Cyber Resilience Fundamental Requirements (CRFR)

Identity and Access Management - 3.3.6 Application Security - 3.3.7 Change Management - 3.3.8 Infrastructure Security - 3.3.9 Cryptography - 3.3.13 Electronic Banking Services - 3.3.14 Cyber Security Event Management - 3.315 Cyber Security Incident Management - 3.3.17 Vulnerability Management 3.3 Resilience Control ID Control requirement description 3.3.1. The Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) should be defined, approved, communicated, implemented and periodically reviewed to enable the entities to continue delivering its critical services, at an acceptable pre-defined level. 3.3.2. Entities should define and implement its backup and restoration requirements considering the following, but not limited to: a. legal and regulatory requirements; b. Critical and customer data; c. business requirements; d. schedule of the backup (daily, weekly, monthly, etc.); e. protection of confidential data stored in back up media through applying encryption techniques; f. storage of backup media offline or at an offsite location; and g. secure destruction of backup data. h. restoration tests. Ref. to other SAMA Framework(s) Business Continuity Management Framework - 2.5 Business Continuity Plan - 2.6 Disaster Recovery Plan -