المملكة: Urgent – Immediate reporting of breaches and record keeping 15 years.. A new national framework for cybersecurity

The National Cybersecurity Authority has proposed a draft national framework for sharing information and responding to incidents related to cybersecurity.
This framework is binding on all public and private entities in the Kingdom Cybersecurity of the entity, whether actual or potential.

Time frames for the Authority’s response

The Authority specified four time frames to respond to its requests in normal situations.

It indicated that immediate requests require action within a maximum of two hours, while it specified 12 hours for very urgent requests, 48 hours for urgent requests, and 72 hours for regular requests.

The Authority stressed the necessity of Entities maintain accurate records of all cyber incidents that are responded to for a period of no less than 15 years from the date of discovery of the incident.

It warned against destroying, deleting or modifying those records before submitting them to the Authority. The document classified cybersecurity incidents into five levels of gradual severity.

The authority revealed that the first level is considered catastrophic and includes infrastructure penetration that leads to damage to lives, while the fifth level represents limited incidents on a workstation without access to national data.

With regard to readiness, the authority obligated the authorities to conduct cyber exercises that simulate incidents to test response plans at least once a year.

Stages of the response process

It added that the response process takes place through four stages. It begins with planning and preparation, passes through detection, analysis, containment and recovery, and ends with review and drawing lessons learned.

The organization adopted the traffic light protocol to control the scope of sharing security information.

The authority stated that the red signal means highly sensitive information that can only be shared with the direct recipient, all the way to the transparent signal that allows information to be shared with the general public without restrictions.

The authority set next July 10 as a deadline to receive the visuals, calling on the authorities. Relevant parties may participate through the unified electronic platform for polling public opinions, “Survey,” or through the designated channels on the Authority’s website.

• For more: Follow Khaleejion 24 Arabic, Khaleejion 24 English, Khaleejion 24 Live, and for social media follow us on Facebook and Twitter