Requirement
In addition to the controls in ECC subdomain 4-1, cybersecurity requirements for contracts and agreements with third-parties must include at least the following:
Sub-Controls
4-1-1-1
Requirement: Screening or vetting of outsourcing and managed services companies and personnel who work on critical systems.
4-1-1-2
Requirement: Outsourcing and managed services of critical systems must rely on Saudi companies and organizations, in accordance with the relevant legislative and regulatory requirements.
References
- ECC – 2:2024 equivalent: 4-1
