INSERT INTO `tm_wsal_metadata` (`id`, `occurrence_id`, `name`, `value`)
VALUES
	(272362,26264,'MetaValueOld','<p dir=\"LTR\" align=\"LEFT\"><img class=\"alignleft size-full wp-image-8046\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_641258596.jpg\" alt=\"\" width=\"4928\" height=\"1748\" /></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Saudi Arabian Ministry of Commerce and Investment (\"MoCI\") issued a Guiding Charter for Family Owned Businesses (\"Charter\") on 02-08-1439H corresponding to 18-04-2018G.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This article will provide a summary of the key provisions of the Charter and the added benefits it will bring to family owned businesses in Saudi Arabia (\"FOBs\" or the \"Company\" as the case may be).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">FOBs play an important role in Saudi Arabia’s economy, investment environment and job market. However, despite their various contributions to the economy, FOBs have at times failed to realize their full potential due to various factors some of which include a lack of transparency with respect to the management and operations of the Company, inadequate succession planning and the absence of a well-defined dispute resolution mechanism for addressing conflicts within the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Although the Charter is not binding, the issuance of the Charter is a welcome development as its main aim is to promote the growth of FOBs in Saudi Arabia, and provide them with a set of guiding principles that will allow them to operate in line with international best practices and standards.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>To which Companies does the Charter apply?</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Charter is intended for use by FOBs that are incorporated as closed joint stock companies in Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">FOBs that are listed on the Saudi Arabian stock exchange (the \"Tadawul\") as open joint stock companies are already subject to the Capital Market Authority’s corporate governance regulations.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">However, the vast majority of FOBs operating in Saudi Arabia are not listed on the Tadawul. MoCI therefore recognized a need to fill this gap by establishing protocols for FOBs to follow.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Saudi Arabian Companies Law issued by Royal Decree no. M/3 dated 28-01-1437H corresponding to 11-11-2015G (as amended) (the \"Companies Law\") will take precedence over the provisions of the Charter as the Charter is meant to be complementary to the Companies Law and provide a set of guiding principles for FOBs to implement in conjunction with their existing regulatory obligations.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>What are the Charter’s Objectives?</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The objectives of the Charter include the following:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Provide a guiding framework for FOBs to operate in an efficient and growth-oriented manner in conformance with international best practices and standards.</li>\r\n 	<li dir=\"LTR\">Provide a common vision for family members with respect to the Company’s values and strategic objectives.</li>\r\n 	<li dir=\"LTR\">Enhance accountability and control mechanisms for the shareholders of FOBs.</li>\r\n 	<li dir=\"LTR\">Set-up well-defined strategies and protocols that promote transparency and govern the interaction of the family within the Company.</li>\r\n 	<li dir=\"LTR\">Achieve a proper and fair balance between the interests of the family members and the interests of the Company.</li>\r\n 	<li dir=\"LTR\">Put succession plans into place (for both ownership and management) to ensure their survival and orderly transition.</li>\r\n 	<li dir=\"LTR\">Provide a well-defined mechanism for the timely resolution of any family disputes that may occur, and to ensure that such disputes do not impede decision-making within the Company.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"alignleft  wp-image-8108\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/08/shutterstock_574104421-2-1024x1024.jpg\" alt=\"\" width=\"521\" height=\"521\" />Shareholders’ Assemblies</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Similar to what is provided in the Companies Law, shareholder meetings are conducted through the Ordinary General Assembly and Extraordinary General Assembly (collectively referred to as the \"Shareholders’ Assemblies\").</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Shareholders’ Assemblies are required to hold all of their meetings in accordance with the provisions of the Companies Law and the Company’s articles of association.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Resolutions passed during any meeting held by the Shareholders’ Assemblies are valid and binding upon all of the family members in the Company, regardless of whether such family members attended the meetings in which the resolutions were issued.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Family Board is entitled to submit a written request to the Board of Directors to invite the Ordinary General Assembly (or the Extraordinary General Assembly as the case may be) to convene provided the written request contains justifications for convening the Ordinary General Assembly. In the event the Board of Directors fails to respond to the Family Board’s written request, then the Family Board (discussed in further detail below) is entitled to seek the written approval of family members representing at least 5% of the Company’s share capital in order to obligate the Board of Directors to invite the Ordinary General Assembly to convene.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure that the Company operates in an institutional manner, family members are prohibited from taking any adverse actions that would prevent the Shareholders’ Assemblies from exercising their functions set out in the Companies Law, the Company’s articles of association and Charter.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Family Board</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Charter prescribes the formation of a Family Board. The Family Board’s competencies include the following:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Monitor the overall performance of the Board of Directors and ensure they are compliant with the provisions of the Companies Law and the articles of association of the Company. For this purpose, the Family Board can provide an opinion on potential candidates for the Board of Directors. They also have the authority to investigate whether any member of the Board of Directors is engaging in an activity that is detrimental to the Company such as whether there is a potential conflict of interest or unauthorized disclosure of the Company’s trade secrets.</li>\r\n 	<li dir=\"LTR\">Resolve any disputes that arise between family members that may affect the Company’s operations (further details on the dispute resolution mechanism will be provided below).</li>\r\n 	<li dir=\"LTR\">Consider recommendations from family members for the investment of the Company’s assets and presenting them to the Board of Directors for their approval.</li>\r\n 	<li dir=\"LTR\">Take any necessary actions to ensure that new generations of family members are trained and prepared to manage the Company in the future.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">The competencies of the Family Board cannot be in direct conflict with the competencies of the Shareholders’ Assemblies and Board of Directors under the Companies Law, the articles of association of the Company and the Charter.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is recommended for a Family Board to be formed when there are more than 12 family members in the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure the Family Board exercises its competencies in an effective manner, there should not be more than 6 Family Board members. Members of the Family Board are elected by secret ballot at a special meeting held for this purpose. Members should be elected based on their personal and professional capabilities.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">A member of the Family Board is not permitted to be a member of the Board of Directors or the executive team of the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The term of the Family Board members is restricted to 3 years, and a member is not permitted to be on the Family Board for more than 2 consecutive terms.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Elections for Family Board members take place under the direction of an Election Committee consisting of 5 family members or any other members appointed by the Ordinary General Assembly. A member appointed to the Election Committee is prohibited from serving as a Family Board member. The Election Committee is required to hold elections for the Family Board members at least 25 days prior to the end of their term. The Election Committee should ensure that the election process is held transparently and impartially.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Family Board should have a Chairman and Deputy-Chairman. They are selected by the Family Board members through secret ballot under the supervision of the Election Committee.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Family Board is required to hold at least 4 meetings each financial year. The Family Board should hold a special meeting prior to any meeting held by the Shareholders’ Assemblies in order to consider the agenda items and to make any recommendations it considers necessary within the scope of its competencies.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The majority of the Family Board members should be present in order for a meeting to be valid. Resolutions issued by the Family Board will need to be approved by a majority of the members present at the meeting. In the event of a deadlock, the Chairman will have the casting vote. The Chairman will invite the Family Board to convene when requested to do so by 2 or more members.