Fallstudie

Narqam cut offboarding to under an hour and earned ISO 27001 with two people in IT

A 78 person electronic invoicing company closed departing staff access within an hour and passed ISO 27001 with two people in IT.

macOS, Windows, and Linux laptops connected to one padlock

Einführung

A compliance company growing fast

In Saudi Arabia and the UAE, an invoice must be structured, signed, and cleared by the tax authority before the buyer receives it. Narqam sits between a company’s ERP and the authority, ZATCA in Saudi Arabia and the Federal Tax Authority in the UAE, and clears invoices for more than 640 businesses.

“So basically, we make sure your invoice is legally an invoice.”
Lama Al-Otaibi, Head of IT and Security

Narqam is based in Riyadh, with an office in Dubai and remote staff in Egypt and Jordan. It had 55 employees a year earlier and 78 today, after 31 hires in 12 months. Two people run IT and security: the Head of IT and Security, who joined in 2024 as the company’s first security hire, and Omar Haddad, IT Support Specialist, in Dubai.

Before choosing Trio, the team compared four options over 4 weeks. It ran trials of two of them on 10 devices each: 6 Macs, 2 Windows laptops, and 2 Linux laptops.

Herausforderungen

Onboarding was slow. Offboarding was a risk.

Narqam had no device management at all. The inventory lived in a Notion table, updated when there was time. Each new MacBook came from the reseller to Omar’s desk in Dubai. He created the account, installed the apps, turned on disk encryption, and logged it, about 2.5 hours of hands on work per laptop. Remote hires then waited for a courier. New hires usually had a working laptop by lunch on day two.

Offboarding was harder. A Notion checklist covered 14 steps across 11 apps, some behind single sign on and some with their own logins. Then the laptop had to come back and be wiped. Each departure took about 4 to 6 hours of IT time, spread over up to a week of waiting.

“Onboarding is annoying. Offboarding is dangerous.”
Lama Al-Otaibi, Head of IT and Security

In October 2025, the first quarterly access review found a former contractor who still had GitHub and staging access 19 days after the contract ended. The logs showed no activity. The laptop was the contractor’s own.

“I didn’t know whether he had a copy of anything on his laptop, because it was his own laptop. That was the part that kept me awake.”
Lama Al-Otaibi, Head of IT and Security

Later that year, an employee lost a company MacBook. The CEO asked whether it was encrypted. Encryption was part of the setup routine, but nobody could prove it for that laptop, and the team spent 2 days working out what the device and its account could reach.

macOS updates relied on a monthly reminder in Slack. The platform team’s 5 Linux laptops had production access, and nobody managed them.

“The most dangerous laptops in the company were the five nobody was managing.”
Lama Al-Otaibi, Head of IT and Security

The trigger came from a sales deal. A large prospective customer in Saudi Arabia sent a security questionnaire of about 240 questions mapped to the NCA Essential Cybersecurity Controls. The endpoint section asked for evidence of encryption, patch levels, device MFA, and remote wipe. The team could only answer “by policy”, and the deal stalled for about 6 weeks. Narqam also had an ISO 27001 Stage 1 audit booked for February 2026 and Stage 2 for May.

“We sell compliance. Our own laptops were the part we couldn’t prove.”
Lama Al-Otaibi, Head of IT and Security

Lösung

New hires open a laptop that works at 09:00 on day one

Macs now ship sealed from the reseller straight to the new hire and enroll through Apple Business Manager with Zero touch onboarding. The apps install at first sign in. Macs bought outside the reseller channel in the early days, 9 in total, could not join Apple Business Manager the normal way and were enrolled manually.

One trigger closes every account when someone leaves

When HR confirms a departure, Omar starts an offboarding workflow built with Workflow automation and SSO and SaaS application management. Single sign on access is revoked, the laptop is locked, the SSO apps are removed, and the device is flagged for return. Three apps outside single sign on are still handled by hand.

A laptop that loses encryption loses access

Compliance monitoring checks disk encryption, operating system version, and patch level on every laptop. Conditional access policies block a laptop that falls out of compliance from Google Workspace and GitHub. Conditional access went live on 15 February 2026. The first days needed an exception group for the QA team’s test machines and a push for staff on old macOS versions.

The platform team’s Linux laptops are managed like the rest

The platform team worried that an agent would slow builds and see too much. The Head of IT and Security walked them through what the agent collects, and the team agreed a scoped policy set for their group: disk encryption checks and patch reporting, without software restrictions.

“Now the platform lead is the one who complains when the report shows red.”
Lama Al-Otaibi, Head of IT and Security

Every app signed up with a company email is visible

In the first week of the trial, Shadow IT and SaaS discovery found 143 SaaS apps in use with company email addresses. The Head of IT and Security had guessed about 40. Three were AI meeting note takers joining customer calls with finance teams, where invoice data is often shared on screen. Narqam approved one under a contract and data agreement and blocked the other two. It also cancelled 11 paid subscriptions that duplicated existing tools or had no owner.

Ergebnis

The result

Offboarding used to take 4 to 6 hours of IT time over up to a week, and in the worst case access stayed open for 19 days. Across nine departures since March 2026, access was gone within 1 hour of HR’s email every time, with about 20 minutes of IT time.

Setting up a MacBook took about 2.5 hours. Across the first 10 of 14 hires since March 2026, it took an average of 11 minutes of IT time. All 14 had a working laptop at 09:00 on day one.

Everyone believed every laptop was encrypted. At enrollment, 7 of 58 Macs had no FileVault and 4 of 15 Windows laptops had no BitLocker. Today, all 78 company laptops are encrypted, and conditional access blocks any that are not.

Patch status was unknown before. In August 2026, 55 of 58 Macs were on the current macOS within 14 days of release, 14 of 15 Windows laptops were current, and all 5 Linux laptops were current on security updates.

Narqam passed its ISO 27001 Stage 2 audit in May 2026 with no nonconformities on Annex A 8.1, the user endpoint devices control, and received its certificate in June. Answering the endpoint section of a customer security questionnaire used to take about 3 days of chasing screenshots. It now takes about half a day, with two questionnaires arriving most months.

Omar estimates he gets back about a day a week. He now runs the quarterly access reviews with the Head of IT and Security. The Notion inventory was archived after a month in read only mode. The Security posture dashboards, bought for the auditor, now go to the CEO every month and on to the board.

“I didn’t expect the board to care about laptops.”
Lama Al-Otaibi, Head of IT and Security

Genutzte Funktionen

Features used

Zero-Touch-Onboarding Apple Business Manager Richtlinien für bedingten Zugriff Compliance-Monitoring SSO und SaaS-Anwendungsverwaltung Shadow-IT- und SaaS-ErkennungWorkflow-Automatisierung

“I’d say, the policy document is not the control. We had a very nice policy document that said all laptops are encrypted. Seven of them weren’t.”
Lama Al-Otaibi
Head of IT and Security