Dir'a · PROGRAM ROADMAP

A phased, fully-funded program from classified-domain hardening to nation-scale defence

Dir'a is scoped as a multi-phase national-scale program, not a single build. Each phase below carries its own investment, team, budget breakdown, and exit-criteria milestones, sequenced so that later phases draw directly on the control-baseline and tooling work completed earlier — no phase starts until its dependencies are met.

SAR 20,000,000
Total program investment
21 months
Total program duration
3
Sequenced phases

ECC/CCC baseline & classified-domain hardening

Planned

Phase 1 — control baseline & classified-domain hardening

6 monthsSAR 6,000,000

Resources

Detection engineers3 FTE

Build detection and hunting tooling that operates inside classified networks without external telemetry egress.

Threat-hunt lead1 FTE

Defines the nation-state-calibrated hunt hypothesis library against APT tradecraft, not commodity malware.

Controls & compliance lead2 FTE

Baselines and enforces NCA ECC and CCC controls across the classified domain.

Program manager1 FTE

Owns cross-workstream sequencing, reporting, and design-partner readiness.

Budget breakdown

Engineering & platform development

Classified-domain-compatible detection tooling, hunt-hypothesis engine, and control-enforcement dashboard.

SAR 3,600,000
Compliance & controls baselining

NCA ECC and CCC control baselining, gap assessment, and continuous-enforcement tooling.

SAR 1,200,000
Design-partner pilot readiness

Classified-network assessments and isolated test environments for validation ahead of live deployment.

SAR 800,000
Contingency

Reserve against classified-domain integration and accreditation-timeline risk.

SAR 400,000

Plan of action

  1. 1
    Baseline ECC and CCC controls across the pilot classified domainControls & compliance lead · 8 weeks

    Establish the enforced-control baseline that every later hunt and response workflow will report against.

  2. 2
    Build classified-domain-compatible detection and hunting toolingDetection engineering · 10 weeks

    Confirm detection and hunt tooling operates fully air-gapped, with no external telemetry egress.

  3. 3
    Define the nation-state-calibrated hunt hypothesis libraryThreat-hunt lead · 8 weeks

    Build initial hunt hypotheses around advanced persistent threat tradecraft rather than commodity signatures.

  4. 4
    Sign first 1-2 design-partner entity letters of intentProgram manager · 10 weeks

    Confirm the classified-network environments the first live hunts and exercises will run against.

Activities

NCA ECC and CCC control enforcement

Planned

Essential and critical cybersecurity controls tracked and enforced continuously, with remediation status always visible.

Owner Controls & compliance lead

Classified-domain hardening

Planned

Detection and response tooling built to operate inside classified networks without external telemetry egress.

Owner Detection engineering

Nation-state-calibrated hunt hypothesis library

Planned

Hunt hypotheses built around advanced persistent threat tradecraft, not commodity malware signatures.

Owner Threat-hunt lead

Depends on Classified-domain hardening

Design-partner entity onboarding

Planned

First classified-network environments confirmed and prepared for phase-2 live hunts and exercises.

Owner Program manager

Depends on NCA ECC and CCC control enforcement

Exit-criteria milestones

  • ✓NCA ECC and CCC control baseline enforced across the pilot classified domain
  • ✓Detection and hunting tooling validated as fully air-gapped
  • ✓Nation-state-calibrated hunt hypothesis library approved
  • ✓1-2 design-partner entity letters of intent signed

Continuous hunting & red-team operationalization

Planned

Phase 2 — continuous hunting & red-team operationalization

7 monthsSAR 7,000,000

Depends on ECC/CCC baseline & classified-domain hardening

Resources

Threat hunters4 FTE

Run continuous hunts against the approved hypothesis library across live design-partner environments.

Red-team operators3 FTE

Design and execute scheduled adversary-simulation exercises against live-representative environments.

Incident response lead1 FTE

Owns the full incident response timeline — detection, isolation, root-cause, control verification, report.

Program manager1 FTE

Continues cross-workstream sequencing and design-partner reporting.

Budget breakdown

Threat-hunting operations

Continuous hunt execution and hypothesis refinement across design-partner classified environments.

SAR 3,000,000
Red-team exercise program

Scheduled adversary-simulation exercises and after-action reporting against live-representative environments.

SAR 2,300,000
Incident response tooling

Full-timeline incident tooling — detection, isolation, root-cause, control verification, report.

SAR 1,100,000
Contingency

Reserve against exercise-scheduling and design-partner-readiness risk.

SAR 600,000

Plan of action

  1. 1
    Stand up continuous threat-hunting operations at the first design-partner entityThreat-hunt lead · 6 weeks

    Move from hypothesis library to live, recurring hunts against a real classified environment.

