Enterprise Architecture and NORA as Enablers of Saudi Arabia’s Digital Transformation
By Mohammed AlMohassen, Digital Transformation & Enterprise Architecture Advisor
Digital transformation is no longer simply about digitizing services or implementing new technologies. As organizations become increasingly dependent on data, artificial intelligence, digital platforms, and interconnected services, transformation requires a broader perspective—one that connects strategy, organizational capabilities, technology, governance, and measurable outcomes.
Saudi Arabia provides a strong example of this evolution. Under Vision 2030, several national strategies shape different dimensions of the Kingdom’s digital transformation. Among the most important are the Digital Government Strategy, the National Strategy for Data and AI, and the National Cybersecurity Strategy. Each has a distinct mandate, but their real value becomes clearer when they are viewed as parts of one integrated transformation ecosystem rather than as separate programs.
Three Strategies, One Transformation Ecosystem
The Digital Government Strategy defines how government services and operations should evolve toward a more integrated, efficient, and citizen-centered model. Its direction reflects an important shift: from measuring transformation mainly by the number of digitized services toward measuring service quality, maturity, user experience, integration, and outcomes. [1]
The National Strategy for Data and AI adds the intelligence layer. Data and AI enable government entities to move beyond transactional services toward increasingly proactive, personalized, and evidence-based services. They also strengthen decision-making, automation, forecasting, innovation, and operational efficiency. [5]
The National Cybersecurity Strategy provides the trust layer required to sustain this transformation. As services, data, systems, and digital identities become more interconnected, cybersecurity becomes a strategic enabler of resilience, risk management, continuity, and trusted digital growth. [7]
Measurement Makes the Strategy Real
What makes this ecosystem particularly important is that national direction is increasingly supported by measurable indicators. For digital government, the Digital Government Authority (DGA) uses Digital Transformation Measurement (Qiyas) to assess the maturity and progress of government entities. Government agencies achieved an overall score of 88.30% in the 2025 cycle. [2]
The Digital Experience Maturity Index (DEMI) provides another perspective by focusing on the quality and maturity of the digital experience. The overall result reached 86.71% in 2025 across 50 government digital platforms. The Digital Government Strategy also targets 95% citizen satisfaction and 95% digital-service maturity by 2030. In parallel, the Emerging Technologies Adoption Readiness Index exceeded 74% in 2025, showing that technology readiness is increasingly being measured alongside service maturity. [1][3][4]
For data and AI, SDAIA’s national strategy establishes ambitions such as positioning Saudi Arabia among the top 15 countries in AI, the top 10 in open data, developing more than 20,000 data and AI specialists, attracting around SAR 75 billion in investment, ranking among the top 20 countries in scientific contribution, and enabling more than 300 data and AI startups. At the entity level, the National Data Index (NDI) reinforces this direction by benchmarking government data practices and maturity. [5][6]
Cybersecurity measurement has a different character. Rather than relying on a single public maturity score, the National Cybersecurity Authority (NCA) establishes national controls and compliance mechanisms. The Essential Cybersecurity Controls (ECC) provide a national baseline, complemented by additional controls for areas such as cloud computing, critical systems, data, and operational technology where applicable. [8]
Together, these indicators show that digital transformation is no longer assessed through technology delivery alone. It is increasingly measured through digital maturity, user experience, data capability, AI readiness, cybersecurity compliance, resilience, and ultimately value.
The Real Challenge: From Strategy to Execution
National strategies and KPIs, however, do not automatically translate into organizational transformation. Government entities still need a mechanism that converts national direction into capabilities, priorities, architecture decisions, roadmaps, investments, and initiatives.
This is where Enterprise Architecture (EA) becomes increasingly important. EA connects strategy with business capabilities, processes, data, applications, and technology. It helps organizations ask practical questions: Do our capabilities support our strategic objectives? Are our applications enabling the required services? Is our data governed and available for the decisions and AI use cases that depend on it? Does our technology landscape support the future direction? Are cybersecurity requirements embedded by design? And can each major investment be connected to a measurable outcome?
