D1 · Domain 1: Information security management and governance 7
1.1
Roles and responsibilities of information security
IEC 62443CBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRADHICSPCI DSS 4.0.1
1.2
Information security policy
CJISADHICSBahrain NCSCKuwait NCFOman NCFCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
1.3
Technical and operational policies
CJISADHICSBahrain NCSCKuwait NCFOman NCFCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
1.4
Information security awareness and training
IEC 62443Bahrain NCSCKuwait NCFOman NCFCJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IAUK GDPR
1.5
Confidentiality agreements
IEC 62443Oman NCFNCA ECC-2NCA OTCCNIS2Qatar NIAUAE IAADHICSISO 27001NCA CCCPCI DSS 4.0.1SAMA CSF
1.6
Relations and sustainability of information security
1.7
Securing external parties relations
IEC 62443CJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
D2 · Domain 2: Information and information assets management 7
2.1
Information assets management
IEC 62443ADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2.2
Information assets ownership and custodianship
IEC 62443ADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2.3
Information assets classification
IEC 62443ADHICSKuwait NCFOman NCFCJISCIS ControlsGDPR (EU)ISO 27001NCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLQatar NIAPDPL – Federal Decree-Law 45/2021UAE IAUK GDPRNCA CCC
2.4
Information assets labelling and handling
IEC 62443ADHICSKuwait NCFOman NCFCJISCIS ControlsGDPR (EU)ISO 27001NCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLQatar NIAPDPL – Federal Decree-Law 45/2021UAE IAUK GDPRNCA CCC
2.5
Disposal of information and assets
IEC 62443ADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2.6
Information assets responsibility
IEC 62443ADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2.7
Information and data protection
IEC 62443ADHICSKuwait NCFOman NCFCJISCIS ControlsGDPR (EU)ISO 27001NCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLQatar NIAPDPL – Federal Decree-Law 45/2021UAE IAUK GDPRNCA CCC
D3 · Domain 3: Information security risk management 4
3.1
Risk assessment methodology and planning
IEC 62443CJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3.2
Risk assessment
IEC 62443CJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3.3
Risk treatment and mitigation
IEC 62443CJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3.4
Risk acceptance
IEC 62443CJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
D4 · Domain 4: Incident and problem management 5
4.1
Incident management planning
IEC 62443CBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
4.2
Information security incident reporting and escalation
IEC 62443CBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
4.3
Evidence gathering
IEC 62443CBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
4.4
Information security incidents knowledge base
IEC 62443CBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
4.5
Problem management
IEC 62443CBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
D5 · Domain 5: Access control 13
5.1
Access control management policy and procedure
IEC 62443ADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
5.2.1
Users access control
IEC 62443ADHICSCJISCIS ControlsHIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFQatar NIASAMA CSFUAE IAPCI DSS 4.0.1
5.2.2
Network access control
IEC 62443ADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
5.2.3
Operating system access control
IEC 62443ADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
5.2.4
Applications access control
IEC 62443ADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
5.2.5
Remote access security
IEC 62443ADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRCBUAE CSFCyber EssentialsCyber Essentials Plus
5.2.6
Mobile computing
IEC 62443ADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
5.2.7
Wireless access management
IEC 62443ADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRDORANCA CCC
5.3.1
Physical access control policy and procedure
IEC 62443Oman NCFADHICSHIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IA
5.3.2
Physical security controls
IEC 62443Oman NCFADHICSHIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IA
5.4
Public and external party access control
IEC 62443ADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRNCA CCC
5.5
Information and documents access control
IEC 62443ADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
5.6
Access control audit and review
IEC 62443ADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRDORANCA CCC
D6 · Domain 6: Operations, systems and communication management 19
6.1.1
Technology and operations capacity management
IEC 62443ADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
6.1.2
Documentation of operational procedures
6.1.3
Change management
IEC 62443CBUAE CSFOman NCFUAE IANCA OTCCQatar NIAISO 27001NCA CCCNCA ECC-2PCI DSS 4.0.1
6.1.4
Segregation of duties
IEC 62443ADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
6.1.5
Separation of operational facilities
IEC 62443Oman NCFUAE IACJISCIS ControlsNCA ECC-2ADHICSISO 27001NCA CCCPCI DSS 4.0.1Qatar NIASAMA CSF
6.1.6
Information systems deployment
IEC 62443Oman NCFUAE IACJISCIS ControlsNCA ECC-2ADHICSISO 27001NCA CCCPCI DSS 4.0.1Qatar NIASAMA CSF
6.1.7
Virtualisation techniques
6.2
External party services management
IEC 62443CJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
6.3
Protection against malicious and mobile code
IEC 62443ADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIAUAE IA
6.4
Network security
IEC 62443ADHICSBahrain NCSCOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusNCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIAUAE IAISO 27001Kuwait NCFGDPR (EU)HIPAA Security RuleNIS2PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021SAMA CSFUK GDPRDORA
6.5.1
Information exchange
IEC 62443Kuwait NCFOman NCFUAE IACJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUK GDPR
6.6
Electronic messaging and email
