Requirement
[A: M | B: M] Cybersecurity requirements for protecting the entity's systems and information-processing devices must be defined, documented and approved, covering at minimum:
Sub-Controls
2-3-1-1
Requirement: [A: M | B: M] Protection against viruses, suspicious programs/activities and malware on servers, user devices and mobile devices, using modern protection technologies and mechanisms, managed securely.
2-3-1-2
Requirement: [A: M | B: M] Changing default configurations (e.g., deactivating unnecessary services, changing default passwords, restricting the use of removable media).
2-3-1-3
Requirement: [A: M | B: M] Clock synchronization, centrally and from an accurate and trusted source, such as that provided by the Saudi Standards, Metrology and Quality Organization.
