Skip to main content

7. Cybersecurity

No: 43060832 Date(g): 9/2/2022 | Date(h): 8/7/1443 Status: In-Force
22.Banks shall establish appropriate precautionary cybersecurity controls to protect the information assets and data of banks and subscribers from cyberattacks, taking into account compliance with the regulatory requirements related to cybersecurity.
 
23.Banks shall ensure that controls related to cybersecurity monitoring are applied to all systems and applications used in the IPO process. The monitoring incident response capabilities shall be governed by the cybersecurity incident response policy, and ensuring the readiness of incident response teams.
 
24.Banks shall conduct a comprehensive testing program to ensure cyber resiliency and controls effectiveness of the systems and applications used in the IPO process, including - but not limited to - the following:
 
 a.Vulnerability assessment and penetration testing.
 
 b.Cybersecurity compromise assessment.
 
25.Banks shall ensure operational resiliency by testing a range of potential disruptive scenarios, in line with regulatory requirements related to business continuity management.
 
26.Banks shall implement preventive measures to reduce the risks arising from the third-party and service providers dependencies and should also ensure the readiness of third-party arrangements to support the systems and applications involved in the IPO process.