Sharing Indicator : White 2-3 Essential Cybersecurity Controls Information System and Information Processing Facilities Protection Objective To ensure the protection of information systems and information processing facilities (including workstations and infrastructures) against cyber risks. Controls Cybersecurity requirements for protecting information systems and information processing facilities 2-3-1 must be defined, documented and approved. The cybersecurity requirements for protecting information systems and information processing 2-3-2 facilities must be implemented. The cybersecurity requirements for protecting information systems and information processing facilities must include at least the following: 2-3-3 2-3-3-1 Advanced, up-to-date and secure management of malware and virus protection 2-3-3-2 Restricted use and secure handling of external storage media. 2-3-3-3 Patch management for information systems, software and devices. 2-3-3-4 Centralized clock synchronization with an accurate and trusted source (e.g., on servers and workstations. Saudi Standards, Metrology and Quality Organization (SASO)). The cybersecurity requirements for protecting information systems and information processing 2-3-4 facilities must be reviewed periodically. 2-4 Email Protection Objective To ensure the protection of organization’s email service from cyber risks. Controls 2-4-1 Cybersecurity requirements for protecting email service must be defined, documented and approved. 2-4-2 The cybersecurity requirements for email service must be implemented. The cybersecurity requirements for protecting the email service must include at the least the following: 2-4-3-1 Analyzing and filtering email messages (specifically phishing emails and spam) using advanced and up-to-date email protection techniques. 2-4-3 2-4-3-2 Multi-factor authentication for remote and webmail access to email service. 2-4-3-3 Email archiving and backup. 2-4-3-4 Secure management and protection against Advanced Persistent Threats (APT), which normally utilize zero-day viruses and malware. 2-4-3-5 Validation of the organization’s email service domains (e.g., using Sender Policy Framework (SPF)). 2-4-4 20 The cybersecurity requirements for email service must be reviewed periodically. Document Classification: Unclassified