Requirement
In alignment with related laws and regulations, and in addition to the applicable controls in ECC and controls within DCC domain (1), (2), and (3); cybersecurity requirements when dealing with consultancy services that works on high-sensitivity strategic projects at the national level must cover at least the following:
Sub-Controls
3-1-2-1
Requirement: Screening or vetting consultancy services employees who have access to the data
3-1-2-2
Requirement: Requiring contractual commitment by consultancy services including employees non-disclosure agreements and secure disposal the organization's data at the end of the contract or in case of contract termination, including providing evidences of such disposal to the organization.
3-1-2-3
Requirement: Documenting all data sharing operations within consultancy services, including data sharing justification.
3-1-2-4
Requirement: Requiring consultancy services to notify the organization immediately in case of cybersecurity incident that may affect data that has been shared or created.
3-1-2-5
Requirement: Reclassifying data to the least level to achieve the objective before sharing it with consultancy services using data masking or data scrambling techniques.
3-1-2-6
Requirement: Dedicating a closed room for the consultancy services employees to perform their work, in addition to providing dedicated organization owned devices to share and process data.
3-1-2-7
Requirement: Activating access control system to allow only authorized access to the closed room.
3-1-2-8
Requirement: Preventing carrying out of devices, storage media and documents outside the closed room, as well as the entry of any other electronic devices.
