2-1-SPE1 · Part 2-1 SPE 1 Organisational security measures 11
2-1-ORG1.1
Information security management system
Dubai ISRCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRADHICSPCI DSS 4.0.1
2-1-ORG1.2
Background checks
Dubai ISROman NCFNCA ECC-2NCA OTCCNIS2Qatar NIAUAE IAADHICSISO 27001NCA CCCPCI DSS 4.0.1SAMA CSF
2-1-ORG1.3
Security roles and responsibilities
Dubai ISRCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRADHICSPCI DSS 4.0.1
2-1-ORG1.4
Security awareness training
Dubai ISRBahrain NCSCKuwait NCFOman NCFCJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IAUK GDPR
2-1-ORG1.5
Security responsibilities training
Dubai ISRBahrain NCSCKuwait NCFOman NCFCJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IAUK GDPR
2-1-ORG1.6
Supply chain security
Dubai ISRCJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-ORG2.1
Security risk mitigation
Dubai ISRCJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-ORG2.2
Processes for discovery of security anomalies
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRCyber EssentialsCyber Essentials Plus
2-1-ORG2.3
Secure development and support
Dubai ISROman NCFUAE IACJISCIS ControlsNCA ECC-2ADHICSISO 27001NCA CCCPCI DSS 4.0.1Qatar NIASAMA CSF
2-1-ORG2.4
SP reviews
Dubai ISRCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRADHICSPCI DSS 4.0.1
2-1-ORG3.1
Physical access control
Dubai ISROman NCFADHICSHIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IA
2-1-SPE2 · Part 2-1 SPE 2 Configuration management 4
2-1-CM1.1
Asset inventory baseline
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-CM1.2
Infrastructure drawings and documentation
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-CM1.3
Configuration settings
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-CM1.4
Change control
Dubai ISRCBUAE CSFOman NCFUAE IANCA OTCCQatar NIAISO 27001NCA CCCNCA ECC-2PCI DSS 4.0.1
2-1-SPE3 · Part 2-1 SPE 3 Network and communications security 15
2-1-NET1.1
Segmentation from non-IACS zones
ADHICSCJISCIS ControlsISO 27001NCA ECC-2NCA OTCCNIST CSFQatar NIAUAE IAPCI DSS 4.0.1Bahrain NCSC
2-1-NET1.2
Documentation of zones and network zone interconnections
ADHICSCJISCIS ControlsISO 27001NCA ECC-2NCA OTCCNIST CSFQatar NIAUAE IAPCI DSS 4.0.1Bahrain NCSC
2-1-NET1.3
Network segmentation from safety systems
ADHICSCJISCIS ControlsISO 27001NCA ECC-2NCA OTCCNIST CSFQatar NIAUAE IAPCI DSS 4.0.1Bahrain NCSC
2-1-NET1.4
Network autonomy
Bahrain NCSCNCA OTCCDubai ISRADHICSCBUAE CSFKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
2-1-NET1.5
Network disconnection from external networks
ADHICSCJISCIS ControlsISO 27001NCA ECC-2NCA OTCCNIST CSFQatar NIAUAE IAPCI DSS 4.0.1Dubai ISRCBUAE CSFBahrain NCSCKuwait NCFOman NCFDORAGDPR (EU)HIPAA Security RuleNIS2PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021SAMA CSFUK GDPR
2-1-NET1.6
Internal network access control
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-NET1.7
Network accessible services
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-NET1.8
User messaging
Dubai ISRADHICSBahrain NCSCOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusNCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIAUAE IAISO 27001
2-1-NET1.9
Network time distribution
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-NET2.1
Wireless protocols
Dubai ISRKuwait NCFOman NCFUAE IACJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUK GDPR
2-1-NET2.2
Wireless network segmentation
ADHICSCJISCIS ControlsISO 27001NCA ECC-2NCA OTCCNIST CSFQatar NIAUAE IAPCI DSS 4.0.1Bahrain NCSC
2-1-NET2.3
Wireless properties and addresses
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-NET3.1
Remote access applications
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-NET3.2
Remote access connections
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRDORANCA CCC
2-1-NET3.3
Remote access termination
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-SPE4 · Part 2-1 SPE 4 Component security 10
2-1-COMP1.1
Component hardening
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-COMP1.2
Dedicated portable media
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-COMP2.1
Malware free
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIAUAE IA
2-1-COMP2.2
Malware protection
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIAUAE IA
2-1-COMP2.3
Malware protection software validation and installation
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIAUAE IA
2-1-COMP3.1
Security patch authenticity and integrity
Dubai ISRBahrain NCSCKuwait NCFOman NCFADHICSCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IA
2-1-COMP3.2
Security patch validation and installation
Dubai ISRBahrain NCSCKuwait NCFOman NCFADHICSCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IA
2-1-COMP3.3
Security patch status
Dubai ISRBahrain NCSCKuwait NCFOman NCFADHICSCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IA
2-1-COMP3.4
Security patching retention of security
Dubai ISRBahrain NCSCKuwait NCFOman NCFADHICSCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IA
2-1-COMP3.5
Security patch mitigation
