-
Notifications
You must be signed in to change notification settings - Fork 306
/
Copy pathecc-1.yaml
1312 lines (1283 loc) · 61.5 KB
/
ecc-1.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
urn: urn:intuitem:risk:library:ecc-1
locale: en
ref_id: essential-cybersecurity-controls
name: Essential Cybersecurity Controls
description: "The Saudi National Cybersecurity Authority developed the essential cybersecurity\
\ controls (ECC \u2013 1: 2018)\nafter conducting a comprehensive study of multiple\
\ national\nand international cybersecurity frameworks and standards.\nReference:\
\ https://nca.gov.sa/en/legislation?item=191&slug=controls-list"
copyright: "\xA9 NCA"
version: 1
publication_date: 2024-04-19
provider: NCA
packager: intuitem
objects:
framework:
urn: urn:intuitem:risk:framework:ecc-1
ref_id: essential-cybersecurity-controls
name: Essential Cybersecurity Controls
description: Saudi National Cybersecurity Authority framework for essential cybersecurity
controls (ECC)
requirement_nodes:
- urn: urn:intuitem:risk:req_node:ecc-1:1
assessable: false
depth: 1
ref_id: '1'
name: Cybersecurity Governance
- urn: urn:intuitem:risk:req_node:ecc-1:1-1
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ecc-1:1
ref_id: 1-1
name: Cybersecurity Strategy
description: To ensure that cybersecurity plans, goals, initiatives and projects
are contributing to compliance with related laws and regulations.
- urn: urn:intuitem:risk:req_node:ecc-1:1-1-1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-1
ref_id: 1-1-1
description: A cybersecurity strategy must be defined, documented and approved.
It must be supported by the head of the organization or his/her delegate (referred
to in this document as Authorizing Official). The strategy goals must be in-line
with related laws and regulations.
- urn: urn:intuitem:risk:req_node:ecc-1:1-1-2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-1
ref_id: 1-1-2
description: A roadmap must be executed to implement the cybersecurity strategy.
- urn: urn:intuitem:risk:req_node:ecc-1:1-1-3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-1
ref_id: 1-1-3
description: The cybersecurity strategy must be reviewed periodically according
to planned intervals or upon changes to related laws and regulations.
- urn: urn:intuitem:risk:req_node:ecc-1:1-2
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ecc-1:1
ref_id: 1-2
name: Cybersecurity Management
description: To ensure Authorizing Official's support in implementing and managing
cybersecurity programs within the organization as per related laws and regulations
- urn: urn:intuitem:risk:req_node:ecc-1:1-2-1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-2
ref_id: 1-2-1
description: A dedicated cybersecurity function (e.g., division, department)
must be established within the organization. This function must be independent
from the Information Technology/Information Communication and Technology (IT/ICT)
functions (as per the Royal Decree number 37140 dated 14/8/1438H). It is highly
recommended that this cybersecurity function reports directly to the head
of the organization or his/her delegate while ensuring that this does not
result in a conflict of interest.
- urn: urn:intuitem:risk:req_node:ecc-1:1-2-2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-2
ref_id: 1-2-2
description: The position of cybersecurity function head (e.g., CISO), and related
supervisory and critical positions within the function, must be filled with
full-time and experienced Saudi cybersecurity professionals.
- urn: urn:intuitem:risk:req_node:ecc-1:1-2-3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-2
ref_id: 1-2-3
description: A cybersecurity steering committee must be established by the Authorizing
Official to ensure the support and implementation of the cybersecurity programs
and initiatives within the organization. Committee members, roles and responsibilities,
and governance framework must be defined, documented and approved. The committee
must include the head of the cybersecurity function as one of its members.
It is highly recommended that the committee reports directly to the head of
the organization or his/her delegate while ensuring that this does not result
in a conflict of interest.
- urn: urn:intuitem:risk:req_node:ecc-1:1-3
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ecc-1:1
ref_id: 1-3
name: Cybersecurity Policies and Procedures
description: To ensure that cybersecurity requirements are documented, communicated
and complied with by the organization as per related laws and regulations,
and organizational requirements.
- urn: urn:intuitem:risk:req_node:ecc-1:1-3-1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-3
ref_id: 1-3-1
description: Cybersecurity policies and procedures must be defined and documented
by the cybersecurity function, approved by the Authorizing Official, and disseminated
to relevant parties inside and outside the organization.
