Sharing Indicator : White Essential Cybersecurity Controls The Essential Cybersecurity Controls (ECC) Details of the Essential Cybersecurity Controls (ECC) 1 Cybersecurity Governance 1-1 Cybersecurity Strategy Objective To ensure that cybersecurity plans, goals, initiatives and projects are contributing to compliance with related laws and regulations. Controls 1-1-1 1-1-2 1-1-3 A cybersecurity strategy must be defined, documented and approved. It must be supported by the head of the organization or his/her delegate (referred to in this document as Authorizing Official). The strategy goals must be in-line with related laws and regulations. A roadmap must be executed to implement the cybersecurity strategy. The cybersecurity strategy must be reviewed periodically according to planned intervals or upon changes to related laws and regulations. 1-2 Cybersecurity Management Objective To ensure Authorizing Official’s support in implementing and managing cybersecurity programs within the organization as per related laws and regulations Controls A dedicated cybersecurity function (e.g., division, department) must be established within the 1-2-1 organization. This function must be independent from the Information Technology/Information Communication and Technology (IT/ICT) functions (as per the Royal Decree number 37140 dated 14/8/1438H). It is highly recommended that this cybersecurity function reports directly to the head of the organization or his/her delegate while ensuring that this does not result in a conflict of interest. 1-2-2 The position of cybersecurity function head (e.g., CISO), and related supervisory and critical positions within the function, must be filled with full-time and experienced Saudi cybersecurity professionals. A cybersecurity steering committee must be established by the Authorizing Official to ensure the support and implementation of the cybersecurity programs and initiatives within the organization. 1-2-3 Committee members, roles and responsibilities, and governance framework must be defined, documented and approved. The committee must include the head of the cybersecurity function as one of its members. It is highly recommended that the committee reports directly to the head of the organization or his/her delegate while ensuring that this does not result in a conflict of interest. 14 Document Classification: Unclassified