Dubai ISRBahrain NCSCKuwait NCFOman NCFADHICSCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IA
2-1-SPE5 · Part 2-1 SPE 5 Protection of data 7
2-1-DATA1.1
Data classification
Dubai ISRADHICSKuwait NCFOman NCFCJISCIS ControlsGDPR (EU)ISO 27001NCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLQatar NIAPDPL – Federal Decree-Law 45/2021UAE IAUK GDPRNCA CCC
2-1-DATA1.2
Data confidentiality
Dubai ISRKuwait NCFOman NCFUAE IACJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUK GDPR
2-1-DATA1.3
Safety system configuration mode
Bahrain NCSCNCA OTCCDubai ISRADHICSCBUAE CSFKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-DATA1.4
Data retention policy
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-DATA1.5
Cryptographic mechanisms
Dubai ISRKuwait NCFOman NCFUAE IACJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUK GDPR
2-1-DATA1.6
Key management
Dubai ISRKuwait NCFOman NCFUAE IACJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUK GDPR
2-1-DATA1.7
Data integrity
Dubai ISRKuwait NCFOman NCFUAE IACJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUK GDPRBahrain NCSCDORA
2-1-SPE6 · Part 2-1 SPE 6 User access control 23
2-1-USER1.1
User identity assignment
Dubai ISRADHICSCJISCIS ControlsHIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFQatar NIASAMA CSFUAE IAPCI DSS 4.0.1
2-1-USER1.2
User identity removal
Dubai ISRADHICSCJISCIS ControlsHIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFQatar NIASAMA CSFUAE IAPCI DSS 4.0.1
2-1-USER1.3
User identity persistence
Dubai ISRADHICSCJISCIS ControlsHIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFQatar NIASAMA CSFUAE IAPCI DSS 4.0.1
2-1-USER1.4
Access rights assignment
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-USER1.5
Least privilege
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-USER1.6
Software service authentication
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-USER1.7
Software services interactive login rights
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-USER1.8
Human user authentication
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-USER1.9
Multifactor authentication
Dubai ISRADHICSKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusHIPAA Security RuleNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIA
2-1-USER1.10
Mutual authentication
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-USER1.11
Password protection
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRNCA CCC
2-1-USER1.12
Shared and disclosed or compromised passwords
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-USER1.13
User login display information
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-USER1.14
User login failure displays
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-USER1.15
Consecutive login failures
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-USER1.16
Session integrity
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-USER1.17
Concurrent sessions
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-USER1.18
Screen lock
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-USER1.19
Component authentication
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-USER2.1
Authorization
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-USER2.2
Separation of duties
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-USER2.3
Multiple approvals
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-USER2.4
Manual elevation of privileges
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-SPE7 · Part 2-1 SPE 7 Event and incident management 9
2-1-EVENT1.1
Event detection
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-EVENT1.2
Event reporting
Dubai ISRCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-EVENT1.3
Event reporting interfaces
Dubai ISRCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-EVENT1.4
Logging
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-EVENT1.5
Log entries
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-EVENT1.6
Log access
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-EVENT1.7
Event analysis
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-EVENT1.8
Incident handling and response
Dubai ISRCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
2-1-EVENT1.9
Vulnerability handling
Dubai ISRBahrain NCSCKuwait NCFOman NCFADHICSCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IA
2-1-SPE8 · Part 2-1 SPE 8 System integrity and availability 8
2-1-AVAIL1.1
Continuity management
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
2-1-AVAIL1.2
Resource availability management
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
2-1-AVAIL1.3
Failure state
Bahrain NCSCNCA OTCC
2-1-AVAIL2.1
Backup
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
2-1-AVAIL2.2
Backup non-interference
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
2-1-AVAIL2.3
Backup verification
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
2-1-AVAIL2.4
Backup media
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
2-1-AVAIL2.5
Backup restoration
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
3-2 · Part 3-2: Security risk assessment, zones and conduits (ZCR 1-7) 25
