Cyber Resilience Fundamental Requirements (CRFR)

Cyber Security Leadership and Governance Control ID Control requirement description 3.1.1. Entities should develop a robust Cyber Security Governance structure that is supported with appropriate resources to oversee and control overall approach to cyber security. 3.1.2. Entities should define, approve, implement and communicate cyber security policies and procedures that is supported by detailed security standards (e.g. password standard, firewall standard). 3.1.3. Entities should periodically review and update cyber security policies, procedures and standards taking into consideration the evolving cyber threat landscape. 3.1.4. Entities should incorporate cyber security requirements in their new and/or existing business operating model, including at least: a. evaluation of cyber security and fraud risks that could target business operating model; and b. adoption and evaluation of cyber security measures for the protection against adversarial attacks (e.g. model stealing, malicious inputs, and poisoning attack). 3.1.5. Entities should establish and implement strong password policy for users’ access to its information assets, such as: a. change of password upon first logon, minimum password length and history and password complexity; b. revoking the access after the three successive incorrect passwords; and c. use non-caching techniques. 3.1.6. Entities should execute comprehensive IT and cyber security risk assessments covering (infrastructure, network, applications, and systems) and the controls implemented to address the identified risks. The identified risks should be documented in a central register, and periodically monitored and reviewed. Ref. to other SAMA Framework(s) Cyber Security Framework - 3.1.1 Cyber Security Governance - 3.1.3 Cyber Security Policy - 3.2.1 Cyber Security Risk Management