Sharing Indicator: White Essential Cybersecurity Controls Terminology Definition Effectiveness refers to the degree to which a planned impact is achieved. Planned activities Effectiveness are considered effective if these activities are already implemented, and the planned results are considered effective if the results are already achieved. KPIs can be used to measure and evaluate the level of effectiveness. Efficiency Event Hyper Text Transfer Protocol Secure (HTTPS) Identification Incident Integrity (Inter) National Requirements The relationship between the results achieved (outputs) and the resources used (inputs). The efficiency of a process or system can be enhanced by achieving more results using the same resources (inputs) or even less. Something that happens in a specific place (such as network, systems, applications) at a specific time. A protocol that uses encryption to secure web pages and data when they are transmitted over the network. It is a secure version of the Hypertext Text Transfer Protocol (HTTP). It is the means of verifying the identity of a user, process, or device, typically as a prerequisite for granting access to resources in a system. A compromise through violation of cybersecurity policies, acceptable use policies, practices or cybersecurity controls or requirements. Protection against unauthorized modification or destruction of information, including ensuring information non-repudiation and authenticity. National requirements are those developed by a regulatory organization or body in Saudi Arabia for regulatory use (e.g., NCA’s Essential Cybersecurity Controls ECC-1:2018) International requirements are those developed by a global organization for worldwide regulatory or best practices use (e.g., SWIFT, PCI DSS). Intrusion Prevention System (IPS) A system with intrusion detection capabilities, as well as the ability to prevent and stop Key Performance Indicator (KPI) A type of performance measurement that evaluates the success of an organization or of a suspicious or potential incidents. particular activity in which it engages to achieve particular objectives and goals. Display of information (by specific and standard naming and coding) that is placed on Labelling the organization›s assets (such as devices, applications and documents) to be used to refer to some information related to the classification, ownership, type and other asset management information. Least Privilege Malware A basic principle in cybersecurity that aims at granting users the access privileges they need to carry out their official responsibilities only. A program that infects systems, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victim’s data, applications, or operating system or of otherwise annoying or disrupting the victim. A security system that verifies user identity, which requires the use of several separate elements of identity verification mechanisms. Verification mechanisms include several Multi-Factor Authentication (MFA) elements: • Knowledge (something only the user knows “like password”). • Possession (something only owned by the user “such as a program , device generating random numbers or SMSs” for login records, which are called: One-Time-Password). • Inherent Characteristics (a characteristic of the user only, such as fingerprint). Document Classification: Unclassified 33