy workshop See the framework

© Raqmana. Proprietary methodology.

The strategy at a glance

Pillars
GRC-BC-ISMS · RPP · ASM · CTI · AIS · UZTNA · SOC · SAT
Scope
Management · Identity · Business · Technology · Operations · Communication
Goal
Resilience & sustainability

The philosophy

Four kinds of knowledge. The strategy plans for all four.

  • Known · known

    Requirements

  • Known · unknown

    Known risks

  • Unknown · known

    Hidden facts

  • Unknown · unknown

    Unknown risks

The framework

Six pillars around one goal.

Resilience and sustainability sit at the centre. The six pillars surround it and the six scope dimensions frame it. Select a pillar to jump to it.

GRC-BC-ISMS RPP ASM · CTI AIS · UZTNA SOC SAT

Six pillars

  1. GRC-BC-ISMSGovernance, risk & compliance, business continuity + information security management
  2. RPPExclusive Preventative Solution Against Ransomwares and Rogue Process
  3. ASM · CTIAttack surface management & cyber threat intelligence
  4. AIS · UZTNAAI security + universal zero trust network access
  5. SOCSecurity operations center
  6. SATSecurity awareness training

Six scope dimensions

  • Management
  • Identity
  • Business
  • Technology
  • Operations
  • Communication

The pillars

What each pillar delivers, and what delivers it.

Every pillar pairs its capabilities with the partner solution we integrate for it.

P/01GRC-BC-ISMS

Governance, Risk & Compliance + Business Continuity + Information Security Management System

Compliance, risk, continuity and a documented, auditable information security programme built to ISO 27001, run as one system and tracked all year rather than rebuilt for each audit.

Capabilities

  • Automated compliance tracking
  • Risk and maturity scoring
  • Policies
  • Controls
  • Internal audit
  • ISO 27001 programme
  • ISO 9001, 27001, 27701, 31000 and 22301: training → implementation → audit → certification
Training T3Information Security & Cybersecurity Strategy

Solutions

Exclusive

Cybervergent

AI-powered GRC platform. It automates ISO, NIST, SOC 2, NDPA and PCI DSS compliance in one executive framework, in Arabic and English, with external auditor and advisor support and on-demand visual reports.

Raqmana service

Raqmana advisory

Raqmana advisory and implementation services, supported by the Cybervergent platform.

P/02RPP

Exclusive Preventative Solution Against Ransomwares and Rogue Process

Rogue processes identified and stopped before they can encrypt, copy or destroy your data.

Capabilities

  • Detection of rogue and unauthorised processes
  • Automatic containment of malicious activity
  • Ransomware and data-extortion prevention
  • Protection for critical data and systems

Solution

Exclusive

Cyber Crucible

AI-powered anti-ransomware and data-extortion prevention, built to stop rogue processes before they do damage.

P/03ASM · CTI

Attack Surface Management & Cyber Threat Intelligence

A current picture of everything you expose to the internet, and early warning from threat feeds, the dark web and your supply chain.

Capabilities

  • External attack surface management (EASM)
  • Digital risk protection
  • Cyber threat intelligence feeds
  • Dark and deep web monitoring
  • Brand-impersonation and phishing-domain alerts
  • Supply-chain intelligence

Solution

Gold partner

SOCRadar

SOCRadar XTI platform: external attack surface management, digital risk protection and cyber threat intelligence in one SaaS platform, with dark and deep web monitoring, brand-impersonation and phishing-domain alerts, and supply-chain intelligence.

P/04AIS · UZTNA

Artificial Intelligence Security + Universal Zero Trust Network Access

AI adopted safely, and every user, device and application verified before it reaches anything.

Capabilities

  • AI usage governance
  • Data-leak control around AI tools
  • Model and prompt risk
  • Zero-trust network access (ZTNA)
  • Least-privilege access
  • Continuous verification
  • Device posture
Training T1Prompt Engineering for AI

Solutions

Cyber Crucible

FortressAI

FortressAI by Cyber Crucible lets your team use generative AI tools without exposing confidential data: it blocks, anonymizes or allows sensitive information before it reaches a public AI service, stops unapproved "shadow AI" use and keeps audit-ready reports of all AI usage.

More about FortressAI
Partner

Forcepoint

SASE with zero-trust network access, data loss prevention and risk-adaptive protection, applied to AI tools as much as to any other application.

Gold partner

Matrix42

Unified endpoint management (UEM) for device posture and asset control.

Raqmana service

Raqmana advisory

Raqmana advisory on AI use and zero-trust design.

P/05SOC

Security Operations Center

Detection, response and the evidence behind them, run from one operations centre.

Capabilities

  • Asset management
  • Change and patch management
  • Log management
  • Incident response
  • Digital forensics
  • Security testing
  • Internal audit
  • Secure network configuration
  • Server, workstation and acceptable-use policies
  • Internal and external risk reports
  • User-behaviour records
  • Threat and management reporting

Solutions

Exclusive

White Guard

Full SOC automation platform (White Hawk).

Exclusive

Segura

Unified identity (IGA · IAM · PAM) with session recording, login-behaviour risk alerts to the SOC, and identity governance across cloud and on-prem.

P/06SAT

Security Awareness Training

Awareness that is measured by role and level, and tested continuously.

Capabilities

  • Continuous, role-based awareness
  • Interactive tests
  • Phishing simulation
  • Certificates per level
  • Reporting
Training T3Information Security & Cybersecurity Strategy

Solutions

Partner

Kaspersky

Kaspersky ASAP: an automated security awareness platform.

Exclusive

dPhish

An all-in-one anti-phishing suite. Drill-Phish runs awareness training and phishing simulation and gives leadership resilience metrics. Discover-Phish (mailbox visibility) and Detect-Phish (AI-assisted detection and response) cover the inbox side.

Regulatory alignment

Aligned with Libya's regulators.

The strategy maps to the national information security policy and to the frameworks the Central Bank of Libya works with.

NISSA

  • Policies 2.0

Central Bank of Libya frameworks

  • ISO 27001
  • NIST CSF
  • PCI DSS
  • ISO 27701 / NDPA
  • ISO 31000 / 27005 / 22301
  • ISO 20022 / 8583
  • Basel / FATF / FATCA

  • Outcome

    Return on security investment

    Spending mapped to pillars and results, so security investment can be measured.

  • Outcome

    Cyber-insurance readiness

    Documented controls and posture that stand up when an insurer asks.

Start here

Start with a strategy workshop.

Tell us your sector and where you want to begin. We'll scope a workshop around your environment, then follow the same gated path as every engagement.

  1. Stage 01

    Session

    A scoping session on your environment and regulatory context.

  2. Stage 02

    NDA

    A signed NDA covering the capability and your operating detail.

  3. Stage 03

    Knowledge Briefing (KB)

    A private briefing on the specific capability, mapped to your use case.

  4. Stage 04

    Proof-of-Concept (PoC)

    A live proof-of-concept inside your own environment.

Book a strategy workshop Request a Demo