Sharing Indicator: White Essential Cybersecurity Controls 4 4-1 Objective Third-Party and Cloud Computing Cybersecurity Third-Party Cybersecurity To ensure the protection of assets against the cybersecurity risks related to third-parties including outsourcing and managed services as per organizational policies and procedures, and related laws and regulations. Controls 4-1-1 Cybersecurity requirements for contracts and agreements with third-parties must be identified, documented and approved. The cybersecurity requirements for contracts and agreements with third-parties (e.g., Service Level Agreement (SLA)) -which may affect, if impacted, the organization’s data or services- must include at least the following: 4-1-2 4-1-2-1 Non-disclosure clauses and secure removal of organization’s data by third parties upon end of service. 4-1-2-2 Communication procedures in case of cybersecurity incidents. 4-1-2-3 Requirements for third-parties to comply with related organizational policies and procedures, laws and regulations. The cybersecurity requirements for contracts and agreements with IT outsourcing and managed services third-parties must include at least the following: 4-1-3 4-1-3-1 Conducting a cybersecurity risk assessment to ensure the availability of risk mitigation controls before signing contracts and agreements or upon changes in related regulatory requirements. 4-1-3-2 Cybersecurity managed services centers for monitoring and operations must be completely present inside the Kingdom of Saudi Arabia. 4-1-4 4-2 The cybersecurity requirements for contracts and agreements with third-parties must be reviewed periodically. Cloud Computing and Hosting Cybersecurity To ensure the proper and efficient remediation of cyber risks and the implementation of cybersecurity Objective requirements related to hosting and cloud computing as per organizational policies and procedures, and related laws and regulations. It is also to ensure the protection of the organization’s information and technology assets hosted on the cloud or processed/managed by third-parties. Controls 4-2-1 4-2-2 Cybersecurity requirements related to the use of hosting and cloud computing services must be defined, documented and approved. The cybersecurity requirements related to the use of hosting and cloud computing services must be implemented. Document Classification: Unclassified 27