Sharing Indicator: White Essential Cybersecurity Controls 1-3 Objective Cybersecurity Policies and Procedures To ensure that cybersecurity requirements are documented, communicated and complied with by the organization as per related laws and regulations, and organizational requirements. Controls 1-3-1 1-3-2 1-3-3 1-3-4 1-4 Objective Cybersecurity policies and procedures must be defined and documented by the cybersecurity function, approved by the Authorizing Official, and disseminated to relevant parties inside and outside the organization. The cybersecurity function must ensure that the cybersecurity policies and procedures are implemented. The cybersecurity policies and procedures must be supported by technical security standards (e.g., operating systems, databases and firewall technical security standards). The cybersecurity policies and procedures must be reviewed periodically according to planned intervals or upon changes to related laws and regulations. Changes and reviews must be approved and documented. Cybersecurity Roles and Responsibilities To ensure that roles and responsibilities are defined for all parties participating in implementing the cybersecurity controls within the organization. Controls 1-4-1 1-4-2 1-5 Objective Cybersecurity organizational structure and related roles and responsibilities must be defined, documented, approved, supported and assigned by the Authorizing Official while ensuring that this does not result in a conflict of interest. The cybersecurity roles and responsibilities must be reviewed periodically according to planned intervals or upon changes to related laws and regulations. Cybersecurity Risk Management To ensure managing cybersecurity risks in a methodological approach in order to protect the organization’s information and technology assets as per organizational policies and procedures, and related laws and regulations. Controls 1-5-1 1-5-2 Cybersecurity risk management methodology and procedures must be defined, documented and approved as per confidentiality, integrity and availability considerations of information and technology assets. The cybersecurity risk management methodology and procedures must be implemented by the cybersecurity function. Document Classification: Unclassified 15