- urn: urn:intuitem:risk:req_node:ecc-1:1-3-2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-3
ref_id: 1-3-2
description: The cybersecurity function must ensure that the cybersecurity policies
and procedures are implemented.
- urn: urn:intuitem:risk:req_node:ecc-1:1-3-3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-3
ref_id: 1-3-3
description: The cybersecurity policies and procedures must be supported by
technical security standards (e.g., operating systems, databases and firewall
technical security standards).
- urn: urn:intuitem:risk:req_node:ecc-1:1-3-4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-3
ref_id: 1-3-4
description: The cybersecurity policies and procedures must be reviewed periodically
according to planned intervals or upon changes to related laws and regulations.
Changes and reviews must be approved and documented.
- urn: urn:intuitem:risk:req_node:ecc-1:1-4
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ecc-1:1
ref_id: 1-4
name: Cybersecurity Roles and Responsibilities
description: To ensure that roles and responsibilities are defined for all parties
participating in implementing the cybersecurity controls within the organization.
- urn: urn:intuitem:risk:req_node:ecc-1:1-4-1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-4
ref_id: 1-4-1
description: Cybersecurity organizational structure and related roles and responsibilities
must be defined, documented, approved, supported and assigned by the Authorizing
Official while ensuring that this does not result in a conflict of interest.
- urn: urn:intuitem:risk:req_node:ecc-1:1-4-2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-4
ref_id: 1-4-2
description: The cybersecurity roles and responsibilities must be reviewed periodically
according to planned intervals or upon changes to related laws and regulations.
- urn: urn:intuitem:risk:req_node:ecc-1:1-5
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ecc-1:1
ref_id: 1-5
name: Cybersecurity Risk Management
description: To ensure managing cybersecurity risks in a methodological approach
in order to protect the organization's information and technology assets as
per organizational policies and procedures, and related laws and regulations.
- urn: urn:intuitem:risk:req_node:ecc-1:1-5-1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-5
ref_id: 1-5-1
description: Cybersecurity risk management methodology and procedures must be
defined, documented and approved as per confidentiality, integrity and availability
considerations of information and technology assets.
- urn: urn:intuitem:risk:req_node:ecc-1:1-5-2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-5
ref_id: 1-5-2
description: The cybersecurity risk management methodology and procedures must
be implemented by the cybersecurity function.
- urn: urn:intuitem:risk:req_node:ecc-1:1-5-3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-5
ref_id: 1-5-3
description: 'The cybersecurity risk assessment procedures must be implemented
at least in the following cases: 1-5-3-1 Early stages of technology projects.
1-5-3-2 Before making major changes to technology infrastructure. 1-5-3-3
During the planning phase of obtaining third party services. 1-5-3-4 During
the planning phase and before going live for new technology services and products.'
- urn: urn:intuitem:risk:req_node:ecc-1:1-5-4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-5
ref_id: 1-5-4
description: The cybersecurity risk management methodology and procedures must
be reviewed periodically according to planned intervals or upon changes to
related laws and regulations. Changes and reviews must be approved and documented.
- urn: urn:intuitem:risk:req_node:ecc-1:1-6
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ecc-1:1
ref_id: 1-6
name: Cybersecurity in Information and Technology Project Management
description: To ensure that cybersecurity requirements are included in project
management methodology and procedures in order to protect the confidentiality,
integrity and availability of information and technology assets as per organization
policies and procedures, and related laws and regulations.
- urn: urn:intuitem:risk:req_node:ecc-1:1-6-1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-6
ref_id: 1-6-1
description: Cybersecurity requirements must be included in project and asset
(information/ technology) change management methodology and procedures to
identify and manage cybersecurity risks as part of project management lifecycle.
The cybersecurity requirements must be a key part of the overall requirements
of technology projects.
- urn: urn:intuitem:risk:req_node:ecc-1:1-6-2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-6
ref_id: 1-6-2
description: 'The cybersecurity requirements in project and assets (information/technology)
change management must include at least the following: 1-6-2-1 Vulnerability
assessment and remediation. 1-6-2-2 Conducting a configurations'' review,
secure configuration and hardening and patching before changes or going live
for technology projects.'