IEC 62443ADHICSKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusHIPAA Security RuleNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIAUAE IAGDPR (EU)ISO 27001NCA CCCPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021SAMA CSFUK GDPR
6.7.1
Online transaction controls
IEC 62443Oman NCFUAE IACJISCIS ControlsNCA ECC-2ADHICSISO 27001NCA CCCPCI DSS 4.0.1Qatar NIASAMA CSF
6.8
Media handling management
IEC 62443ADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
6.9
Monitoring and logs management
IEC 62443ADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
6.10
Data centre security
IEC 62443ADHICSKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusHIPAA Security RuleNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIAISO 27001NCA CCCSAMA CSFUAE IA
D7 · Domain 7: Business continuity planning 7
7.1
Business impact analysis
IEC 62443ADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
7.2
Business continuity plan
IEC 62443ADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
7.3
Disaster recovery
IEC 62443ADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
7.4.1
Backup and storage policy and procedure
IEC 62443ADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
7.4.2
Media library and resources protection
IEC 62443Kuwait NCFOman NCFUAE IACJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUK GDPRBahrain NCSCCyber EssentialsCyber Essentials PlusDORA
7.4.3
Backup testing and restoration
IEC 62443ADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
7.5
BCP test and review
IEC 62443ADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
D8 · Domain 8: Information systems acquisition, development and management 9
8.1.1
Acquisition, development and management policy and procedure
IEC 62443Oman NCFUAE IACJISCIS ControlsNCA ECC-2ADHICSISO 27001NCA CCCPCI DSS 4.0.1Qatar NIASAMA CSF
8.1.2
Application development
IEC 62443Oman NCFUAE IACJISCIS ControlsNCA ECC-2ADHICSISO 27001NCA CCCPCI DSS 4.0.1Qatar NIASAMA CSF
8.2
Information systems security requirements and specifications
IEC 62443Oman NCFUAE IACJISCIS ControlsNCA ECC-2ADHICSISO 27001NCA CCCPCI DSS 4.0.1Qatar NIASAMA CSF
8.3
Secure and correct processing of information systems
IEC 62443Oman NCFUAE IACJISCIS ControlsNCA ECC-2ADHICSISO 27001NCA CCCPCI DSS 4.0.1Qatar NIASAMA CSF
8.4
Securing information systems files, source codes and data
IEC 62443Oman NCFUAE IACJISCIS ControlsNCA ECC-2ADHICSISO 27001NCA CCCPCI DSS 4.0.1Qatar NIASAMA CSF
8.5
Managing changes in software development
IEC 62443CBUAE CSFOman NCFUAE IANCA OTCCQatar NIAISO 27001NCA CCCNCA ECC-2PCI DSS 4.0.1CJISCIS ControlsADHICSSAMA CSF
8.6
Security testing
IEC 62443Bahrain NCSCKuwait NCFOman NCFADHICSCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IA
8.7
Deployment of information systems and applications
IEC 62443CBUAE CSFOman NCFUAE IANCA OTCCQatar NIAISO 27001NCA CCCNCA ECC-2PCI DSS 4.0.1
8.8
Cryptography controls
IEC 62443Kuwait NCFOman NCFUAE IACJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUK GDPR
D9 · Domain 9: Environmental and physical security 5
9.1
Environmental and physical threats protection policy and procedure
IEC 62443Oman NCFADHICSHIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IA
9.2
Protection from environmental threats
IEC 62443Oman NCFADHICSHIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IA
9.3
Secure working areas
IEC 62443Oman NCFADHICSHIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IA
9.4
Securing equipment
IEC 62443Oman NCFADHICSHIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IA
9.5
Periodic testing
IEC 62443Oman NCFADHICSHIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IA
D10 · Domain 10: Roles and responsibilities of human resources 3
10.1
Prior to employment security controls
IEC 62443Oman NCFNCA ECC-2NCA OTCCNIS2Qatar NIAUAE IAADHICSISO 27001NCA CCCPCI DSS 4.0.1SAMA CSF
10.2
During employment security controls
IEC 62443Bahrain NCSCKuwait NCFOman NCFCJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IAUK GDPRNCA CCC
10.3
Termination and change of employment security controls
IEC 62443ADHICSCJISCIS ControlsHIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFQatar NIASAMA CSFUAE IAPCI DSS 4.0.1Oman NCFNIS2
D11 · Domain 11: Compliance and audit 5
11.1
Compliance with federal and local government legal requirements
11.2
Compliance controls
CJISADHICSBahrain NCSCKuwait NCFOman NCFCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
11.3
Protection of private information of individuals and corporates
Kuwait NCFUK GDPRADHICSGDPR (EU)PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021
11.4
Compliance with information security policies and standards
CJISADHICSBahrain NCSCKuwait NCFOman NCFCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
11.5
Audit of information security regulation implementation
CJISADHICSBahrain NCSCKuwait NCFOman NCFCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
D12 · Domain 12: Information security assurance and performance assessment 2
12.1
Information security key performance indicators
IEC 62443CBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRADHICSPCI DSS 4.0.1
12.2
Information security dashboard
IEC 62443CBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRADHICSPCI DSS 4.0.1
D13 · Domain 13: Cloud security 7
13.1
Cloud security policy and procedure
Kuwait NCFOman NCFADHICSCJISCIS ControlsISO 27001NCA CCCNCA ECC-2Qatar NIASAMA CSFUAE IA
13.2.1
Data location
Kuwait NCFOman NCFADHICSCJISCIS ControlsISO 27001NCA CCCNCA ECC-2Qatar NIASAMA CSFUAE IA
13.2.2
Data classification and handling
IEC 62443ADHICSKuwait NCFOman NCFCJISCIS ControlsGDPR (EU)ISO 27001NCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLQatar NIAPDPL – Federal Decree-Law 45/2021UAE IAUK GDPRNCA CCCSAMA CSF
13.2.3
Architecture and deployment model
Kuwait NCFOman NCFADHICSCJISCIS ControlsISO 27001NCA CCCNCA ECC-2Qatar NIASAMA CSFUAE IA
13.2.4
Service agreements
IEC 62443CJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
13.2.5
Data portability and continuity
IEC 62443ADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPRSAMA CSF
13.2.6
Compliance and monitoring
IEC 62443CJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR