Requirement
In addition to the controls in ECC subdomain 4-1, cybersecurity requirements for third-parties cybersecurity must include at least the following:
Sub-Controls
3-1-1-1
Requirement: Screening or vetting third-party employees who have access to the data.
3-1-1-2
Requirement: Requiring contractual commitment by third-parties to securely dispose the organization's data at the end of the contract or in case of contract termination, including providing evidences of such disposal to the organization.
3-1-1-3
Requirement: Documenting all data sharing operations within third-parties, including data sharing justification.
3-1-1-4
Requirement: When transferring data outside the kingdom, the capability of the hosting organization abroad to safeguard data must be verified, approval of the Authorizing Official must be obtained and complying with related laws and regulations.
3-1-1-5
Requirement: Requiring third-parties to notify the organization immediately in case of cybersecurity incident that may affect data that has been shared or created.
3-1-1-6
Requirement: Reclassifying data to the least level to achieve the objective before sharing it with third-parties using data masking or data scrambling techniques.
References
- ECC – 2:2024 equivalent: 4-1
