الإطار التنظيمي للأمن السيبراني لمؤسسة النقد العربي السعودي

1 Introduction

1.1 Introduction to the Framework

The current digital society has high expectations of flawless customer experience, continuous availability of services and effective protection of sensitive data. Information assets and online services are now strategically important to all public and private organizations, as well as to broader society. These services are vital to the creation of a vibrant digital economy. They are also becoming systemically important to the economy and to broader national security. All of which underlines the need to safeguard sensitive data and

1.2 Definition of Cyber Security

Cyber security is defined as the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization's information assets against internal and external threats.

The general security objectives comprise the following:

- Confidentiality – Information assets are accessible only to those authorized to have access (i.e., protected from unauthorized disclosure or (un)intended leakage of sensitive data).

2.1 Structure

The Framework is structured around four main domains, namely:

- Cyber Security Leadership and Governance. - Cyber Security Risk Management and Compliance. - Cyber Security Operations and Technology. - Third Party Cyber Security.

For each domain, several subdomains are defined. A subdomain focuses on a specific cyber security topic. Per subdomain, the Framework states a principle, objective and control considerations.

- A principle summarizes the main set of required cyber security controls related to the subdomain. - The objective describes the purpose of the principle