- urn: urn:intuitem:risk:req_node:ecc-1:1-6-3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-6
ref_id: 1-6-3
description: 'The cybersecurity requirements related to software and application
development projects must include at least the following: 1-6-3-1 Using secure
coding standards. 1-6-3-2 Using trusted and licensed sources for software
development tools and libraries. 1-6-3-3 Conducting compliance test for software
against the defined organizational cybersecurity requirements. 1-6-3-4 Secure
integration between software components. 1-6-3-5 Conducting a configurations''
review, secure configuration and hardening and patching before going live
for software products.'
- urn: urn:intuitem:risk:req_node:ecc-1:1-6-4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-6
ref_id: 1-6-4
description: The cybersecurity requirements in project management must be reviewed
periodically.
- urn: urn:intuitem:risk:req_node:ecc-1:1-7
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ecc-1:1
ref_id: 1-7
name: Compliance with Cybersecurity Standards, Laws and Regulations
description: To ensure that the organization's cybersecurity program is in compliance
with related laws and regulations.
- urn: urn:intuitem:risk:req_node:ecc-1:1-7-1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-7
ref_id: 1-7-1
description: The organization must comply with related national cybersecurity
laws and regulations.
- urn: urn:intuitem:risk:req_node:ecc-1:1-7-2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-7
ref_id: 1-7-2
description: The organization must comply with any nationally-approved international
agreements and commiments related to cybersecurity.
- urn: urn:intuitem:risk:req_node:ecc-1:1-8
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ecc-1:1
ref_id: 1-8
name: Periodical Cybersecurity Review and Audit
description: To ensure that cybersecurity controls are implemented and in compliance
with organizational policies and procedures, as well as related national and
international laws, regulations and agreements.
- urn: urn:intuitem:risk:req_node:ecc-1:1-8-1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-8
ref_id: 1-8-1
description: Cybersecurity reviews must be conducted periodically by the cybersecurity
function in the organization to assess the compliance with the cybersecurity
controls in the organization.
- urn: urn:intuitem:risk:req_node:ecc-1:1-8-2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-8
ref_id: 1-8-2
description: Cybersecurity audits and reviews must be conducted by independent
parties outside the cybersecurity function (e.g., Internal Audit function)
to assess the compliance with the cybersecurity controls in the organization.
Audits and reviews must be conducted independently, while ensuring that this
does not result in a conflict of interest, as per the Generally Accepted Auditing
Standards (GAAS), and related laws and regulations.
- urn: urn:intuitem:risk:req_node:ecc-1:1-8-3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-8
ref_id: 1-8-3
description: Results from the cybersecurity audits and reviews must be documented
and presented to the cybersecurity steering committee and Authorizing Official.
Results must include the audit/review scope, observations, recommendations
and remediation plans.
- urn: urn:intuitem:risk:req_node:ecc-1:1-9
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ecc-1:1
ref_id: 1-9
name: Cybersecurity in Human Resources
description: To ensure that cybersecurity risks and requirements related to
personnel (employees and contractors) are managed efficiently prior to employment,
during employment and after termination/separation as per organizational policies
and procedures, and related laws and regulations.
- urn: urn:intuitem:risk:req_node:ecc-1:1-9-1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-9
ref_id: 1-9-1
description: Personnel cybersecurity requirements (prior to employment, during
employment and after termination/separation) must be defined, documented and
approved.
- urn: urn:intuitem:risk:req_node:ecc-1:1-9-2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-9
ref_id: 1-9-2
description: The personnel cybersecurity requirements must be implemented.
- urn: urn:intuitem:risk:req_node:ecc-1:1-9-3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-9
ref_id: 1-9-3
description: 'The personnel cybersecurity requirements prior to employment must
include at least the following: 1-9-3-1 Inclusion of personnel cybersecurity
responsibilities and non-disclosure clauses (covering the cybersecurity requirements
during employment and after termination/ separation) in employment contracts.
1-9-3-2 Screening or vetting candidates of cybersecurity and critical/privileged
positions.'
- urn: urn:intuitem:risk:req_node:ecc-1:1-9-4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-9
ref_id: 1-9-4
description: 'The personnel cybersecurity requirements during employment must
include at least the following: 1-9-4-1 Cybersecurity awareness (during on-boarding
and during employment). 1-9-4-2 Implementation of and compliance with the
cybersecurity requirements as per the organizational cybersecurity policies
and procedures.'