3-2-ZCR1
Identify the system under consideration (SUC
Dubai ISRCJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-2-ZCR2
Initial cyber security risk assessment
Dubai ISRCJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-2-ZCR3
Partition the SUC into zones and conduits
ADHICSCJISCIS ControlsISO 27001NCA ECC-2NCA OTCCNIST CSFQatar NIAUAE IAPCI DSS 4.0.1Bahrain NCSC
3-2-ZCR3.1
Establish zones and conduits
ADHICSCJISCIS ControlsISO 27001NCA ECC-2NCA OTCCNIST CSFQatar NIAUAE IAPCI DSS 4.0.1Bahrain NCSC
3-2-ZCR3.2
Separate business and IACS assets
ADHICSCJISCIS ControlsISO 27001NCA ECC-2NCA OTCCNIST CSFQatar NIAUAE IAPCI DSS 4.0.1Bahrain NCSC
3-2-ZCR3.3
Separate safety related assets
ADHICSCJISCIS ControlsISO 27001NCA ECC-2NCA OTCCNIST CSFQatar NIAUAE IAPCI DSS 4.0.1Bahrain NCSC
3-2-ZCR3.4
Separate temporarily connected devices
ADHICSCJISCIS ControlsISO 27001NCA ECC-2NCA OTCCNIST CSFQatar NIAUAE IAPCI DSS 4.0.1Bahrain NCSC
3-2-ZCR3.5
Separate wireless devices
ADHICSCJISCIS ControlsISO 27001NCA ECC-2NCA OTCCNIST CSFQatar NIAUAE IAPCI DSS 4.0.1Bahrain NCSC
3-2-ZCR3.6
Separate devices connected via external networks
ADHICSCJISCIS ControlsISO 27001NCA ECC-2NCA OTCCNIST CSFQatar NIAUAE IAPCI DSS 4.0.1Bahrain NCSC
3-2-ZCR4
Compare initial risk to tolerable risk
Dubai ISRCJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-2-ZCR5
Detailed cyber security risk assessment
Dubai ISRCJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-2-ZCR5.1
Identify threats
Dubai ISRCJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-2-ZCR5.2
Identify vulnerabilities
Dubai ISRCJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-2-ZCR5.3
Determine consequence and impact
Dubai ISRCJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-2-ZCR5.4
Determine unmitigated likelihood
Dubai ISRCJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-2-ZCR5.5
Determine unmitigated cyber security risk
Dubai ISRCJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-2-ZCR5.6
Determine security level target
Dubai ISRCJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-2-ZCR5.7
Identify and evaluate existing countermeasures
Dubai ISRCJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-2-ZCR5.8
Re-evaluate likelihood and impact
Dubai ISRCJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-2-ZCR5.9
Determine residual risk
Dubai ISRCJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-2-ZCR5.10
Compare residual risk with tolerable risk
Dubai ISRCJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-2-ZCR5.11
Identify additional cyber security countermeasures
Dubai ISRCJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-2-ZCR5.12
Document and communicate results
Dubai ISRCJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-2-ZCR6
Document cyber security requirements, assumptions and constraints
Dubai ISROman NCFUAE IACJISCIS ControlsNCA ECC-2ADHICSISO 27001NCA CCCPCI DSS 4.0.1Qatar NIASAMA CSF
3-2-ZCR7
Asset owner approval
Dubai ISRCJISCBUAE CSFBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-FR1 · Part 3-3 FR 1 Identification and authentication control 24
3-3-SR1.1
Human user identification and authentication
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR1.1.RE1
Unique identification and authentication
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR1.1.RE2
Multifactor authentication for untrusted networks
Dubai ISRADHICSKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusHIPAA Security RuleNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIA
3-3-SR1.1.RE3
Multifactor authentication for all networks
Dubai ISRADHICSKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusHIPAA Security RuleNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIA
3-3-SR1.2
Software process and device identification and authentication
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR1.2.RE1
Unique identification and authentication
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR1.3
Account management
Dubai ISRADHICSCJISCIS ControlsHIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFQatar NIASAMA CSFUAE IAPCI DSS 4.0.1
3-3-SR1.3.RE1
Unified account management
Dubai ISRADHICSCJISCIS ControlsHIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFQatar NIASAMA CSFUAE IAPCI DSS 4.0.1
3-3-SR1.4
Identifier management
Dubai ISRADHICSCJISCIS ControlsHIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFQatar NIASAMA CSFUAE IAPCI DSS 4.0.1
3-3-SR1.5
Authenticator management
Dubai ISRADHICSCJISCIS ControlsHIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFQatar NIASAMA CSFUAE IAPCI DSS 4.0.1
3-3-SR1.5.RE1
Hardware security for software process identity credentials
Dubai ISRKuwait NCFOman NCFUAE IACJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUK GDPR
3-3-SR1.6
Wireless access management
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR1.6.RE1
Unique identification and authentication
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR1.7
Strength of password-based authentication
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR1.7.RE1