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Family Board members are entitled to receive remuneration for attending meetings. Remuneration will be equivalent to what is prescribed to Board of Directors members who attend meetings.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">As referenced above, the Charter prescribes a multi-tiered mechanism for the resolution of any disputes that may occur between family members.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Initially, private discussions are held between members of the Family Board to determine the reasons for the dispute and the most optimal way forward to resolving the dispute. The Family Board assigns the Chairman or one of its members who do not have any involvement in the dispute to take the lead in amicably resolving the dispute. The Family Board member assigned to resolve the dispute will then hold discussions with the disputing parties in an effort to resolve the dispute in a manner that is in the best interests of both the family members and the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In the event the dispute cannot be settled amicably, a conciliation body consisting of non-family members will be formed in an attempt to settle the dispute in a fair and impartial manner. The Family Board, in consultation with the disputing members, will determine the scope and composition of the conciliation body.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If the conciliation body referred to in the preceding paragraph cannot be formed or is unable to resolve the dispute, the Family Board will recommend the disputing parties to resolve their dispute through arbitration or a court. The Family Board will need to take necessary measures to ensure that this does not have an adverse effect on the Company’s operations. The Family Board should continue to make an effort to resolve the dispute until a final binding decision is issued by the arbitration tribunal or court. When a final binding decision is issued, the Family Board should ensure that this decision is implemented.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Board of Directors</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Similar to what is provided in the Companies Law, the Board of Directors has wide ranging authority to manage the affairs of the Company and maximize its value. All shareholders are prohibited from interfering with the Board’s functions or the executive team of the Company, unless they are members of the Board or the executive team.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Board members of the Company will be elected by the Ordinary General Assembly. The recommended number of Board members should be between 5 and 9.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">A Chairman and a Deputy Chairman will need to be elected by the Board of Directors through secret ballot. The Chairman of the Board of Directors is not permitted to hold an executive position within the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">When electing Board members, the Ordinary General Assembly should take into consideration each candidate’s personal and professional capabilities such as his or her ability to lead, competence, financial expertise and medical fitness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The term of the Board of Directors cannot exceed 3 years. Board members may be re-elected for 1 or more terms.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The CEO of the Company is selected through a resolution issued by the Board of Directors. It is not permissible for the CEO to be the Chairman or Deputy Chairman of the Board of Directors.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Board of Directors has the authority to form an Advisory Board to assist it with its functions. The members of the Advisory Board should have the necessary experience and competence to assist the Board of Directors in developing strategic objectives to ensure the Company’s continuity and growth. The Board of Directors is tasked with establishing the bylaws for the Advisory Board which must then be submitted to the Ordinary General Assembly for approval.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Board of Directors has the authority to form additional committees as it deems necessary to assist it with its functions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"alignleft size-full wp-image-8047\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_737881615-Converted-01.jpg\" alt=\"\" width=\"3967\" height=\"1751\" /></strong></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Sale of Shares</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Any shareholder who intends to sell all or part of his or her shares in the Company will be required to notify all of the shareholders in writing through the Board of Directors. Each shareholder may exercise their priority right to purchase the shares put up for sale within 30 days from the date of notification. In the event 30 days elapse and no shareholder exercises his or her right to purchase the shares, the shareholder may proceed to sell the shares to a third party. It should be noted that this procedure will not be applicable to any transfer of shares by legal inheritance.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Company Policy</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">A human resources policy should be developed for the Company that contains clear rules for employing a family member, which will address issues such as qualifications, experience, performance, evaluation and termination.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is not permissible to create a position for the specific purpose of appointing a family member. Additionally, it is not permissible to terminate, without a valid justification, an employee who is not a family member in order to replace him or her with a family member instead.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The salary of an employee, whether or not a member of the family, should be commensurate with the employee’s position, responsibilities, academic qualifications and level of performance.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The work of a family member employed in the Company should not be subject to the supervision of another family member. In addition, no more than 1 member of the family should work in the same department unless it is in the best interests of the Company.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Additional Provisions</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">A family member is entitled to submit a proposal to amend the Charter. The Family Board will assess the proposal to amend the Charter and prepare a report on its findings which will be presented to the Ordinary General Assembly for its consideration and approval.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The articles of association of the Company should be amended in order to be commensurate with the provisions of the Charter.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Charter should be reviewed by shareholders on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is advisable for the Charter to include the names and signatures of each shareholder of the Company on the final page.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\nIn conclusion, even though the Charter is merely a guide and is not mandatory for FOBs operating in Saudi Arabia, its issuance is nevertheless a positive development as it will raise a general awareness amongst FOBs of the importance of implementing proper governance frameworks and point the way to international best practice and standards and allow them to increase their contribution to the local economy. It may also provide a roadmap for the enactment of future legislation that will be binding on FOBs.\r\n\r\n&nbsp;'),
	(272363,26264,'MetaLink','content'),
	(272364,26264,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7960&amp;action=edit'),
	(272365,26264,'ReportText','<p dir=\"LTR\" align=\"LEFT\"><img class=\"alignleft size-full wp-image-8046\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_641258596.jpg\" alt=\"\" width=\"4928\" height=\"1748\" /></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Saudi Arabian Ministry of Commerce and Investment (\"MoCI\") issued a Guiding Charter for Family Owned Businesses (\"Charter\") on 02-08-1439H corresponding to 18-04-2018G.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This article will provide a summary of the key provisions of the Charter and the added benefits it will bring to family owned businesses in Saudi Arabia (\"FOBs\" or the \"Company\" as the case may be).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">FOBs play an important role in Saudi Arabia’s economy, investment environment and job market. However, despite their various contributions to the economy, FOBs have at times failed to realize their full potential due to various factors some of which include a lack of transparency with respect to the management and operations of the Company, inadequate succession planning and the absence of a well-defined dispute resolution mechanism for addressing conflicts within the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Although the Charter is not binding, the issuance of the Charter is a welcome development as its main aim is to promote the growth of FOBs in Saudi Arabia, and provide them with a set of guiding principles that will allow them to operate in line with international best practices and standards.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>To which Companies does the Charter apply?</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Charter is intended for use by FOBs that are incorporated as closed joint stock companies in Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">FOBs that are listed on the Saudi Arabian stock exchange (the \"Tadawul\") as open joint stock companies are already subject to the Capital Market Authority’s corporate governance regulations.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">However, the vast majority of FOBs operating in Saudi Arabia are not listed on the Tadawul. MoCI therefore recognized a need to fill this gap by establishing protocols for FOBs to follow.