Runs an essential service, in Saudi Arabia

Essential Cybersecurity Controls (ECC-2:2024), Control 2-13 · Read the law's page

• Identify, document, approve and implement requirements for cybersecurity incident and threat management that include cybersecurity incident response plans and escalation procedures and cybersecurity incident classification (Control 2-13).
• Include in those requirements reporting cybersecurity incidents to the National Cybersecurity Authority (Control 2-13-3, item 2.13.3.3).
• Include in those requirements sharing cybersecurity incident notifications, threat intelligence, penetration indicators, and incident reports with the National Cybersecurity Authority (Control 2-13-3, item 2.13.3.4).
• This binds a private sector entity that owns, operates or hosts Critical National Infrastructure in Saudi Arabia, and a government agency and its affiliated companies and entities (reached by declaring that you operate an essential service); every other entity is only encouraged to adopt the Controls (ECC Scope of Work).

Essential Cybersecurity Controls (ECC-2:2024), Scope of Work and Applicability and Controls 2-10 and 2-11 · Read the law's page

• Take all necessary measures to ensure ongoing and continuous compliance with the Essential Cybersecurity Controls (Implementation and Compliance).
• Identify, document, approve and implement cybersecurity requirements for technical vulnerabilities management that include, at a minimum, periodic vulnerabilities assessment and detection, classification by severity, remediation based on classification and cyber risk, patch management with updates verified in a non-production environment before they are applied, and subscription to trusted sources for new vulnerabilities (Control 2-10).
• Include in penetration testing requirements all externally provided services over the Internet, including infrastructure, websites, web applications, smartphone and tablet applications, email and remote access, and test periodically (Control 2-11-3).
• Include in the cybersecurity requirements for software and application development projects secure coding standards, trusted and licensed sources for development tools and libraries, compliance testing of the software against the entity's cybersecurity requirements, secure integration between applications, and review of secure configuration, hardening and update packages before launch (Control 1-6-3).
• Meet at least the NCA's National Cryptographic Standards for cryptography, including encryption of data in transit and at rest according to its classification, use multi-factor authentication for remote access and privileged accounts, and use a web application firewall for external web applications (Controls 2-8-3, 2-2-3 and 2-15-3).
• Monitor cybersecurity event logs continuously and keep them for at least 12 months (Control 2-12-3).
• Fill all cybersecurity positions with full-time and qualified Saudi cybersecurity professionals (Control 1-2-2).
• Require third parties providing IT or cybersecurity outsourcing or managed services, by contract, to locate managed cybersecurity service centers for monitoring and operations that use remote access fully in the Kingdom of Saudi Arabia (Control 4-1-3, item 4.1.3.2).
• Expect the National Cybersecurity Authority to evaluate your compliance through self-assessment, periodic reports of the compliance tool, or field auditing visits (Implementation and Compliance).
• This binds a private sector entity that owns, operates or hosts Critical National Infrastructure in Saudi Arabia, and a government agency and its affiliated companies and entities (reached by declaring that you operate an essential service); every other entity is only encouraged to adopt the Controls (ECC Scope of Work).