- urn: urn:intuitem:risk:req_node:ecc-1:1-9-5
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-9
ref_id: 1-9-5
description: Personnel access to information and technology assets must be reviewed
and removed immediately upon termination/separation.
- urn: urn:intuitem:risk:req_node:ecc-1:1-9-6
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-9
ref_id: 1-9-6
description: Personnel cybersecurity requirements must be reviewed periodically.
- urn: urn:intuitem:risk:req_node:ecc-1:1-10
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ecc-1:1
ref_id: 1-10
name: Cybersecurity Awareness and Training Program
description: To ensure that personnel are aware of their cybersecurity responsibilities
and have the essential cybersecurity awareness. It is also to ensure that
personnel are provided with the required cybersecurity training, skills and
credentials needed to accomplish their cybersecurity responsibilities and
to protect the organization's information and technology assets.
- urn: urn:intuitem:risk:req_node:ecc-1:1-10-1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-10
ref_id: 1-10-1
description: A cybersecurity awareness program must be developed and approved.
The program must be conducted periodically through multiple channels to strengthen
the awareness about cybersecurity, cyber threats and risks, and to build a
positive cybersecurity awareness culture.
- urn: urn:intuitem:risk:req_node:ecc-1:1-10-2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-10
ref_id: 1-10-2
description: The cybersecurity awareness program must be implemented.
- urn: urn:intuitem:risk:req_node:ecc-1:1-10-3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-10
ref_id: 1-10-3
description: 'The cybersecurity awareness program must cover the latest cyber
threats and how to protect against them, and must include at least the following
subjects:
1-10-3-1 Secure handling of email services, especially phishing emails.
1-10-3-2 Secure handling of mobile devices and storage media.
1-10-3-3 Secure Internet browsing. 1-10-3-4 Secure use of social media.'
- urn: urn:intuitem:risk:req_node:ecc-1:1-10-4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-10
ref_id: 1-10-4
description: 'Essential and customized (i.e., tailored to job functions as it
relates to cybersecurity) training and access to professional skillsets must
be made available to personnel working directly on tasks related to cybersecurity
including: 1-10-4-1 Cybersecurity function''s personnel.
1-10-4-2 Personnel working on software/application development. and information
and technology assets operations. 1-10-4-3 Executive and supervisory positions.'
- urn: urn:intuitem:risk:req_node:ecc-1:1-10-5
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:1-10
ref_id: 1-10-5
description: The implementation of the cybersecurity awareness program must
be reviewed periodically.
- urn: urn:intuitem:risk:req_node:ecc-1:2
assessable: false
depth: 1
ref_id: '2'
name: Cybersecurity Defense
- urn: urn:intuitem:risk:req_node:ecc-1:2-1
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ecc-1:2
ref_id: 2-1
name: Asset Management
description: To ensure that the organization has an accurate and detailed inventory
of information and technology assets in order to support the organization's
cybersecurity and operational requirements to maintain the confidentiality,
integrity and availability of information and technology assets.
- urn: urn:intuitem:risk:req_node:ecc-1:2-1-1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-1
ref_id: 2-1-1
description: Cybersecurity requirements for managing information and technology
assets must be defined, documented and approved.
- urn: urn:intuitem:risk:req_node:ecc-1:2-1-2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-1
ref_id: 2-1-2
description: The cybersecurity requirements for managing information and technology
assets must be implemented.
- urn: urn:intuitem:risk:req_node:ecc-1:2-1-3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-1
ref_id: 2-1-3
description: Acceptable use policy of information and technology assets must
be defined, documented and approved.
- urn: urn:intuitem:risk:req_node:ecc-1:2-1-4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-1
ref_id: 2-1-4
description: Acceptable use policy of information and technology assets must
be implemented.
- urn: urn:intuitem:risk:req_node:ecc-1:2-1-5
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-1
ref_id: 2-1-5
description: Information and technology assets must be classified, labeled and
handled as per related law and regulatory requirements.
- urn: urn:intuitem:risk:req_node:ecc-1:2-1-6
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-1
ref_id: 2-1-6
description: The cybersecurity requirements for managing information and technology
assets must be reviewed periodically.