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Saudi Arabian Companies Law issued by Royal Decree no. M/3 dated 28-01-1437H corresponding to 11-11-2015G (as amended) (the \"Companies Law\") will take precedence over the provisions of the Charter as the Charter is meant to be complementary to the Companies Law and provide a set of guiding principles for FOBs to implement in conjunction with their existing regulatory obligations.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>What are the Charter’s Objectives?</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The objectives of the Charter include the following:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Provide a guiding framework for FOBs to operate in an efficient and growth-oriented manner in conformance with international best practices and standards.</li>\r\n 	<li dir=\"LTR\">Provide a common vision for family members with respect to the Company’s values and strategic objectives.</li>\r\n 	<li dir=\"LTR\">Enhance accountability and control mechanisms for the shareholders of FOBs.</li>\r\n 	<li dir=\"LTR\">Set-up well-defined strategies and protocols that promote transparency and govern the interaction of the family within the Company.</li>\r\n 	<li dir=\"LTR\">Achieve a proper and fair balance between the interests of the family members and the interests of the Company.</li>\r\n 	<li dir=\"LTR\">Put succession plans into place (for both ownership and management) to ensure their survival and orderly transition.</li>\r\n 	<li dir=\"LTR\">Provide a well-defined mechanism for the timely resolution of any family disputes that may occur, and to ensure that such disputes do not impede decision-making within the Company.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"alignleft  wp-image-8108\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/08/shutterstock_574104421-2-1024x1024.jpg\" alt=\"\" width=\"521\" height=\"521\" />Shareholders’ Assemblies</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Similar to what is provided in the Companies Law, shareholder meetings are conducted through the Ordinary General Assembly and Extraordinary General Assembly (collectively referred to as the \"Shareholders’ Assemblies\").</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Shareholders’ Assemblies are required to hold all of their meetings in accordance with the provisions of the Companies Law and the Company’s articles of association.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Resolutions passed during any meeting held by the Shareholders’ Assemblies are valid and binding upon all of the family members in the Company, regardless of whether such family members attended the meetings in which the resolutions were issued.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Family Board is entitled to submit a written request to the Board of Directors to invite the Ordinary General Assembly (or the Extraordinary General Assembly as the case may be) to convene provided the written request contains justifications for convening the Ordinary General Assembly. In the event the Board of Directors fails to respond to the Family Board’s written request, then the Family Board (discussed in further detail below) is entitled to seek the written approval of family members representing at least 5% of the Company’s share capital in order to obligate the Board of Directors to invite the Ordinary General Assembly to convene.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure that the Company operates in an institutional manner, family members are prohibited from taking any adverse actions that would prevent the Shareholders’ Assemblies from exercising their functions set out in the Companies Law, the Company’s articles of association and Charter.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Family Board</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Charter prescribes the formation of a Family Board. The Family Board’s competencies include the following:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Monitor the overall performance of the Board of Directors and ensure they are compliant with the provisions of the Companies Law and the articles of association of the Company. For this purpose, the Family Board can provide an opinion on potential candidates for the Board of Directors. They also have the authority to investigate whether any member of the Board of Directors is engaging in an activity that is detrimental to the Company such as whether there is a potential conflict of interest or unauthorized disclosure of the Company’s trade secrets.</li>\r\n 	<li dir=\"LTR\">Resolve any disputes that arise between family members that may affect the Company’s operations (further details on the dispute resolution mechanism will be provided below).</li>\r\n 	<li dir=\"LTR\">Consider recommendations from family members for the investment of the Company’s assets and presenting them to the Board of Directors for their approval.</li>\r\n 	<li dir=\"LTR\">Take any necessary actions to ensure that new generations of family members are trained and prepared to manage the Company in the future.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">The competencies of the Family Board cannot be in direct conflict with the competencies of the Shareholders’ Assemblies and Board of Directors under the Companies Law, the articles of association of the Company and the Charter.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is recommended for a Family Board to be formed when there are more than 12 family members in the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure the Family Board exercises its competencies in an effective manner, there should not be more than 6 Family Board members. Members of the Family Board are elected by secret ballot at a special meeting held for this purpose. Members should be elected based on their personal and professional capabilities.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">A member of the Family Board is not permitted to be a member of the Board of Directors or the executive team of the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The term of the Family Board members is restricted to 3 years, and a member is not permitted to be on the Family Board for more than 2 consecutive terms.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Elections for Family Board members take place under the direction of an Election Committee consisting of 5 family members or any other members appointed by the Ordinary General Assembly. A member appointed to the Election Committee is prohibited from serving as a Family Board member. The Election Committee is required to hold elections for the Family Board members at least 25 days prior to the end of their term. The Election Committee should ensure that the election process is held transparently and impartially.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Family Board should have a Chairman and Deputy-Chairman. They are selected by the Family Board members through secret ballot under the supervision of the Election Committee.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Family Board is required to hold at least 4 meetings each financial year. The Family Board should hold a special meeting prior to any meeting held by the Shareholders’ Assemblies in order to consider the agenda items and to make any recommendations it considers necessary within the scope of its competencies.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The majority of the Family Board members should be present in order for a meeting to be valid. Resolutions issued by the Family Board will need to be approved by a majority of the members present at the meeting. In the event of a deadlock, the Chairman will have the casting vote. The Chairman will invite the Family Board to convene when requested to do so by 2 or more members.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Family Board members are entitled to receive remuneration for attending meetings. Remuneration will be equivalent to what is prescribed to Board of Directors members who attend meetings.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">As referenced above, the Charter prescribes a multi-tiered mechanism for the resolution of any disputes that may occur between family members.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Initially, private discussions are held between members of the Family Board to determine the reasons for the dispute and the most optimal way forward to resolving the dispute. The Family Board assigns the Chairman or one of its members who do not have any involvement in the dispute to take the lead in amicably resolving the dispute. The Family Board member assigned to resolve the dispute will then hold discussions with the disputing parties in an effort to resolve the dispute in a manner that is in the best interests of both the family members and the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In the event the dispute cannot be settled amicably, a conciliation body consisting of non-family members will be formed in an attempt to settle the dispute in a fair and impartial manner. The Family Board, in consultation with the disputing members, will determine the scope and composition of the conciliation body.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If the conciliation body referred to in the preceding paragraph cannot be formed or is unable to resolve the dispute, the Family Board will recommend the disputing parties to resolve their dispute through arbitration or a court. The Family Board will need to take necessary measures to ensure that this does not have an adverse effect on the Company’s operations. The Family Board should continue to make an effort to resolve the dispute until a final binding decision is issued by the arbitration tribunal or court. When a final binding decision is issued, the Family Board should ensure that this decision is implemented.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Board of Directors</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Similar to what is provided in the Companies Law, the Board of Directors has wide ranging authority to manage the affairs of the Company and maximize its value. All shareholders are prohibited from interfering with the Board’s functions or the executive team of the Company, unless they are members of the Board or the executive team.