NCA Critical Systems
Cybersecurity Controls

In addition to the controls in ECC subdomain 1-1, the organization's cybersecurity strategy must prioritize the support of protecting its critical systems.

Conducting a cybersecurity risk assessment on critical systems at least once annually.

Creating a cybersecurity risk register for critical systems, and reviewing it at least once every month.

Conducting a stress test to ensure the capacity of the various components.

Ensuring the implementation of business continuity requirements.

Conducting a security source code review before the critical system release.

Securing the access, storage, documentation and releases of source code.

Securing the authenticated Application Programming Interface (API).

Secure and trusted migration of applications from testing environments to production environments, along with deletion of any data, IDs or passwords related to the testing environment before the migration.

With reference to ECC control 1-8-1, the organization's cybersecurity function must review the implementation of CSCC at least once annually.

With reference to ECC control 1-8-2, the implementation of CSCC must be reviewed by independent parties within the organization, outside the cybersecurity function at least once every three years.

Screening or vetting candidates for working on critical systems.

The technical support and development positions for critical systems, must be filled with experienced Saudi professionals.

Maintaining an annually-updated inventory of critical systems' assets.

Identifying assets owners and involving them in the asset management lifecycle for critical systems.

Prohibiting remote access from outside the Kingdom of Saudi Arabia.

Restricting remote access from inside the Kingdom of Saudi Arabia and verifying each access attempt by the organization's security operations center, and continuously monitoring activities related to remote access.

Using multi-factor authentication for all users.

Using multi-factor authentication for privileged users, and on systems utilized for managing critical systems stated in control 2-3-1-4.

Developing and implementing a high-standard and secure password policy.

Utilizing secure methods and algorithms for storing and processing passwords, such as: Hashing functions.

Securely managing service accounts for applications and systems, and disabling interactive login from these accounts.

Prohibiting direct access and interaction with databases for all users except for database administrators. Users' access and interaction with databases must be through applications only, with consideration given to applying security solutions that limit or prohibit visibility of classified data to database administrators.

With reference to ECC subcontrol 2-2-3-5, user identities and access rights to critical systems must be reviewed at least once every three months.

Whitelisting of application and software operation files that are allowed to execute on servers hosting critical systems.

Protecting servers hosting critical systems using end-point protection solutions that are approved by the organization.

Applying security patches and updates at least once every month for external and internet-connected critical systems and at least once every three months for internal critical systems, in line with the organization's approved change management mechanisms.

Allocating specific workstations in an isolated network (Management Network), that is isolated from other networks or services (e.g., email service or internet), to be used by highly privileged accounts.

Encrypting the network traffic of non-console administrative access for all technical components of critical systems using secure encryption algorithms and protocols.

Reviewing critical systems' configurations and hardening at least once every six months.

Reviewing and changing default configurations, and ensuring the removal of hard-coded, backdoor and/or default passwords, where applicable.

Protecting systems' logs and critical files from unauthorized access, tampering, illegitimate modification and/or deletion.

Logically and/or physically segregating and isolating critical systems' networks.

Reviewing firewall rules and access lists, at least once every six months.

Prohibiting direct connection between local network devices and critical systems, unless those devices are scanned to ensure they have security controls that meet the acceptable security levels for critical systems.

Prohibiting critical systems from connecting to a wireless network.

Protecting against Advanced Persistent Threats (APT) at the network layer.

Prohibiting connection to the internet for critical systems that provide internal services to the organization and have no strong need to be accessed from outside the organization.

Critical systems that provide services to a limited number of organizations (not individuals), shall use networks isolated from the Internet.

Protecting against Distributed Denial of Service (DDoS) attacks to limit risks arising from these attacks.

Allowing only whitelisting for critical systems' firewall access lists.

Prohibiting access to critical systems from mobile devices except for a temporary period only, after assessing the risks and obtaining the necessary approvals from the cybersecurity function in the organization.

Implementing full disk encryption for mobile devices with access to critical systems.

Prohibiting the use of critical systems' data in any environment other than production environment, except after applying strict controls for protecting that data, such as: data masking or data scrambling techniques.

Classifying all data within critical systems.

Protecting classified data of critical systems using data leakage prevention techniques.

Identifying retention period for critical systems-associated data, in accordance with relevant legislations. Only required data must be retained in critical systems' production environments.

Prohibiting the transfer of any critical systems' data from production environment to any other environment.

Encrypting all critical systems' data-in-transit.

Encrypting all critical systems' data-at-rest at the level of files, database or certain columns within database.

Using secure and up-to-date methods, algorithms, keys and devices in accordance with what NCA issues in this regard.

Scope and coverage of online and offline backups shall cover all critical systems.

Performing backup within planned intervals, according to the organization's risk assessment. NCA recommends performing backup for critical systems on a daily basis.

Securing access, storage and transfer of critical systems' backups and storage media, and protecting it from destruction, unauthorized access or modification.

With reference to ECC subcontrol 2-9-3-3, a periodical test must be conducted at least once every three months in order to determine the efficiency of recovering critical systems backups.

Utilizing trusted methods and tools for vulnerabilities assessments.

Assessing and remediating vulnerabilities (by installing security updates and patches) on technical components of critical systems at least once every month for external and internet-connected critical systems, and at least once every three months for internal critical systems.

Immediately remediating for critical vulnerabilities, in line with change management processes approved by the organization.

With reference to ECC subcontrol 2-10-3-1, vulnerabilities assessments must be conducted on critical systems' technical components at least once every month.

Scope of penetration tests must cover all of the critical systems' technical components and all its internal and external services.

Conducting penetration tests by a qualified team.

With reference to ECC subcontrol 2-11-3-2, penetration tests must be conducted on critical systems at least once every six months.

Activating cybersecurity event logs on all technical components of critical systems.

Activating and monitoring of alerts and event logs related to file integrity management.

Monitoring and analyzing user behavior.

Monitoring critical systems security events around the clock.

Maintaining and protecting critical systems security events logs. The log shall include all details (e.g., time, date, ID and affected system).

With reference to ECC subcontrol 2-12-3-5, retention period of cybersecurity's critical systems event logs must be 18 months minimum, in accordance with relevant legislative and regulatory requirements.

Secure session management, including session authenticity, session lockout and session timeout.

Applying the minimum standards of Open Web Application Security Project (OWASP) Top Ten.

With reference to ECC subcontrol 2-15-3-2, multi-tier architecture principle, with minimum 3 tiers, must be used.

Cybersecurity requirements for critical systems' internal applications must be defined, documented, and approved.

The cybersecurity requirements for critical systems' internal applications must be implemented.

Adopting multi-tier architecture principle, provided that number of tiers is not less than three.

Using secure protocols (e.g., HTTPS).

Outlining the acceptable use policy for users.

Secure session management, including session authenticity, session lockout and session timeout.

The cybersecurity requirements for critical systems' internal applications must be reviewed periodically.

Establishing a disaster recovery center for critical systems.

Incorporating critical systems within disaster recovery plans.

Conducting periodical tests to ensure the efficiency of disaster recovery plans for critical systems, at least once annually.

NCA recommends conducting periodical live Disaster Recovery (DR) test for critical systems.

Screening or vetting of outsourcing and managed services companies and personnel who work on critical systems.

Outsourcing and managed services of critical systems must rely on Saudi companies and organizations, in accordance with the relevant legislative and regulatory requirements.

Hosting of critical systems and any part of their technical components must be inside the organization or within cloud computing services provided by government organizations or Saudi companies that are in compliance with NCA's Cloud Cybersecurity Controls (CCC), taking into account the classification of the hosted data.