Sharing Indicator : White Essential Cybersecurity Controls The cybersecurity risk assessment procedures must be implemented at least in the following cases: 1-5-3 1-5-3-1 Early stages of technology projects. 1-5-3-2 Before making major changes to technology infrastructure. 1-5-3-3 During the planning phase of obtaining third party services. 1-5-3-4 During the planning phase and before going live for new technology services and products. 1-5-4 1-6 The cybersecurity risk management methodology and procedures must be reviewed periodically according to planned intervals or upon changes to related laws and regulations. Changes and reviews must be approved and documented. Cybersecurity in Information and Technology Project Management To ensure that cybersecurity requirements are included in project management methodology and Objective procedures in order to protect the confidentiality, integrity and availability of information and technology assets as per organization policies and procedures, and related laws and regulations. Controls Cybersecurity requirements must be included in project and asset (information/ technology) change 1-6-1 management methodology and procedures to identify and manage cybersecurity risks as part of project management lifecycle. The cybersecurity requirements must be a key part of the overall requirements of technology projects. 1-6-2 The cybersecurity requirements in project and assets (information/technology) change management must include at least the following: 1-6-2-1 Vulnerability assessment and remediation. 1-6-2-2 Conducting a configurations’ review, secure configuration and hardening and patching before changes or going live for technology projects. The cybersecurity requirements related to software and application development projects must include at least the following: 1-6-3 1-6-3-1 Using secure coding standards. 1-6-3-2 Using trusted and licensed sources for software development tools and libraries. 1-6-3-3 Conducting compliance test for software against the defined organizational cybersecurity requirements. 1-6-3-4 Secure integration between software components. 1-6-3-5 Conducting a configurations’ review, secure configuration and hardening and patching before going live for software products. 1-6-4 The cybersecurity requirements in project management must be reviewed periodically. 1-7 Compliance with Cybersecurity Standards, Laws and Regulations Objective To ensure that the organization’s cybersecurity program is in compliance with related laws and regulations. Controls 1-7-1 1-7-2 16 The organization must comply with related national cybersecurity laws and regulations. The organization must comply with any nationally-approved international agreements and commiments related to cybersecurity. Document Classification: Unclassified