The ATT&CK techniques MENA actors actually use, rolled up against the control frameworks that matter in the region — Saudi NCA ECC, NIST CSF 2.0, and ISO 27001:2022. Each control area shows its threat pressure (# techniques) and your detection coverage (Sigma). A tactic-level prioritization aid — not a certified control crosswalk.