Sharing Indicator : White Essential Cybersecurity Controls 2-11-4 Cybersecurity requirements for penetration testing processes must be reviewed periodically. 2-12 Cybersecurity Event Logs and Monitoring Management Objective To ensure timely collection, analysis and monitoring of cybersecurity events for early detection of potential cyber-attacks in order to prevent or minimize the negative impacts on the organization’s operations. Controls Cybersecurity requirements for event logs and monitoring management must be defined, documented 2-12-1 and approved. 2-12-2 The cybersecurity requirements for event logs and monitoring management must be implemented. The cybersecurity requirements for event logs and monitoring management must include at least the following: 2-12-3-1 Activation of cybersecurity event logs on critical information assets. 2-12-3-2 Activation of cybersecurity event logs on remote access and privileged user accounts. 2-12-3 2-12-3-3 Identification of required technologies (e.g., SIEM) for cybersecurity event logs collection. 2-12-3-4 Continuous monitoring of cybersecurity events. 2-12-3-5 Retention period for cybersecurity event logs (must be 12 months minimum). The cybersecurity requirements for event logs and monitoring management must be reviewed 2-12-4 periodically. 2-13 Cybersecurity Incident and Threat Management Objective To ensure timely identification, detection, effective management and handling of cybersecurity incidents and threats to prevent or minimize negative impacts on organization’s operation taking into consideration the Royal Decree number 37140, dated 14/8/1438H. Controls 2-13-1 2-13-2 Requirements for cybersecurity incidents and threat management must be defined, documented and approved. The requirements for cybersecurity incidents and threat management must be implemented. The requirements for cybersecurity incidents and threat management must include at least the following: 2-13-3 2-13-3-1 Cybersecurity incident response plans and escalation procedures. 2-13-3-2 Cybersecurity incidents classification. 2-13-3-3 Cybersecurity incidents reporting to NCA. 2-13-3-4 Sharing incidents notifications, threat intelligence, breach indicators and reports with NCA. 2-13-3-5 Collecting and handling threat intelligence feeds. 2-13-4 24 The requirements for cybersecurity incidents and threat management must be reviewed periodically. Document Classification: Unclassified