When applied this way, Enterprise Architecture is no longer simply a repository of diagrams, systems, and standards. It becomes a mechanism for translating strategy into organizational design and investment decisions.
National Enterprise Architecture and NORA as Strategic Enablers
Within Saudi government, the DGA’s National Enterprise Architecture provides national direction for adopting and implementing EA practices. NORA 2.0 serves as the national reference for adopting enterprise architecture practices across the government sector, supporting consistent implementation and alignment with the wider digital-government landscape. [9]
This gives EA two important roles. Vertically, it connects national priorities to entity strategy and execution. Horizontally, it integrates business, data, applications, technology, and security.
Instead of beginning with “What system should we implement?”, organizations can begin with more fundamental questions: What outcome are we trying to achieve? Which national and organizational KPI does it support? What capability is required? What architecture change is necessary? Which initiative represents the best investment? And how will value be measured?
From Strategic Alignment to Strategic Traceability
Many organizations already require projects to demonstrate strategic alignment. A more mature model is strategic traceability: the relationship between national direction, entity strategy, KPIs, capabilities, architecture roadmaps, investments, projects, accountability, and realized benefits can be followed through an explicit chain.
National Strategy → Entity Objective → KPI → Business Capability → Enterprise Architecture → Investment → Program/Project → Outcome → Benefit
This allows leadership to understand not only whether a project is aligned with strategy, but what objective it supports, what capability it develops, what architecture change it advances, who is accountable, which KPI should move, and whether the expected benefit has actually been realized.
Digital Transformation Should Ultimately Be Measured Through Value
Viewed together, the national ecosystem becomes clearer: Digital Government enables services, integration, and user experience; Data and AI enable intelligence, automation, and innovation; Cybersecurity enables trust, protection, and resilience; Enterprise Architecture and NORA enable strategic and architectural alignment; Portfolio, Program, and Project Management enable execution; and KPIs and Benefits Management demonstrate whether value has been realized.
The most meaningful measure of digital transformation is therefore not the number of technologies adopted or projects completed. It is the ability to demonstrate a traceable line from national and organizational strategy to capabilities, from capabilities to investments, from investments to execution, and from execution to measurable outcomes.
Technology becomes strategically valuable when an organization can clearly demonstrate why it exists, what capability it enables, which objective and KPI it supports, how it aligns with the wider digital landscape, and what measurable value it creates.
Mohammed AlMohassen is a Digital Transformation and Enterprise Architecture professional with more than 20 years of experience in connecting strategy, organizational capabilities, technology, governance, and measurable outcomes. His areas of interest include Enterprise Architecture, digital transformation, technology governance, strategic alignment, data and AI, and translating national and organizational strategies into executable architecture roadmaps and measurable business value.
References
- Digital Government Strategy — Unified National Platform / Digital Government Authority. https://my.gov.sa/en/content/digital-strategy
- Digital Transformation Measurement (Qiyas) — 2025 Cycle, Digital Government Authority. https://dga.gov.sa/en/indicators/qiyas/2025
- Digital Experience Maturity Index — 2025, Digital Government Authority. https://dga.gov.sa/en/indicators/digitalexperience/2025
- Emerging Technologies Adoption Readiness — Digital Government Authority. https://dga.gov.sa/en/news/dga-international-cloud-workshop-world-bank
- National Strategy for Data and AI — Saudi Data & AI Authority (SDAIA). https://sdaia.gov.sa/en/SDAIA/SdaiaStrategies/Pages/NationalStrategyForDataAndAI.aspx
- National Data Index (NDI) — Saudi Data & AI Authority (SDAIA). https://sdaia.gov.sa/en/Research/Pages/NationalDataIndex.aspx
- National Cybersecurity Strategy — National Cybersecurity Authority (NCA). https://nca.gov.sa/en/national_cybersecurity_strategy/
- Essential Cybersecurity Controls (ECC) — National Cybersecurity Authority (NCA). https://nca.gov.sa/en/regulatory-documents/controls-list/ecc/
- NEA Framework / NORA 2.0 — Digital Government Authority. https://dga.gov.sa/en/programs/nea/nois