Password generation and lifetime restrictions for human users
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR1.7.RE2
Password lifetime restrictions for all users
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR1.8
Public key infrastructure certificates
Dubai ISRKuwait NCFOman NCFUAE IACJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUK GDPR
3-3-SR1.9
Strength of public key authentication
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR1.9.RE1
Hardware security for public key authentication
Dubai ISRKuwait NCFOman NCFUAE IACJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUK GDPR
3-3-SR1.10
Authenticator feedback
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR1.11
Unsuccessful login attempts
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR1.12
System use notification
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR1.13
Access via untrusted networks
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR1.13.RE1
Explicit access request approval
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-FR2 · Part 3-3 FR 2 Use control 24
3-3-SR2.1
Authorization enforcement
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR2.1.RE1
Authorization enforcement for all users
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR2.1.RE2
Permission mapping to roles
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR2.1.RE3
Supervisor override
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR2.1.RE4
Dual approval
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR2.2
Wireless use control
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR2.2.RE1
Identify and report unauthorized wireless devices
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR2.3
Use control for portable and mobile devices
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR2.3.RE1
Enforcement of security status of portable and mobile devices
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR2.4
Mobile code
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIAUAE IA
3-3-SR2.4.RE1
Mobile code integrity check
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIAUAE IA
3-3-SR2.5
Session lock
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR2.6
Remote session termination
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR2.7
Concurrent session control
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR2.8
Auditable events
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR2.8.RE1
Centrally managed, system-wide audit trail
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR2.9
Audit storage capacity
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR2.9.RE1
Warn when audit record storage capacity threshold reached
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR2.10
Response to audit processing failures
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR2.11
Timestamps
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR2.11.RE1
Internal time synchronization
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR2.11.RE2
Protection of time source integrity
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR2.12
Non-repudiation
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR2.12.RE1
Non-repudiation for all users
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-FR3 · Part 3-3 FR 3 System integrity 19
3-3-SR3.1
Communication integrity
Dubai ISRKuwait NCFOman NCFUAE IACJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUK GDPR
3-3-SR3.1.RE1
Cryptographic integrity protection
Dubai ISRKuwait NCFOman NCFUAE IACJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUK GDPR
3-3-SR3.2
Malicious code protection
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIAUAE IA
3-3-SR3.2.RE1
Malicious code protection on entry and exit points
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIAUAE IA
3-3-SR3.2.RE2
Central management and reporting for malicious code protection
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIAUAE IA
3-3-SR3.3
Security functionality verification
Dubai ISRBahrain NCSCKuwait NCFOman NCFADHICSCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IA
3-3-SR3.3.RE1
Automated mechanisms for security functionality verification
Dubai ISRBahrain NCSCKuwait NCFOman NCFADHICSCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IA
3-3-SR3.3.RE2
Security functionality verification during normal operation
Dubai ISRBahrain NCSCKuwait NCFOman NCFADHICSCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IA
3-3-SR3.4
Software and information integrity
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR3.4.RE1
Automated notification about integrity violations
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR3.5
Input validation
Dubai ISROman NCFUAE IACJISCIS ControlsNCA ECC-2ADHICSISO 27001NCA CCCPCI DSS 4.0.1Qatar NIASAMA CSF
3-3-SR3.6
Deterministic output
Bahrain NCSCNCA OTCC
3-3-SR3.7
Error handling
Dubai ISROman NCFUAE IACJISCIS ControlsNCA ECC-2ADHICSISO 27001NCA CCCPCI DSS 4.0.1Qatar NIASAMA CSF
3-3-SR3.8
Session integrity
Dubai ISROman NCFUAE IACJISCIS ControlsNCA ECC-2ADHICSISO 27001NCA CCCPCI DSS 4.0.1Qatar NIASAMA CSF
3-3-SR3.8.RE1
