Trusted government websites, ready from day one: a security baseline aligned to the national cybersecurity controls, the DGA Unified Design System, and Arabic first.

Brought to you by iSpectra.

Mutamad (معتمد, "approved") is a Drupal distribution for the websites of Saudi government entities. One install gives a site in Arabic and English with the Digital Government Authority's page templates and components, an approval workflow in which whoever writes never publishes, and a security baseline aligned to the NCA Essential Cybersecurity Controls (ECC-2:2024) and Data Cybersecurity Controls (DCC-1:2022).

Building a website for a Saudi government entity? Start with Mutamad: composer create-project drupal/mutamad_project my-site

Documentation · Issue queue · iSpectra

Why Mutamad

✔ A security baseline aligned to the NCA controls

Password policies, account lockout, a 15-minute idle logout, multi-factor authentication for privileged roles, a strict Content Security Policy and security headers, encryption keys kept outside the database, and every log entry sent to syslog as JSON for a SIEM. Each control is applied by one recipe, and ddev mutamad-verify checks it on the running site.

✔ The DGA Unified Design System

Every component of DGA's Platforms Code, built as Drupal components: the Digital Stamp, Service page, FAQ, e-Participation, Life Journeys, Charts, Accessibility Tools and more. 130 components, 64 of them in the Drupal Canvas library, each with Storybook stories in Arabic and English.

✔ Arabic first

The installer speaks Arabic from its first step, and every site comes in Arabic and English. Right to left throughout, page addresses that keep their Arabic letters, Hijri and Gregorian dates, and a site search that understands Arabic: it finds a word however its alef, hamza or taa marbuta is written.

✔ Separation of duties

An editor drafts and an approver publishes, never the same person, on content and on Drupal Canvas pages alike. Every edit needs a reason, every decision lands in an audit trail, and the dashboard shows each person what waits for them.

✔ Privacy and accessibility

Nothing from another site loads before the visitor agrees (PDPL): videos, maps and analytics wait behind a consent notice where declining is as easy as accepting. Pages are tested against WCAG 2.1 AA, and the footer carries DGA's accessibility tools.

✔ The content of a government site

Services after DGA's Service Page Template, News, Events, FAQ, Publications, Leadership and a newsletter, plus optional e-Consultations, Life Journeys, a knowledge base and an AI assistant that runs on the entity's own model server.

✔ Built the Drupal way

Drupal 11 and Drupal Canvas. All configuration lives in recipes, one control area each, so every recipe applies to a bare Drupal site on its own. Nothing is loaded from a CDN: the theme, its icons and its font are its own files.

Get started

composer create-project drupal/mutamad_project my-site
cd my-site
ddev start
ddev install-mutamad
ddev mutamad-verify

install-mutamad installs a site in Arabic (or English), with its starting pages: the home page, About us, e-Participation, the legal and help pages and the main menu. mutamad-verify then checks every control on the running site.

What's inside

Every part of Mutamad is its own drupal.org project, released on its own.

Start here

Mutamad Project: start here: composer create-project, hardened settings and a DDEV environment.
Mutamad: the installation profile and its Arabic-first installer.
Mutamad Standard Site: the site template that applies every recipe below, in order.

Security and compliance

Mutamad Roles: the three job roles: an editor writes, an approver publishes, a site administrator runs the site.
Mutamad Security: password policies, lockout, idle logout, security headers and a Content Security Policy.
Mutamad Crypto: AES-256 encryption with keys outside the database, and multi-factor authentication.
Mutamad Logging: structured logs for a SIEM, and scheduled tasks that run on time.
Mutamad Workflow: an editor drafts, another person approves, with an audit trail.
Mutamad Privacy: a cookie notice, and nothing from another site before the visitor agrees.
Mutamad Admin: the administration area, with an audit trail, protected accounts and a trash.

Pages and design

Mutamad Theme: every DGA Platforms Code component, Arabic first and right to left.
Mutamad Theme Setup: the theme on Canvas: page templates and ready-made sections.
Mutamad Canvas: Drupal Canvas, with separation of duties and shared Arabic and English layouts.
Mutamad Canvas Controls: a Canvas change is published by an approver who did not make it.
Mutamad drimage: Canvas images sized to their box and served as WebP.
Mutamad Editor: CKEditor 5 for Arabic and English, filtered and accessible.
Mutamad Media: the media library, focal-point cropping and bulk upload.

Content types of a government site

Mutamad Content Base: the Basic page, and what every content type shares.
Mutamad Services: services, after DGA's Service Page Template.
Mutamad News: news, announcements and circulars.
Mutamad Events: conferences, forums, workshops and webinars.
Mutamad FAQ: frequently asked questions, after DGA's FAQ Template.
Mutamad Resources: reports, guides, policies and forms to download.
Mutamad People: the leadership, with photo, position and biography.
Mutamad Newsletter: a double opt-in newsletter, each issue sent by an approver.
Mutamad Forms: Webform, a Contact form and spam protection that runs on the site.

Language, search and the people who run the site

Mutamad Multilingual: Arabic and English on every site.
Mutamad Search: site search that understands Arabic, on the site's own database.
Mutamad SEO: readable Arabic addresses, meta tags, structured data and sitemaps.
Mutamad Dashboard: a dashboard with Hijri and Gregorian dates for the people who run the site.

Optional, applied when an entity needs it

Mutamad e-Consultations: public consultations, after DGA's e-Participation Template.
Mutamad Life Journeys: life journeys, after DGA's Life Journeys Template.
Mutamad Analytics: Google Analytics, only after the visitor agrees and the entity accepts the data transfer.
Mutamad AI: AI help for editors, from the entity's own model server.
Mutamad Knowledge Base: short, approved answers to what citizens ask.
Mutamad AI Chatbot: a chatbot that answers from the site's published pages only.

Project status

Under active development, on the 1.0.x branch, toward a first release.
Not yet covered by Drupal's security advisory policy.
Next: content classification (DCC 1-2) and field encryption.

Requirements

Drupal 11.4 and PHP 8.4
Composer, and DDEV for local development
A private files directory outside the web root

Documentation and support

The README of each project explains every setting and why.
Report bugs and ask questions in the issue queue; report security issues to the Drupal Security Team, not in public.

Contributing

Issues and merge requests are welcome on every Mutamad project. A change to a control comes with the check that proves it, in mutamad-verify.

Mutamad