- urn: urn:intuitem:risk:req_node:ecc-1:2-2
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ecc-1:2
ref_id: 2-2
name: Identity and Access Management
description: To ensure the secure and restricted logical access to information
and technology assets in order to prevent unauthorized access and allow only
authorized access for users which are necessary to accomplish assigned tasks.
- urn: urn:intuitem:risk:req_node:ecc-1:2-2-1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-2
ref_id: 2-2-1
description: Cybersecurity requirements for identity and access management must
be defined, documented and approved.
- urn: urn:intuitem:risk:req_node:ecc-1:2-2-2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-2
ref_id: 2-2-2
description: The cybersecurity requirements for identity and access management
must be implemented.
- urn: urn:intuitem:risk:req_node:ecc-1:2-2-3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-2
ref_id: 2-2-3
description: 'The cybersecurity requirements for identity and access management
must include at least the following 2-2-3-1 User authentication based on username
and password. 2-2-3-2 Multi-factor authentication for remote access. 2-2-3-3
User authorization based on identity and access control principles: Need-to-Know
and Need-to-Use, Least Privilege and Segregation of Duties. 2-2-3-4 Privileged
access management. 2-2-3-5 Periodic review of users'' identities and access
rights.'
- urn: urn:intuitem:risk:req_node:ecc-1:2-2-4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-2
ref_id: 2-2-4
description: The Implementation of the cybersecurity requirements for identity
and access management must be reviewed periodically.
- urn: urn:intuitem:risk:req_node:ecc-1:2-3
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ecc-1:2
ref_id: 2-3
name: Information System and Information Processing Facilities Protection
description: To ensure the protection of information systems and information
processing facilities (including workstations and infrastructures) against
cyber risks.
- urn: urn:intuitem:risk:req_node:ecc-1:2-3-1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-3
ref_id: 2-3-1
description: Cybersecurity requirements for protecting information systems and
information processing facilities must be defined, documented and approved.
- urn: urn:intuitem:risk:req_node:ecc-1:2-3-2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-3
ref_id: 2-3-2
description: The cybersecurity requirements for protecting information systems
and information processing facilities must be implemented.
- urn: urn:intuitem:risk:req_node:ecc-1:2-3-3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-3
ref_id: 2-3-3
description: 'The cybersecurity requirements for protecting information systems
and information processing facilities must include at least the following:
2-3-3-1 Advanced, up-to-date and secure management of malware and virus protection
on servers and workstations.
2-3-3-2 Restricted use and secure handling of external storage media. 2-3-3-3
Patch management for information systems, software and devices. 2-3-3-4 Centralized
clock synchronization with an accurate and trusted source (e.g., Saudi Standards,
Metrology and Quality Organization (SASO)).'
- urn: urn:intuitem:risk:req_node:ecc-1:2-3-4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-3
ref_id: 2-3-4
description: The cybersecurity requirements for protecting information systems
and information processing facilities must be reviewed periodically.
- urn: urn:intuitem:risk:req_node:ecc-1:2-4
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ecc-1:2
ref_id: 2-4
name: Email Protection
description: To ensure the protection of organization's email service from cyber
risks.
- urn: urn:intuitem:risk:req_node:ecc-1:2-4-1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-4
ref_id: 2-4-1
description: Cybersecurity requirements for protecting email service must be
defined, documented and approved.
- urn: urn:intuitem:risk:req_node:ecc-1:2-4-2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-4
ref_id: 2-4-2
description: The cybersecurity requirements for email service must be implemented.
- urn: urn:intuitem:risk:req_node:ecc-1:2-4-3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-4
ref_id: 2-4-3
description: 'The cybersecurity requirements for protecting the email service
must include at the least the following: 2-4-3-1 Analyzing and filtering email
messages (specifically phishing emails and spam) using advanced and up-to-date
email protection techniques.
2-4-3-2 Multi-factor authentication for remote and webmail access to email
service. 2-4-3-3 Email archiving and backup. 2-4-3-4 Secure management and
protection against Advanced Persistent Threats (APT), which normally utilize
zero-day viruses and malware. 2-4-3-5 Validation of the organization''s email
service domains (e.g., using Sender Policy Framework (SPF)).'
- urn: urn:intuitem:risk:req_node:ecc-1:2-4-4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-4
ref_id: 2-4-4
description: The cybersecurity requirements for email service must be reviewed
periodically.
