Digital Government Authority

DGA Enterprise Architecture and NORA Implementation in Saudi Arabia

Build an operational enterprise architecture practice with DGA reference alignment, current and target architectures, governance, roadmaps and useful repositories.

Discuss your readiness اقرأ هذه الصفحة بالعربية

National enterprise architecture references; confirm applicable methodologySources reviewed: 4 November 2026

Understand the requirement. Connect it to operations.

Saudi national enterprise architecture provides a government-sector reference for aligning business priorities with applications, data and technology. The Digital Government Authority publishes enterprise architecture establishment and NORA guidance, while the national portal describes the wider national enterprise architecture framework. The practical objective is to make change coherent: projects should contribute to agreed service and organizational outcomes and use a shared view of important dependencies.

IRIS Technology can support an architecture practice that informs procurement, integration, cloud adoption, infrastructure modernization and security decisions. This includes establishing governance, documenting current capabilities, defining target states and sequencing a realistic transition roadmap. A repository becomes useful when owners maintain it and delivery teams consult it during change. Diagrams produced for a one-time assessment have limited value if the underlying decisions and relationships are not kept current.

Confirm applicability before choosing controls.

Confirm the government entity's applicable DGA methodology, current guidance and measurement requirements before selecting templates, domain structures or maturity criteria. Published establishment and NORA documents are official references, but their continued availability does not establish that an older edition is the latest. Private-sector organizations can adopt relevant practices while distinguishing voluntary use from specific government or contractual obligations.

Include the business services, processes, information, applications, technology and external dependencies necessary for the agreed scope. Coordinate enterprise architecture with data governance, cybersecurity, continuity and portfolio management. DGA provides a National Enterprise Architecture Accreditation Certificate service for government entities; implementation support can prepare an organization and its evidence, but does not confer accreditation or guarantee an official decision. Define the engagement around operational outcomes as well as assessment readiness.

Turn requirements into implementation and evidence.

Practical examples, not an exhaustive assessment or mandatory product list
Focus area	Implementation examples	Evidence to maintain
Practice establishment	Define mandate, roles, governance forums and architecture decision rights.	Approved charter, responsibility model and review procedures.
Current-state visibility	Inventory services, applications, data and technology with dependencies.	Validated architecture views, repository records and ownership assignments.
Target architecture	Agree principles and target capabilities aligned to organizational priorities.	Approved target views, requirements and documented design decisions.
Transition roadmap	Sequence changes using gaps, dependencies, cost and operational constraints.	Prioritized roadmap, project links and tracked architecture requirements.
Governance and maintenance	Review initiatives, handle justified exceptions and update models.	Review records, exception decisions and repository maintenance evidence.

What this looks like in practice.

Overlapping applications

Several departments procure tools with similar functions. Architecture analysis can identify overlapping capabilities, integration costs and transition dependencies before leaders decide whether consolidation is justified.

A new government service

Map the intended user journey to processes, information, applications and infrastructure. Validate identity, integration, monitoring and recovery dependencies, then assess proposed designs against approved architecture principles.

From readiness assessment to working controls.

Agree the scope, responsible owners and acceptance criteria before work begins. The approach is tailored to your systems, suppliers, operating constraints and existing evidence.

Assess and prioritize

Review applicability, current controls and evidence. Identify gaps and dependencies, distinguish design from operating effectiveness, and prioritize actions with accountable owners.

Design the improvements

Translate approved requirements into architecture, policies, processes and technical changes. Reuse effective controls while keeping national and sector mappings distinct.

Implement and validate

Configure agreed safeguards, document procedures and validate representative workflows within authorized access and change windows. Record exceptions and residual risks.

Handover and sustain

Organize evidence, transfer operating knowledge and define a review cadence. Track corrective actions as systems, services, suppliers and requirements change.

Agree concrete deliverables.

A scope and applicability record with assumptions and responsibilities.
A gap/risk register and prioritized remediation roadmap.
Control mapping, architecture recommendations and operating procedures.
An evidence register, agreed validation results and handover material.

Deliverables, depth, access and timing depend on the statement of work. This is readiness and implementation support; it does not include a promise of regulator acceptance or formal certification.

Common questions.

Is enterprise architecture just infrastructure design?

No. It links organizational services and processes to information, applications and technology. Infrastructure architecture is one important contribution to that broader practice.

Must we buy an EA platform first?

Establish ownership, information needs and decision workflows before selecting tooling. A platform helps maintain relationships and reporting, but it cannot replace governance or reliable source information.

Does NORA implementation guarantee accreditation?

No. Accreditation is an official DGA process for the relevant government entities. Support can address readiness and evidence; the authority determines the outcome.

How do we choose the reference edition?

Confirm current DGA methodology documents and applicable assessment directions at initiation. Record the baseline and manage changes explicitly rather than combining templates from different editions without review.

What makes the practice sustainable?

Give model owners maintenance duties, connect architecture review to project decisions and measure whether the information remains accurate and useful. Review gaps and exceptions through accountable governance forums.

Start with the official sources.

Read the linked authority publications for the binding scope, wording and applicable updates. The implementation examples on this page are practical recommendations, not a reproduction of every regulatory requirement.

General readiness and technology information, not a legal opinion, regulator endorsement or guarantee of compliance. Confirm applicability, current versions and sector directions with the competent authority and qualified advisers.

Related frameworks and requirements

DGA Digital Transformation →NDMO Data Governance →NCA ECC →NCA CCC →

Define the right scope for your organization.

Bring your services, systems, supplier dependencies and existing findings. We will help turn them into a practical assessment and implementation scope.

Discuss your readiness