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Board members of the Company will be elected by the Ordinary General Assembly. The recommended number of Board members should be between 5 and 9.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">A Chairman and a Deputy Chairman will need to be elected by the Board of Directors through secret ballot. The Chairman of the Board of Directors is not permitted to hold an executive position within the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">When electing Board members, the Ordinary General Assembly should take into consideration each candidate’s personal and professional capabilities such as his or her ability to lead, competence, financial expertise and medical fitness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The term of the Board of Directors cannot exceed 3 years. Board members may be re-elected for 1 or more terms.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The CEO of the Company is selected through a resolution issued by the Board of Directors. It is not permissible for the CEO to be the Chairman or Deputy Chairman of the Board of Directors.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Board of Directors has the authority to form an Advisory Board to assist it with its functions. The members of the Advisory Board should have the necessary experience and competence to assist the Board of Directors in developing strategic objectives to ensure the Company’s continuity and growth. The Board of Directors is tasked with establishing the bylaws for the Advisory Board which must then be submitted to the Ordinary General Assembly for approval.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Board of Directors has the authority to form additional committees as it deems necessary to assist it with its functions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"alignleft size-full wp-image-8047\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_737881615-Converted-01.jpg\" alt=\"\" width=\"3967\" height=\"1751\" /></strong></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Sale of Shares</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Any shareholder who intends to sell all or part of his or her shares in the Company will be required to notify all of the shareholders in writing through the Board of Directors. Each shareholder may exercise their priority right to purchase the shares put up for sale within 30 days from the date of notification. In the event 30 days elapse and no shareholder exercises his or her right to purchase the shares, the shareholder may proceed to sell the shares to a third party. It should be noted that this procedure will not be applicable to any transfer of shares by legal inheritance.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Company Policy</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">A human resources policy should be developed for the Company that contains clear rules for employing a family member, which will address issues such as qualifications, experience, performance, evaluation and termination.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is not permissible to create a position for the specific purpose of appointing a family member. Additionally, it is not permissible to terminate, without a valid justification, an employee who is not a family member in order to replace him or her with a family member instead.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The salary of an employee, whether or not a member of the family, should be commensurate with the employee’s position, responsibilities, academic qualifications and level of performance.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The work of a family member employed in the Company should not be subject to the supervision of another family member. In addition, no more than 1 member of the family should work in the same department unless it is in the best interests of the Company.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Additional Provisions</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">A family member is entitled to submit a proposal to amend the Charter. The Family Board will assess the proposal to amend the Charter and prepare a report on its findings which will be presented to the Ordinary General Assembly for its consideration and approval.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The articles of association of the Company should be amended in order to be commensurate with the provisions of the Charter.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Charter should be reviewed by shareholders on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is advisable for the Charter to include the names and signatures of each shareholder of the Company on the final page.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\nIn conclusion, even though the Charter is merely a guide and is not mandatory for FOBs operating in Saudi Arabia, its issuance is nevertheless a positive development as it will raise a general awareness amongst FOBs of the importance of implementing proper governance frameworks and point the way to international best practice and standards and allow them to increase their contribution to the local economy. It may also provide a roadmap for the enactment of future legislation that will be binding on FOBs.\r\n\r\n&nbsp;|<p dir=\"LTR\" align=\"LEFT\"><img class=\"alignleft size-full wp-image-8046\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_641258596.jpg\" alt=\"\" width=\"4928\" height=\"1748\" /></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Saudi Arabian Ministry of Commerce and Investment (\"MoCI\") issued a Guiding Charter for Family Owned Businesses (\"Charter\") on 02-08-1439H corresponding to 18-04-2018G.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This article will provide a summary of the key provisions of the Charter and the added benefits it will bring to family owned businesses in Saudi Arabia (\"FOBs\" or the \"Company\" as the case may be).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">FOBs play an important role in Saudi Arabia’s economy, investment environment and job market. However, despite their various contributions to the economy, FOBs have at times failed to realize their full potential due to various factors some of which include a lack of transparency with respect to the management and operations of the Company, inadequate succession planning and the absence of a well-defined dispute resolution mechanism for addressing conflicts within the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Although the Charter is not binding, the issuance of the Charter is a welcome development as its main aim is to promote the growth of FOBs in Saudi Arabia, and provide them with a set of guiding principles that will allow them to operate in line with international best practices and standards.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>To which Companies does the Charter apply?</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Charter is intended for use by FOBs that are incorporated as closed joint stock companies in Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">FOBs that are listed on the Saudi Arabian stock exchange (the \"Tadawul\") as open joint stock companies are already subject to the Capital Market Authority’s corporate governance regulations.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">However, the vast majority of FOBs operating in Saudi Arabia are not listed on the Tadawul. MoCI therefore recognized a need to fill this gap by establishing protocols for FOBs to follow.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Saudi Arabian Companies Law issued by Royal Decree no. M/3 dated 28-01-1437H corresponding to 11-11-2015G (as amended) (the \"Companies Law\") will take precedence over the provisions of the Charter as the Charter is meant to be complementary to the Companies Law and provide a set of guiding principles for FOBs to implement in conjunction with their existing regulatory obligations.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>What are the Charter’s Objectives?</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The objectives of the Charter include the following:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Provide a guiding framework for FOBs to operate in an efficient and growth-oriented manner in conformance with international best practices and standards.</li>\r\n 	<li dir=\"LTR\">Provide a common vision for family members with respect to the Company’s values and strategic objectives.</li>\r\n 	<li dir=\"LTR\">Enhance accountability and control mechanisms for the shareholders of FOBs.</li>\r\n 	<li dir=\"LTR\">Set-up well-defined strategies and protocols that promote transparency and govern the interaction of the family within the Company.</li>\r\n 	<li dir=\"LTR\">Achieve a proper and fair balance between the interests of the family members and the interests of the Company.</li>\r\n 	<li dir=\"LTR\">Put succession plans into place (for both ownership and management) to ensure their survival and orderly transition.</li>\r\n 	<li dir=\"LTR\">Provide a well-defined mechanism for the timely resolution of any family disputes that may occur, and to ensure that such disputes do not impede decision-making within the Company.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"alignleft wp-image-8108\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/08/shutterstock_574104421-2-1024x1024.jpg\" alt=\"\" width=\"322\" height=\"322\" />Shareholders’ Assemblies</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Similar to what is provided in the Companies Law, shareholder meetings are conducted through the Ordinary General Assembly and Extraordinary General Assembly (collectively referred to as the \"Shareholders’ Assemblies\").</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Shareholders’ Assemblies are required to hold all of their meetings in accordance with the provisions of the Companies Law and the Company’s articles of association.