Sharing Indicator : White Terminology Essential Cybersecurity Controls Definition These are the rules that include the principles, methods and means of storing and Cryptography transmitting data or information in a particular form in order to conceal its semantic content, prevent unauthorized use or prevent undetected modification so that only the persons concerned can read and process the same. Cyber Attack Intentional exploitation of computer systems, networks, and organizations whose work depends on digital ICT, in order to cause damage. The risks to organizational operations (including vision, mission, functions, image or Cyber Risks reputation), organizational assets, individuals, other organizations, or the nation due to the potential of unauthorized access, use, disclosure, disruption, modification, or destruction of information and/or information systems. According to the Royal Decree number 6801, dated 11/2/1439H, cybersecurity is the Cybersecurity protection of networks, IT systems, operational technologies systems and their components of hardware and software, their services and the data they contain, from any penetration, disruption, modification, access, use or unauthorized exploitation. The concept of cybersecurity also includes information security and digital security. Cybersecurity Resilience The overall ability of organizations to withstand cyber events and, where harm is caused, recover from them. The interconnected network of IT infrastructure, including the Internet, communications Cyberspace networks, computer systems and Internet-connected devices, as well as the associated hardware and control devices. The term can also refer to a virtual world or domain such as a simple concept. Setting the sensitivity level of data and information that results in security controls for Data and Information Classification each level of classification. Data and information sensitivity levels are set according to predefined categories where data and information is created, modified, improved, stored or transmitted. The classification level is an indication of the value or importance of the data and information of the organization. It is the process of moving data that is no longer actively used to a separate storage device Data Archiving for long-term retention. Archive data consists of older data that is still important to the organization and may be needed for future reference, as well as data that must be retained for relevant legal and regulatory compliance. Defense-in-Depth Disaster Recovery Domain Name System (DNS) 32 It is an information assurance concept in which multiple layers of security controls (defense) are placed throughout an information technology (IT) or operation technology (OT) system. Programs, activities and plans designed to restore the organization›s critical business functions and services to an acceptable situation, following exposure to cyber attacks or disruption of such services. A technical system that uses a database distributed over the network and/or the Internet which allows the translation of domain names into IP addresses, and vice-versa in order to identify service addresses such as web and email servers. Document Classification: Unclassified