Invalidation of session IDs after session termination
Dubai ISROman NCFUAE IACJISCIS ControlsNCA ECC-2ADHICSISO 27001NCA CCCPCI DSS 4.0.1Qatar NIASAMA CSF
3-3-SR3.8.RE2
Unique session ID generation
Dubai ISROman NCFUAE IACJISCIS ControlsNCA ECC-2ADHICSISO 27001NCA CCCPCI DSS 4.0.1Qatar NIASAMA CSF
3-3-SR3.8.RE3
Randomness of session IDs
Dubai ISROman NCFUAE IACJISCIS ControlsNCA ECC-2ADHICSISO 27001NCA CCCPCI DSS 4.0.1Qatar NIASAMA CSF
3-3-SR3.9
Protection of audit information
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR3.9.RE1
Audit records on write-once media
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-FR4 · Part 3-3 FR 4 Data confidentiality 6
3-3-SR4.1
Information confidentiality
Dubai ISRKuwait NCFOman NCFUAE IACJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUK GDPR
3-3-SR4.1.RE1
Protection of confidentiality at rest or in transit via untrusted networks
Dubai ISRKuwait NCFOman NCFUAE IACJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUK GDPR
3-3-SR4.1.RE2
Protection of confidentiality across zone boundaries
Dubai ISRKuwait NCFOman NCFUAE IACJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUK GDPR
3-3-SR4.2
Information persistence
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR4.2.RE1
Purging of shared memory resources
3-3-SR4.3
Use of cryptography
Dubai ISRKuwait NCFOman NCFUAE IACJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUK GDPR
3-3-FR5 · Part 3-3 FR 5 Restricted data flow 11
3-3-SR5.1
Network segmentation
ADHICSCJISCIS ControlsISO 27001NCA ECC-2NCA OTCCNIST CSFQatar NIAUAE IAPCI DSS 4.0.1Bahrain NCSC
3-3-SR5.1.RE1
Physical network segmentation
ADHICSCJISCIS ControlsISO 27001NCA ECC-2NCA OTCCNIST CSFQatar NIAUAE IAPCI DSS 4.0.1
3-3-SR5.1.RE2
Independence from non-control system networks
ADHICSCJISCIS ControlsISO 27001NCA ECC-2NCA OTCCNIST CSFQatar NIAUAE IAPCI DSS 4.0.1Bahrain NCSC
3-3-SR5.1.RE3
Logical and physical isolation of critical networks
ADHICSCJISCIS ControlsISO 27001NCA ECC-2NCA OTCCNIST CSFQatar NIAUAE IAPCI DSS 4.0.1Bahrain NCSC
3-3-SR5.2
Zone boundary protection
Dubai ISRADHICSBahrain NCSCOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusNCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIAUAE IAISO 27001
3-3-SR5.2.RE1
Deny by default, allow by exception
Dubai ISRADHICSBahrain NCSCOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusNCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIAUAE IAISO 27001
3-3-SR5.2.RE2
Island mode
ADHICSCJISCIS ControlsISO 27001NCA ECC-2NCA OTCCNIST CSFQatar NIAUAE IAPCI DSS 4.0.1Bahrain NCSC
3-3-SR5.2.RE3
Fail close
Dubai ISRADHICSBahrain NCSCOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusNCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIAUAE IAISO 27001
3-3-SR5.3
General purpose person-to-person communication restrictions
Dubai ISRADHICSBahrain NCSCOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusNCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIAUAE IAISO 27001
3-3-SR5.3.RE1
Prohibit all general purpose person-to-person communications
Dubai ISRADHICSBahrain NCSCOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusNCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIAUAE IAISO 27001
3-3-SR5.4
Application partitioning
Dubai ISROman NCFUAE IACJISCIS ControlsNCA ECC-2ADHICSISO 27001NCA CCCPCI DSS 4.0.1Qatar NIASAMA CSF
3-3-FR6 · Part 3-3 FR 6 Timely response to events 3
3-3-SR6.1
Audit log accessibility
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR6.1.RE1
Programmatic access to audit logs
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR6.2
Continuous monitoring
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-FR7 · Part 3-3 FR 7 Resource availability 13
3-3-SR7.1
Denial of service protection
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
3-3-SR7.1.RE1
Manage communication loads
Dubai ISRADHICSBahrain NCSCOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusNCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIAUAE IAISO 27001
3-3-SR7.1.RE2
Limit DoS effects to other systems or networks
ADHICSCJISCIS ControlsISO 27001NCA ECC-2NCA OTCCNIST CSFQatar NIAUAE IAPCI DSS 4.0.1
3-3-SR7.2
Resource management
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
3-3-SR7.3
Control system backup
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
3-3-SR7.3.RE1
Backup verification
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
3-3-SR7.3.RE2
Backup automation
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
3-3-SR7.4
Control system recovery and reconstitution
Dubai ISRADHICSCBUAE CSFBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
3-3-SR7.5
Emergency power
Dubai ISROman NCFADHICSHIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IA
3-3-SR7.6
Network and security configuration settings
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR7.6.RE1
Machine-readable reporting of current security settings
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR7.7
Least functionality
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
3-3-SR7.8
Control system component inventory
Dubai ISRADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR