Sharing Indicator: White Essential Cybersecurity Controls 2-9-2 The cybersecurity requirements for backup and recovery management must be implemented. The cybersecurity requirements for backup and recovery management must include at least the following: 2-9-3 2-9-3-1 Scope and coverage of backups to cover critical technology and information assets. 2-9-3-2 Ability to perform quick recovery of data and systems after cybersecurity incidents. 2-9-3-3 Periodic tests of backup’s recovery effectiveness. 2-9-4 The cybersecurity requirements for backup and recovery management must be reviewed periodically. 2-10 Vulnerabilities Management Objective To ensure timely detection and effective remediation of technical vulnerabilities to prevent or minimize the probability of exploiting these vulnerabilities to launch cyber attacks against the organization. Controls 2-10-1 2-10-2 Cybersecurity requirements for technical vulnerabilities management must be defined, documented and approved. The cybersecurity requirements for technical vulnerabilities management must be implemented. The cybersecurity requirements for technical vulnerabilities management must include at least the following: 2-10-3-1 Periodic vulnerabilities assessments. 2-10-3 2-10-3-2 Vulnerabilities classification based on criticality level. 2-10-3-3 Vulnerabilities remediation based on classification and associated risk levels. 2-10-3-4 Security patch management. 2-10-3-5 Subscription with authorized and trusted cybersecurity resources for up-to-date information and notifications on technical vulnerabilities. 2-10-4 2-11 Objective The cybersecurity requirements for technical vulnerabilities management must be reviewed periodically. Penetration Testing To assess and evaluate the efficiency of the organization’s cybersecurity defense capabilities through simulated cyber-attacks to discover unknown weaknesses within the technical infrastructure that may lead to a cyber breach. Controls 2-11-1 2-11-2 Cybersecurity requirements for penetration testing exercises must be defined, documented and approved. The cybersecurity requirements for penetration testing processes must be implemented. The cybersecurity requirements for penetration testing processes must include at least the following: 2-11-3 2-11-3-1 Scope of penetration tests which must cover Internet-facing services and its technical components including infrastructure, websites, web applications, mobile apps, email and remote access. 2-11-3-2 Conducting penetration tests periodically. Document Classification: Unclassified 23