- urn: urn:intuitem:risk:req_node:ecc-1:2-5
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ecc-1:2
ref_id: 2-5
name: Networks Security Management
description: To ensure the protection of organization's network from cyber risks.
- urn: urn:intuitem:risk:req_node:ecc-1:2-5-1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-5
ref_id: 2-5-1
description: Cybersecurity requirements for network security management must
be defined, documented and approved.
- urn: urn:intuitem:risk:req_node:ecc-1:2-5-2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-5
ref_id: 2-5-2
description: The cybersecurity requirements for network security management
must be implemented.
- urn: urn:intuitem:risk:req_node:ecc-1:2-5-3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-5
ref_id: 2-5-3
description: 'The cybersecurity requirements for network security management
must include at least the following: 2-5-3-1 Logical or physical segregation
and segmentation of network segments using firewalls and defense-in-depth
principles.
2-5-3-2 Network segregation between production, test and development environments.
2-5-3-3 Secure browsing and Internet connectivity including restrictions on
the use of file storage/sharing and remote access websites, and protection
against suspicious websites.
2-5-3-4 Wireless network protection using strong authentication and encryption
techniques. A comprehensive risk assessment and management exercise must be
conducted to assess and manage the cyber risks prior to connecting any wireless
networks to the organization''s internal network. 2-5-3-5 Management and restrictions
on network services, protocols and ports. 2-5-3-6 Intrusion Prevention Systems
(IPS). 2-5-3-7 Security of Domain Name Service (DNS). 2-5-3-8 Secure management
and protection of Internet browsing channel against Advanced Persistent Threats
(APT), which normally utilize zero-day viruses and malware.'
- urn: urn:intuitem:risk:req_node:ecc-1:2-5-4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-5
ref_id: 2-5-4
description: The cybersecurity requirements for network security management
must be reviewed periodically.
- urn: urn:intuitem:risk:req_node:ecc-1:2-6
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ecc-1:2
ref_id: 2-6
name: Mobile Devices Security
description: To ensure the protection of mobile devices (including laptops,
smartphones, tablets) from cyber risks and to ensure the secure handling of
the organization's information (including sensitive information) while utilizing
Bring Your Own Device (BYOD) policy.
- urn: urn:intuitem:risk:req_node:ecc-1:2-6-1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-6
ref_id: 2-6-1
description: Cybersecurity requirements for mobile devices security and BYOD
must be defined, documented and approved.
- urn: urn:intuitem:risk:req_node:ecc-1:2-6-2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-6
ref_id: 2-6-2
description: The cybersecurity requirements for mobile devices security and
BYOD must be implemented.
- urn: urn:intuitem:risk:req_node:ecc-1:2-6-3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-6
ref_id: 2-6-3
description: 'The cybersecurity requirements for mobile devices security and
BYOD must include at least the following: 2-6-3-1 Separation and encryption
of organization''s data and information stored on mobile devices and BYODs.
2-6-3-2 Controlled and restricted use based on job requirements. 2-6-3-3 Secure
wiping of organization''s data and information stored on mobile devices and
BYOD in cases of device loss, theft or after termination/separation from the
organization. 2-6-3-4 Security awareness for mobile devices users.'
- urn: urn:intuitem:risk:req_node:ecc-1:2-6-4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-6
ref_id: 2-6-4
description: The cybersecurity requirements for mobile devices security and
BYOD must be reviewed periodically.
- urn: urn:intuitem:risk:req_node:ecc-1:2-7
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ecc-1:2
ref_id: 2-7
name: Data and Information Protection
description: To ensure the confidentiality, integrity and availability of organization's
data and information as per organizational policies and procedures, and related
laws and regulations.
- urn: urn:intuitem:risk:req_node:ecc-1:2-7-1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-7
ref_id: 2-7-1
description: Cybersecurity requirements for protecting and handling data and
information must be defined, documented and approved as per the related laws
and regulations.
- urn: urn:intuitem:risk:req_node:ecc-1:2-7-2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-7
ref_id: 2-7-2
description: The cybersecurity requirements for protecting and handling data
and information must be implemented.
- urn: urn:intuitem:risk:req_node:ecc-1:2-7-3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-7
ref_id: 2-7-3
description: 'The cybersecurity requirements for protecting and handling data
and information must include at least the following: 2-7-3-1 Data and information
ownership. 2-7-3-2 Data and information classification and labeling mechanisms.