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Resolutions passed during any meeting held by the Shareholders’ Assemblies are valid and binding upon all of the family members in the Company, regardless of whether such family members attended the meetings in which the resolutions were issued.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Family Board is entitled to submit a written request to the Board of Directors to invite the Ordinary General Assembly (or the Extraordinary General Assembly as the case may be) to convene provided the written request contains justifications for convening the Ordinary General Assembly. In the event the Board of Directors fails to respond to the Family Board’s written request, then the Family Board (discussed in further detail below) is entitled to seek the written approval of family members representing at least 5% of the Company’s share capital in order to obligate the Board of Directors to invite the Ordinary General Assembly to convene.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure that the Company operates in an institutional manner, family members are prohibited from taking any adverse actions that would prevent the Shareholders’ Assemblies from exercising their functions set out in the Companies Law, the Company’s articles of association and Charter.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Family Board</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Charter prescribes the formation of a Family Board. The Family Board’s competencies include the following:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Monitor the overall performance of the Board of Directors and ensure they are compliant with the provisions of the Companies Law and the articles of association of the Company. For this purpose, the Family Board can provide an opinion on potential candidates for the Board of Directors. They also have the authority to investigate whether any member of the Board of Directors is engaging in an activity that is detrimental to the Company such as whether there is a potential conflict of interest or unauthorized disclosure of the Company’s trade secrets.</li>\r\n 	<li dir=\"LTR\">Resolve any disputes that arise between family members that may affect the Company’s operations (further details on the dispute resolution mechanism will be provided below).</li>\r\n 	<li dir=\"LTR\">Consider recommendations from family members for the investment of the Company’s assets and presenting them to the Board of Directors for their approval.</li>\r\n 	<li dir=\"LTR\">Take any necessary actions to ensure that new generations of family members are trained and prepared to manage the Company in the future.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">The competencies of the Family Board cannot be in direct conflict with the competencies of the Shareholders’ Assemblies and Board of Directors under the Companies Law, the articles of association of the Company and the Charter.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is recommended for a Family Board to be formed when there are more than 12 family members in the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure the Family Board exercises its competencies in an effective manner, there should not be more than 6 Family Board members. Members of the Family Board are elected by secret ballot at a special meeting held for this purpose. Members should be elected based on their personal and professional capabilities.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">A member of the Family Board is not permitted to be a member of the Board of Directors or the executive team of the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The term of the Family Board members is restricted to 3 years, and a member is not permitted to be on the Family Board for more than 2 consecutive terms.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Elections for Family Board members take place under the direction of an Election Committee consisting of 5 family members or any other members appointed by the Ordinary General Assembly. A member appointed to the Election Committee is prohibited from serving as a Family Board member. The Election Committee is required to hold elections for the Family Board members at least 25 days prior to the end of their term. The Election Committee should ensure that the election process is held transparently and impartially.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Family Board should have a Chairman and Deputy-Chairman. They are selected by the Family Board members through secret ballot under the supervision of the Election Committee.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Family Board is required to hold at least 4 meetings each financial year. The Family Board should hold a special meeting prior to any meeting held by the Shareholders’ Assemblies in order to consider the agenda items and to make any recommendations it considers necessary within the scope of its competencies.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The majority of the Family Board members should be present in order for a meeting to be valid. Resolutions issued by the Family Board will need to be approved by a majority of the members present at the meeting. In the event of a deadlock, the Chairman will have the casting vote. The Chairman will invite the Family Board to convene when requested to do so by 2 or more members.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Family Board members are entitled to receive remuneration for attending meetings. Remuneration will be equivalent to what is prescribed to Board of Directors members who attend meetings.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">As referenced above, the Charter prescribes a multi-tiered mechanism for the resolution of any disputes that may occur between family members.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Initially, private discussions are held between members of the Family Board to determine the reasons for the dispute and the most optimal way forward to resolving the dispute. The Family Board assigns the Chairman or one of its members who do not have any involvement in the dispute to take the lead in amicably resolving the dispute. The Family Board member assigned to resolve the dispute will then hold discussions with the disputing parties in an effort to resolve the dispute in a manner that is in the best interests of both the family members and the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In the event the dispute cannot be settled amicably, a conciliation body consisting of non-family members will be formed in an attempt to settle the dispute in a fair and impartial manner. The Family Board, in consultation with the disputing members, will determine the scope and composition of the conciliation body.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If the conciliation body referred to in the preceding paragraph cannot be formed or is unable to resolve the dispute, the Family Board will recommend the disputing parties to resolve their dispute through arbitration or a court. The Family Board will need to take necessary measures to ensure that this does not have an adverse effect on the Company’s operations. The Family Board should continue to make an effort to resolve the dispute until a final binding decision is issued by the arbitration tribunal or court. When a final binding decision is issued, the Family Board should ensure that this decision is implemented.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Board of Directors</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Similar to what is provided in the Companies Law, the Board of Directors has wide ranging authority to manage the affairs of the Company and maximize its value. All shareholders are prohibited from interfering with the Board’s functions or the executive team of the Company, unless they are members of the Board or the executive team.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Board members of the Company will be elected by the Ordinary General Assembly. The recommended number of Board members should be between 5 and 9.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">A Chairman and a Deputy Chairman will need to be elected by the Board of Directors through secret ballot. The Chairman of the Board of Directors is not permitted to hold an executive position within the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">When electing Board members, the Ordinary General Assembly should take into consideration each candidate’s personal and professional capabilities such as his or her ability to lead, competence, financial expertise and medical fitness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The term of the Board of Directors cannot exceed 3 years. Board members may be re-elected for 1 or more terms.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The CEO of the Company is selected through a resolution issued by the Board of Directors. It is not permissible for the CEO to be the Chairman or Deputy Chairman of the Board of Directors.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Board of Directors has the authority to form an Advisory Board to assist it with its functions. The members of the Advisory Board should have the necessary experience and competence to assist the Board of Directors in developing strategic objectives to ensure the Company’s continuity and growth. The Board of Directors is tasked with establishing the bylaws for the Advisory Board which must then be submitted to the Ordinary General Assembly for approval.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Board of Directors has the authority to form additional committees as it deems necessary to assist it with its functions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"alignleft size-full wp-image-8047\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_737881615-Converted-01.jpg\" alt=\"\" width=\"3967\" height=\"1751\" /></strong></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Sale of Shares</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Any shareholder who intends to sell all or part of his or her shares in the Company will be required to notify all of the shareholders in writing through the Board of Directors. Each shareholder may exercise their priority right to purchase the shares put up for sale within 30 days from the date of notification. In the event 30 days elapse and no shareholder exercises his or her right to purchase the shares, the shareholder may proceed to sell the shares to a third party. It should be noted that this procedure will not be applicable to any transfer of shares by legal inheritance.