  2. 2
    Run the first scheduled red-team exercise cadenceRed-team operators · 12 weeks

    Validate that defensive controls hold against realistic adversary tradecraft on a recurring schedule.

  3. 3
    Stand up the full incident-response timeline workflowIncident response lead · 8 weeks

    Every incident carries a complete record from detection through control verification and report.

  4. 4
    Begin mean-time-to-contain tracking and trendingIncident response lead · 10 weeks

    Measure and trend containment performance to give command visibility into defensive readiness.

Activities

Nation-state-calibrated threat hunting

Planned

Hunt hypotheses pursued continuously against live design-partner environments, not only after an alert fires.

Owner Threat-hunt lead

Depends on Nation-state-calibrated hunt hypothesis library

Continuous red-team exercises

Planned

Scheduled adversary simulations against live-representative environments keep defensive posture tested, not assumed.

Owner Red-team operators

Depends on Classified-domain hardening

Incident response with full timeline

Planned

Every incident carries a complete response record — detection, isolation, root-cause, control verification, report.

Owner Incident response lead

Depends on NCA ECC and CCC control enforcement

Mean-time-to-contain tracking

Planned

Containment performance measured and trended over time for command visibility into defensive readiness.

Owner Incident response lead

Depends on Incident response with full timeline

Exit-criteria milestones

  • ✓Continuous threat-hunting operations live at the first design-partner entity
  • ✓First scheduled red-team exercise cadence completed and reported
  • ✓Full incident-response timeline workflow validated on a live incident
  • ✓Mean-time-to-contain tracking live and trending

Nation-scale rollout & certification

Planned

Phase 3 — nation-scale rollout & certification

8 monthsSAR 7,000,000

Depends on Continuous hunting & red-team operationalization

Resources

Platform engineers3 FTE

Build the multi-entity SOC console and cross-entity MTTC benchmarking view.

Red-team operators2 FTE

Expand exercise cadence to advanced adversary-emulation scenarios across additional entities.

Defence account lead1 FTE

Opens and manages additional entity onboarding beyond the initial design-partner cohort.

Compliance lead1 FTE, part-time

Owns the ISO 27001 certification audit.

Budget breakdown

Platform engineering (multi-entity SOC console)

Multi-entity command view, cross-entity MTTC benchmarking, and scale-out infrastructure.

SAR 3,000,000
Advanced red-team exercise expansion

Advanced adversary-emulation scenarios run across the expanded entity cohort.

SAR 1,800,000
Entity onboarding & market development

Onboarding additional defence and government entities beyond the initial design-partner cohort.

SAR 1,300,000
Certification & scale infrastructure

ISO 27001 certification audit and infrastructure scaling for a multi-entity rollout.

SAR 600,000
Contingency

Reserve against certification-timeline and multi-entity onboarding risk.

SAR 300,000

Plan of action

  1. 1
    Design and deliver the multi-entity SOC consolePlatform engineering · 14 weeks

    One command view across every onboarded entity, with cross-entity MTTC benchmarking.

  2. 2
    Expand red-team exercises to advanced adversary-emulation scenariosRed-team operators · 12 weeks

    Move beyond baseline exercises to nation-state-tradecraft emulation across the entity cohort.

  3. 3
    Onboard additional defence and government entitiesDefence account lead · 16 weeks

    Extend the model from the initial design-partner cohort into a broader entity rollout.

  4. 4
    Complete ISO 27001 certification auditCompliance lead · 12 weeks

    Close out formal certification building on the architecture pre-aligned during phase 1.

Activities

Multi-entity SOC console

Planned

A cross-entity command view and MTTC benchmarking for organizations running more than one classified domain.

Owner Platform engineering

Depends on Mean-time-to-contain tracking

Advanced adversary-emulation exercises

Planned

Red-team exercises expanded to nation-state-tradecraft emulation across the entity cohort.

Owner Red-team operators

Depends on Continuous red-team exercises

Defence & government entity rollout

Planned

Extends beyond the initial design-partner cohort into additional defence and government entities.

Owner Defence account lead

Depends on Nation-state-calibrated threat hunting

ISO 27001 certification

Planned

Complete formal certification building on the pre-aligned architecture.

Owner Compliance lead

Depends on NCA ECC and CCC control enforcement

Exit-criteria milestones

  • ✓Multi-entity SOC console live with cross-entity MTTC benchmarking
  • ✓Advanced adversary-emulation exercise cadence validated across the entity cohort
  • ✓Additional defence and government entities onboarded beyond the initial cohort
  • ✓ISO 27001 certification achieved

Defend against adversaries who don’t stop trying

We're selecting design-partner entities for the first mission-cyber deployment cohort. Book a briefing to review your current ECC/CCC posture.

Request a PilotBack to Dir'a