2-7-3-3 Data and information privacy.'
- urn: urn:intuitem:risk:req_node:ecc-1:2-7-4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-7
ref_id: 2-7-4
description: The cybersecurity requirements for protecting and handling data
and information must be reviewed periodically.
- urn: urn:intuitem:risk:req_node:ecc-1:2-8
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ecc-1:2
ref_id: 2-8
name: Cryptography
description: To ensure the proper and efficient use of cryptography to protect
information assets as per organizational policies and procedures, and related
laws and regulations.
- urn: urn:intuitem:risk:req_node:ecc-1:2-8-1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-8
ref_id: 2-8-1
description: Cybersecurity requirements for cryptography must be defined, documented
and approved.
- urn: urn:intuitem:risk:req_node:ecc-1:2-8-2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-8
ref_id: 2-8-2
description: The cybersecurity requirements for cryptography must be implemented.
- urn: urn:intuitem:risk:req_node:ecc-1:2-8-3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-8
ref_id: 2-8-3
description: 'The cybersecurity requirements for cryptography must include at
least the following: 2-8-3-1 Approved cryptographic solutions standards and
its technical and regulatory limitations. 2-8-3-2 Secure management of cryptographic
keys during their lifecycles.
2-8-3-3 Encryption of data in-transit and at-rest as per classification and
related laws and regulations.'
- urn: urn:intuitem:risk:req_node:ecc-1:2-8-4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-8
ref_id: 2-8-4
description: The cybersecurity requirements for cryptography must be reviewed
periodically.
- urn: urn:intuitem:risk:req_node:ecc-1:2-9
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ecc-1:2
ref_id: 2-9
name: Backup and Recovery Management
description: To ensure the protection of organization's data and information
including information systems and software configurations from cyber risks
as per organizational policies and procedures, and related laws and regulations.
- urn: urn:intuitem:risk:req_node:ecc-1:2-9-1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-9
ref_id: 2-9-1
description: Cybersecurity requirements for backup and recovery management must
be defined, documented and approved.
- urn: urn:intuitem:risk:req_node:ecc-1:2-9-2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-9
ref_id: 2-9-2
description: The cybersecurity requirements for backup and recovery management
must be implemented.
- urn: urn:intuitem:risk:req_node:ecc-1:2-9-3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-9
ref_id: 2-9-3
description: 'The cybersecurity requirements for backup and recovery management
must include at least the following:
2-9-3-1 Scope and coverage of backups to cover critical technology and information
assets.
2-9-3-2 Ability to perform quick recovery of data and systems after cybersecurity
incidents. 2-9-3-3 Periodic tests of backup''s recovery effectiveness.'
- urn: urn:intuitem:risk:req_node:ecc-1:2-9-4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-9
ref_id: 2-9-4
description: The cybersecurity requirements for backup and recovery management
must be reviewed periodically.
- urn: urn:intuitem:risk:req_node:ecc-1:2-10
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ecc-1:2
ref_id: 2-10
name: Vulnerabilities Management
description: To ensure timely detection and effective remediation of technical
vulnerabilities to prevent or minimize the probability of exploiting these
vulnerabilities to launch cyber attacks against the organization.
- urn: urn:intuitem:risk:req_node:ecc-1:2-10-1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-10
ref_id: 2-10-1
description: Cybersecurity requirements for technical vulnerabilities management
must be defined, documented and approved.
- urn: urn:intuitem:risk:req_node:ecc-1:2-10-2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-10
ref_id: 2-10-2
description: The cybersecurity requirements for technical vulnerabilities management
must be implemented.
- urn: urn:intuitem:risk:req_node:ecc-1:2-10-3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-10
ref_id: 2-10-3
description: 'The cybersecurity requirements for technical vulnerabilities management
must include at least the following: 2-10-3-1 Periodic vulnerabilities assessments.
2-10-3-2 Vulnerabilities classification based on criticality level. 2-10-3-3
Vulnerabilities remediation based on classification and associated risk levels.
2-10-3-4 Security patch management. 2-10-3-5 Subscription with authorized
and trusted cybersecurity resources for up-to-date information and notifications
on technical vulnerabilities.'