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Company Policy</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">A human resources policy should be developed for the Company that contains clear rules for employing a family member, which will address issues such as qualifications, experience, performance, evaluation and termination.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is not permissible to create a position for the specific purpose of appointing a family member. Additionally, it is not permissible to terminate, without a valid justification, an employee who is not a family member in order to replace him or her with a family member instead.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The salary of an employee, whether or not a member of the family, should be commensurate with the employee’s position, responsibilities, academic qualifications and level of performance.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The work of a family member employed in the Company should not be subject to the supervision of another family member. In addition, no more than 1 member of the family should work in the same department unless it is in the best interests of the Company.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Additional Provisions</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">A family member is entitled to submit a proposal to amend the Charter. The Family Board will assess the proposal to amend the Charter and prepare a report on its findings which will be presented to the Ordinary General Assembly for its consideration and approval.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The articles of association of the Company should be amended in order to be commensurate with the provisions of the Charter.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Charter should be reviewed by shareholders on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is advisable for the Charter to include the names and signatures of each shareholder of the Company on the final page.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\nIn conclusion, even though the Charter is merely a guide and is not mandatory for FOBs operating in Saudi Arabia, its issuance is nevertheless a positive development as it will raise a general awareness amongst FOBs of the importance of implementing proper governance frameworks and point the way to international best practice and standards and allow them to increase their contribution to the local economy. It may also provide a roadmap for the enactment of future legislation that will be binding on FOBs.\r\n\r\n&nbsp;'),
	(272366,26264,'ClientIP','86.98.5.18'),
	(272367,26264,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272368,26264,'CurrentUserID','8'),
	(272369,26264,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272370,26265,'PostID','7960'),
	(272371,26265,'PostType','law_update_articles'),
	(272372,26265,'PostTitle','Guiding Charter for Family Owned Businesses in Saudi Arabia'),
	(272373,26265,'PostStatus','publish'),
	(272374,26265,'PostDate','2018-08-01 07:32:04'),
	(272375,26265,'PostUrl','http://localhost:8888/tamimi/law-update-articles/guiding-charter-for-family-owned-businesses-in-saudi-arabia/'),
	(272376,26265,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7960&amp;action=edit'),
	(272377,26265,'ClientIP','86.98.5.18'),
	(272378,26265,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272379,26265,'CurrentUserID','8'),
	(272380,26265,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272381,26266,'PostID','7960'),
	(272382,26266,'PostType','law_update_articles'),
	(272383,26266,'PostTitle','Guiding Charter for Family Owned Businesses in Saudi Arabia'),
	(272384,26266,'PostStatus','publish'),
	(272385,26266,'PostDate','2018-08-01 07:32:04'),
	(272386,26266,'PostUrl','http://localhost:8888/tamimi/law-update-articles/guiding-charter-for-family-owned-businesses-in-saudi-arabia/'),
	(272387,26266,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7960&amp;action=edit'),
	(272388,26266,'ClientIP','86.98.5.18'),
	(272389,26266,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272390,26266,'CurrentUserID','8'),
	(272391,26266,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272498,26277,'MetaLink','content'),
	(272499,26277,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272500,26277,'ReportText','<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" />In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n<em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em>|<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em>'),
	(272501,26277,'ClientIP','86.98.5.18'),
	(272502,26277,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272503,26277,'CurrentUserID','8'),
	(272504,26277,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272505,26278,'PostID','7961'),
	(272506,26278,'PostType','law_update_articles'),
	(272507,26278,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272508,26278,'PostStatus','publish'),
	(272509,26278,'PostDate','2018-08-01 07:31:23'),
	(272510,26278,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272511,26278,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272512,26278,'ClientIP','86.98.5.18'),
	(272513,26278,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272514,26278,'CurrentUserID','8'),
	(272515,26278,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272516,26279,'PostID','7961'),
	(272517,26279,'PostType','law_update_articles'),
	(272518,26279,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272519,26279,'PostStatus','publish'),
	(272520,26279,'PostDate','2018-08-01 07:31:23'),
	(272521,26279,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272522,26279,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272523,26279,'ClientIP','86.98.5.18'),
	(272524,26279,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272525,26279,'CurrentUserID','8'),
	(272526,26279,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272527,26280,'PostID','7961'),
	(272528,26280,'PostType','law_update_articles'),
	(272529,26280,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272530,26280,'PostStatus','publish'),
	(272531,26280,'PostDate','2018-08-01 07:31:23'),
	(272532,26280,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272533,26280,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272534,26280,'ClientIP','86.98.5.18'),
	(272535,26280,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272536,26280,'CurrentUserID','8'),
	(272537,26280,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272538,26281,'PostID','7961'),
	(272539,26281,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272540,26281,'PostStatus','publish'),
	(272541,26281,'PostType','law_update_articles'),
	(272542,26281,'PostDate','2018-08-01 07:31:23'),
	(272543,26281,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272544,26281,'MetaID','224274'),
	(272545,26281,'MetaKey','content'),
	(272546,26281,'MetaValueNew','<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em>'),
	(272547,26281,'MetaValueOld','<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em>'),
	(272548,26281,'MetaLink','content'),
	(272549,26281,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272550,26281,'ReportText','<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em>|<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em>'),
	(272551,26281,'ClientIP','86.98.5.18'),
	(272552,26281,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272553,26281,'CurrentUserID','8'),
	(272554,26281,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272555,26282,'PostID','7961'),
	(272556,26282,'PostType','law_update_articles'),
	(272557,26282,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272558,26282,'PostStatus','publish'),
	(272559,26282,'PostDate','2018-08-01 07:31:23'),
	(272560,26282,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272561,26282,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272562,26282,'ClientIP','86.98.5.18'),
	(272563,26282,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272564,26282,'CurrentUserID','8'),
	(272565,26282,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272566,26283,'PostID','7961'),
	(272567,26283,'PostType','law_update_articles'),
	(272568,26283,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272569,26283,'PostStatus','publish'),
	(272570,26283,'PostDate','2018-08-01 07:31:23'),
	(272571,26283,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272572,26283,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272573,26283,'ClientIP','86.98.5.18'),
	(272574,26283,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272575,26283,'CurrentUserID','8'),
	(272576,26283,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272577,26284,'AttachmentID','8109'),
	(272578,26284,'FileName','shutterstock_159902675.jpg'),
	(272579,26284,'FilePath','/home/tamimnew/public_html/wp-content/uploads/2018/08'),
	(272580,26284,'ClientIP','86.98.5.18'),
	(272581,26284,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272582,26284,'CurrentUserID','8'),
	(272583,26284,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272584,26285,'PostID','7961'),
	(272585,26285,'PostType','law_update_articles'),
	(272586,26285,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272587,26285,'PostStatus','publish'),
	(272588,26285,'PostDate','2018-08-01 07:31:23'),
	(272589,26285,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272590,26285,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272591,26285,'ClientIP','86.98.5.18'),
	(272592,26285,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272593,26285,'CurrentUserID','8'),
	(272594,26285,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272595,26286,'PostID','7961'),
	(272596,26286,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272597,26286,'PostStatus','publish'),
	(272598,26286,'PostType','law_update_articles'),
	(272599,26286,'PostDate','2018-08-01 07:31:23'),
	(272600,26286,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272601,26286,'MetaID','224274'),
