Strategic architecture for regulated organisations in Saudi Arabia — aligning Azure security controls with NCA requirements and sovereign security standards.