- urn: urn:intuitem:risk:req_node:ecc-1:2-10-4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-10
ref_id: 2-10-4
description: The cybersecurity requirements for technical vulnerabilities management
must be reviewed periodically.
- urn: urn:intuitem:risk:req_node:ecc-1:2-11
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ecc-1:2
ref_id: 2-11
name: Penetration Testing
description: To assess and evaluate the efficiency of the organization's cybersecurity
defense capabilities through simulated cyber-attacks to discover unknown weaknesses
within the technical infrastructure that may lead to a cyber breach.
- urn: urn:intuitem:risk:req_node:ecc-1:2-11-1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-11
ref_id: 2-11-1
description: Cybersecurity requirements for penetration testing exercises must
be defined, documented and approved.
- urn: urn:intuitem:risk:req_node:ecc-1:2-11-2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-11
ref_id: 2-11-2
description: The cybersecurity requirements for penetration testing processes
must be implemented.
- urn: urn:intuitem:risk:req_node:ecc-1:2-11-3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-11
ref_id: 2-11-3
description: 'The cybersecurity requirements for penetration testing processes
must include at least the following:
2-11-3-1 Scope of penetration tests which must cover Internet-facing services
and its technical components including infrastructure, websites, web applications,
mobile apps, email and remote access.
2-11-3-2 Conducting penetration tests periodically.'
- urn: urn:intuitem:risk:req_node:ecc-1:2-11-4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-11
ref_id: 2-11-4
description: Cybersecurity requirements for penetration testing processes must
be reviewed periodically.
- urn: urn:intuitem:risk:req_node:ecc-1:2-12
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ecc-1:2
ref_id: 2-12
name: Cybersecurity Event Logs and Monitoring Management
description: To ensure timely collection, analysis and monitoring of cybersecurity
events for early detection of potential cyber-attacks in order to prevent
or minimize the negative impacts on the organization's operations.
- urn: urn:intuitem:risk:req_node:ecc-1:2-12-1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-12
ref_id: 2-12-1
description: Cybersecurity requirements for event logs and monitoring management
must be defined, documented and approved.
- urn: urn:intuitem:risk:req_node:ecc-1:2-12-2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-12
ref_id: 2-12-2
description: The cybersecurity requirements for event logs and monitoring management
must be implemented.
- urn: urn:intuitem:risk:req_node:ecc-1:2-12-3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-12
ref_id: 2-12-3
description: 'The cybersecurity requirements for event logs and monitoring management
must include at least the following:
2-12-3-1 Activation of cybersecurity event logs on critical information assets.
2-12-3-2 Activation of cybersecurity event logs on remote access and privileged
user accounts. 2-12-3-3 Identification of required technologies (e.g., SIEM)
for cybersecurity event logs collection. 2-12-3-4 Continuous monitoring of
cybersecurity events. 2-12-3-5 Retention period for cybersecurity event logs
(must be 12 months minimum).'
- urn: urn:intuitem:risk:req_node:ecc-1:2-12-4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-12
ref_id: 2-12-4
description: The cybersecurity requirements for event logs and monitoring management
must be reviewed periodically.
- urn: urn:intuitem:risk:req_node:ecc-1:2-13
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ecc-1:2
ref_id: 2-13
name: Cybersecurity Incident and Threat Management
description: To ensure timely identification, detection, effective management
and handling of cybersecurity incidents and threats to prevent or minimize
negative impacts on organization's operation taking into consideration the
Royal Decree number 37140, dated 14/8/1438H.
- urn: urn:intuitem:risk:req_node:ecc-1:2-13-1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-13
ref_id: 2-13-1
description: Requirements for cybersecurity incidents and threat management
must be defined, documented and approved.
- urn: urn:intuitem:risk:req_node:ecc-1:2-13-2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-13
ref_id: 2-13-2
description: The requirements for cybersecurity incidents and threat management
must be implemented.
- urn: urn:intuitem:risk:req_node:ecc-1:2-13-3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:ecc-1:2-13
ref_id: 2-13-3
description: 'The requirements for cybersecurity incidents and threat management
must include at least the following:
2-13-3-1 Cybersecurity incident response plans and escalation procedures.
2-13-3-2 Cybersecurity incidents classification. 2-13-3-3 Cybersecurity incidents
reporting to NCA.