	(272602,26286,'MetaKey','content'),
	(272603,26286,'MetaValueNew','<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"alignleft  wp-image-8109\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/08/shutterstock_159902675.jpg\" alt=\"\" width=\"786\" height=\"524\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>'),
	(272604,26286,'MetaValueOld','<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em>'),
	(272605,26286,'MetaLink','content'),
	(272606,26286,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272607,26286,'ReportText','<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em>|<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"alignleft  wp-image-8109\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/08/shutterstock_159902675.jpg\" alt=\"\" width=\"786\" height=\"524\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>'),
	(272608,26286,'ClientIP','86.98.5.18'),
	(272609,26286,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272610,26286,'CurrentUserID','8'),
	(272611,26286,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272612,26287,'PostID','7961'),
	(272613,26287,'PostType','law_update_articles'),
	(272614,26287,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272615,26287,'PostStatus','publish'),
	(272616,26287,'PostDate','2018-08-01 07:31:23'),
	(272617,26287,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272618,26287,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272619,26287,'ClientIP','86.98.5.18'),
	(272620,26287,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272621,26287,'CurrentUserID','8'),
	(272622,26287,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272623,26288,'PostID','7961'),
	(272624,26288,'PostType','law_update_articles'),
	(272625,26288,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272626,26288,'PostStatus','publish'),
	(272627,26288,'PostDate','2018-08-01 07:31:23'),
	(272628,26288,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272629,26288,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272630,26288,'ClientIP','86.98.5.18'),
	(272631,26288,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272632,26288,'CurrentUserID','8'),
	(272633,26288,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272634,26289,'PostID','7961'),
	(272635,26289,'PostType','law_update_articles'),
	(272636,26289,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272637,26289,'PostStatus','publish'),
	(272638,26289,'PostDate','2018-08-01 07:31:23'),
	(272639,26289,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272640,26289,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272641,26289,'ClientIP','86.98.5.18'),
	(272642,26289,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272643,26289,'CurrentUserID','8'),
	(272644,26289,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272645,26290,'PostID','7961'),
	(272646,26290,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272647,26290,'PostStatus','publish'),
	(272648,26290,'PostType','law_update_articles'),
	(272649,26290,'PostDate','2018-08-01 07:31:23'),
	(272650,26290,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272651,26290,'MetaID','224274'),
	(272652,26290,'MetaKey','content'),
	(272653,26290,'MetaValueNew','<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"alignleft wp-image-8109\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/08/shutterstock_159902675.jpg\" alt=\"\" width=\"494\" height=\"329\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>'),
	(272654,26290,'MetaValueOld','<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"alignleft  wp-image-8109\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/08/shutterstock_159902675.jpg\" alt=\"\" width=\"786\" height=\"524\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>'),
	(272655,26290,'MetaLink','content'),
	(272656,26290,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272657,26290,'ReportText','<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"alignleft  wp-image-8109\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/08/shutterstock_159902675.jpg\" alt=\"\" width=\"786\" height=\"524\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>|<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"alignleft wp-image-8109\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/08/shutterstock_159902675.jpg\" alt=\"\" width=\"494\" height=\"329\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>');

INSERT INTO `tm_wsal_metadata` (`id`, `occurrence_id`, `name`, `value`)
VALUES
	(272658,26290,'ClientIP','86.98.5.18'),
	(272659,26290,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272660,26290,'CurrentUserID','8'),
	(272661,26290,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272662,26291,'PostID','7961'),
	(272663,26291,'PostType','law_update_articles'),
	(272664,26291,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272665,26291,'PostStatus','publish'),
	(272666,26291,'PostDate','2018-08-01 07:31:23'),
	(272667,26291,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272668,26291,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272669,26291,'ClientIP','86.98.5.18'),
	(272670,26291,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272671,26291,'CurrentUserID','8'),
	(272672,26291,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272673,26292,'PluginFile','/home/tamimnew/public_html/wp-content/plugins/advanced-custom-fields-pro/acf.php'),
	(272674,26292,'PluginData','O:8:\"stdClass\":5:{s:4:\"Name\";s:26:\"Advanced Custom Fields PRO\";s:9:\"PluginURI\";s:37:\"https://www.advancedcustomfields.com/\";s:7:\"Version\";s:5:\"5.7.1\";s:6:\"Author\";s:13:\"Elliot Condon\";s:7:\"Network\";s:5:\"False\";}'),
	(272675,26292,'ClientIP','86.98.5.18'),
	(272676,26292,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272677,26292,'CurrentUserID','1'),
	(272678,26292,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272679,26293,'PostID','7961'),
	(272680,26293,'PostType','law_update_articles'),
	(272681,26293,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272682,26293,'PostStatus','publish'),
	(272683,26293,'PostDate','2018-08-01 07:31:23'),
	(272684,26293,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272685,26293,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272686,26293,'ClientIP','86.98.5.18'),
	(272687,26293,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272688,26293,'CurrentUserID','8'),
	(272689,26293,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272690,26294,'PostID','7961'),
	(272691,26294,'PostType','law_update_articles'),
	(272692,26294,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272693,26294,'PostStatus','publish'),
	(272694,26294,'PostDate','2018-08-01 07:31:23'),
	(272695,26294,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272696,26294,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272697,26294,'ClientIP','86.98.5.18'),
	(272698,26294,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272699,26294,'CurrentUserID','8'),
	(272700,26294,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272701,26295,'PostID','7109'),
	(272702,26295,'PostType','lawyer'),
	(272703,26295,'PostTitle','Xavier Solanes'),
	(272704,26295,'PostStatus','publish'),
	(272705,26295,'PostDate','2018-02-11 15:36:24'),
	(272706,26295,'PostUrl','http://localhost:8888/tamimi/lawyer/xavier-solanes/'),
	(272707,26295,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7109&amp;action=edit'),
	(272708,26295,'ClientIP','83.111.236.141'),
	(272709,26295,'UserAgent','Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
	(272710,26295,'CurrentUserID','5'),
	(272711,26295,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272712,26296,'AttachmentID','8110'),
	(272713,26296,'FileName','shutterstock_287395955.jpg'),
	(272714,26296,'FilePath','/home/tamimnew/public_html/wp-content/uploads/2018/08'),
	(272715,26296,'ClientIP','86.98.5.18'),
	(272716,26296,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272717,26296,'CurrentUserID','8'),
	(272718,26296,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272719,26297,'PostID','7961'),
	(272720,26297,'PostType','law_update_articles'),
	(272721,26297,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272722,26297,'PostStatus','publish'),
	(272723,26297,'PostDate','2018-08-01 07:31:23'),
	(272724,26297,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272725,26297,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272726,26297,'ClientIP','86.98.5.18'),
	(272727,26297,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272728,26297,'CurrentUserID','8'),
	(272729,26297,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272730,26298,'PostID','7961'),
	(272731,26298,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272732,26298,'PostStatus','publish'),
	(272733,26298,'PostType','law_update_articles'),
	(272734,26298,'PostDate','2018-08-01 07:31:23'),
	(272735,26298,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272736,26298,'MetaID','224274'),
	(272737,26298,'MetaKey','content'),
	(272738,26298,'MetaValueNew','<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"wp-image-8110 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/08/shutterstock_287395955-1024x683.jpg\" alt=\"\" width=\"485\" height=\"324\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>'),
	(272739,26298,'MetaValueOld','<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"alignleft wp-image-8109\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/08/shutterstock_159902675.jpg\" alt=\"\" width=\"494\" height=\"329\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>'),
	(272740,26298,'MetaLink','content'),
	(272741,26298,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272742,26298,'ReportText','<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"alignleft wp-image-8109\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/08/shutterstock_159902675.jpg\" alt=\"\" width=\"494\" height=\"329\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>|<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"wp-image-8110 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/08/shutterstock_287395955-1024x683.jpg\" alt=\"\" width=\"485\" height=\"324\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>'),
	(272743,26298,'ClientIP','86.98.5.18'),
	(272744,26298,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272745,26298,'CurrentUserID','8'),
	(272746,26298,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272747,26299,'PostID','7961'),
	(272748,26299,'PostType','law_update_articles'),
	(272749,26299,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272750,26299,'PostStatus','publish'),
	(272751,26299,'PostDate','2018-08-01 07:31:23'),
	(272752,26299,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272753,26299,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272754,26299,'ClientIP','86.98.5.18'),
	(272755,26299,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272756,26299,'CurrentUserID','8'),
	(272757,26299,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272758,26300,'PostID','7109'),
	(272759,26300,'PostType','lawyer'),
	(272760,26300,'PostTitle','Xavier Solanes'),
	(272761,26300,'PostStatus','publish'),
	(272762,26300,'PostDate','2018-02-11 15:36:24'),
	(272763,26300,'PostUrl','http://localhost:8888/tamimi/lawyer/xavier-solanes/'),
	(272764,26300,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7109&amp;action=edit'),
	(272765,26300,'ClientIP','83.111.236.141'),
	(272766,26300,'UserAgent','Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
	(272767,26300,'CurrentUserID','5'),
	(272768,26300,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272769,26301,'PostID','7109'),
	(272770,26301,'PostTitle','Xavier Solanes'),
	(272771,26301,'PostStatus','publish'),
	(272772,26301,'PostType','lawyer'),
	(272773,26301,'PostDate','2018-02-11 15:36:24'),
	(272774,26301,'PostUrl','http://localhost:8888/tamimi/lawyer/xavier-solanes/'),
	(272775,26301,'MetaID','194426'),
	(272776,26301,'MetaKey','biography'),
	(272777,26301,'MetaValueNew','Xavier is a lawyer qualified in Spain, with over 5 years of international tax experience. Prior to joining Al Tamimi in 2017, he worked for more than four years at leading Spanish firm Cuatrecasas.\r\n\r\nXavier has advised a wide-range of clients including financial institutions, large multinationals, family offices and local companies in Spain.\r\n\r\nXavier specialises in advising on international tax structuring and tax aspects of cross border M&amp;A and investments, real estate transactions, as well as providing ongoing advice on Corporate Income Tax and VAT consolidated groups.\r\n\r\nHe has in-depth knowledge and expertise across all taxes including corporate and personal income tax, VAT, withholding taxes and double taxation treaties, in a wide range of industry sectors.'),
	(272778,26301,'MetaValueOld','Xavier is a lawyer qualified in Spain, with over 5 years of international tax experience. Prior to joining Al Tamimi, he worked for more than four years at leading Spanish firm Cuatrecasas.\r\n\r\nXavier has advised a wide-range of clients including financial institutions, large multinationals, family offices and local companies in Spain.\r\n\r\nXavier specialises in advising on international tax structuring and tax aspects of cross border M&amp;A and investments, real estate transactions, as well as providing ongoing advice on Corporate Income Tax and VAT consolidated groups.\r\n\r\nHe has in-depth knowledge and expertise across all taxes including corporate and personal income tax, VAT, withholding taxes and double taxation treaties, in a wide range of industry sectors.'),
	(272779,26301,'MetaLink','biography'),
	(272780,26301,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7109&amp;action=edit'),
	(272781,26301,'ReportText','Xavier is a lawyer qualified in Spain, with over 5 years of international tax experience. Prior to joining Al Tamimi, he worked for more than four years at leading Spanish firm Cuatrecasas.\r\n\r\nXavier has advised a wide-range of clients including financial institutions, large multinationals, family offices and local companies in Spain.\r\n\r\nXavier specialises in advising on international tax structuring and tax aspects of cross border M&amp;A and investments, real estate transactions, as well as providing ongoing advice on Corporate Income Tax and VAT consolidated groups.\r\n\r\nHe has in-depth knowledge and expertise across all taxes including corporate and personal income tax, VAT, withholding taxes and double taxation treaties, in a wide range of industry sectors.|Xavier is a lawyer qualified in Spain, with over 5 years of international tax experience. Prior to joining Al Tamimi in 2017, he worked for more than four years at leading Spanish firm Cuatrecasas.\r\n\r\nXavier has advised a wide-range of clients including financial institutions, large multinationals, family offices and local companies in Spain.\r\n\r\nXavier specialises in advising on international tax structuring and tax aspects of cross border M&amp;A and investments, real estate transactions, as well as providing ongoing advice on Corporate Income Tax and VAT consolidated groups.\r\n\r\nHe has in-depth knowledge and expertise across all taxes including corporate and personal income tax, VAT, withholding taxes and double taxation treaties, in a wide range of industry sectors.'),
	(272782,26301,'ClientIP','83.111.236.141'),
	(272783,26301,'UserAgent','Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
	(272784,26301,'CurrentUserID','5'),
	(272785,26301,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272786,26302,'PostID','7109'),
	(272787,26302,'PostTitle','Xavier Solanes'),
	(272788,26302,'PostStatus','publish'),
	(272789,26302,'PostType','lawyer'),
	(272790,26302,'PostDate','2018-02-11 15:36:24'),
	(272791,26302,'PostUrl','http://localhost:8888/tamimi/lawyer/xavier-solanes/'),
	(272792,26302,'MetaID','194428'),
	(272793,26302,'MetaKey','recent_dealsexperience'),
	(272794,26302,'MetaValueNew','<ul>\r\n 	<li>Implementing and advising on VAT implications for GCC and foreign clients across the region.</li>\r\n 	<li>Advising on income tax and on withholding tax implications across the region for local and foreign clients.</li>\r\n 	<li>Advising on VAT implications for financial institutions across the GCC.</li>\r\n 	<li>Carrying on tax due diligences in the UAE and in KSA, advising on structuring and M&amp;A transactions and support documentation.</li>\r\n 	<li>Advising on custom duties in the UAE and Saudi Arabia.</li>\r\n 	<li>Providing tax advice to banks based in the GCC in connection with the issue of shares and sukuk.</li>\r\n 	<li>Drafting requests for clarification to the UAE Federal Tax Authority.</li>\r\n 	<li>Assisting clients against tax authorities’ decisions and drafting appeals and applications for reconsideration.</li>\r\n</ul>'),
	(272795,26302,'MetaValueOld','<ul>\r\n 	<li>Implementing and advising VAT for GCC and foreign clients across the region.</li>\r\n 	<li>VAT advice to a transportation multinational group based in the Middle East in connection with their international operations.</li>\r\n 	<li>Corporate Income Tax advice on construction projects in Saudi Arabia and Kuwait.</li>\r\n 	<li>Providing advice on VAT implications for financial institutions across the GCC.</li>\r\n 	<li>Tax and VAT due diligence, structuring and sale purchase agreement documentation.</li>\r\n 	<li>Advising on custom duties in the UAE and Saudi Arabia.</li>\r\n 	<li>Providing legal assistance with Corporate and Sales Tax audit in Jordan.</li>\r\n</ul>'),
	(272796,26302,'MetaLink','recent_dealsexperience'),
	(272797,26302,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7109&amp;action=edit'),
	(272798,26302,'ReportText','<ul>\r\n 	<li>Implementing and advising VAT for GCC and foreign clients across the region.</li>\r\n 	<li>VAT advice to a transportation multinational group based in the Middle East in connection with their international operations.</li>\r\n 	<li>Corporate Income Tax advice on construction projects in Saudi Arabia and Kuwait.</li>\r\n 	<li>Providing advice on VAT implications for financial institutions across the GCC.</li>\r\n 	<li>Tax and VAT due diligence, structuring and sale purchase agreement documentation.</li>\r\n 	<li>Advising on custom duties in the UAE and Saudi Arabia.</li>\r\n 	<li>Providing legal assistance with Corporate and Sales Tax audit in Jordan.</li>\r\n</ul>|<ul>\r\n 	<li>Implementing and advising on VAT implications for GCC and foreign clients across the region.</li>\r\n 	<li>Advising on income tax and on withholding tax implications across the region for local and foreign clients.</li>\r\n 	<li>Advising on VAT implications for financial institutions across the GCC.</li>\r\n 	<li>Carrying on tax due diligences in the UAE and in KSA, advising on structuring and M&amp;A transactions and support documentation.</li>\r\n 	<li>Advising on custom duties in the UAE and Saudi Arabia.</li>\r\n 	<li>Providing tax advice to banks based in the GCC in connection with the issue of shares and sukuk.</li>\r\n 	<li>Drafting requests for clarification to the UAE Federal Tax Authority.</li>\r\n 	<li>Assisting clients against tax authorities’ decisions and drafting appeals and applications for reconsideration.</li>\r\n</ul>'),
	(272799,26302,'ClientIP','83.111.236.141'),
	(272800,26302,'UserAgent','Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
	(272801,26302,'CurrentUserID','5'),
	(272802,26302,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272803,26303,'PostID','7961'),
	(272804,26303,'PostType','law_update_articles'),
	(272805,26303,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272806,26303,'PostStatus','publish'),
	(272807,26303,'PostDate','2018-08-01 07:31:23'),
	(272808,26303,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272809,26303,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272810,26303,'ClientIP','86.98.5.18'),
	(272811,26303,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272812,26303,'CurrentUserID','8'),
	(272813,26303,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272814,26304,'PostID','7109'),
	(272815,26304,'PostType','lawyer'),
	(272816,26304,'PostTitle','Xavier Solanes'),
	(272817,26304,'PostStatus','publish'),
	(272818,26304,'PostDate','2018-02-11 15:36:24'),
	(272819,26304,'PostUrl','http://localhost:8888/tamimi/lawyer/xavier-solanes/'),
	(272820,26304,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7109&amp;action=edit'),
	(272821,26304,'ClientIP','83.111.236.141'),
	(272822,26304,'UserAgent','Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
	(272823,26304,'CurrentUserID','5'),
	(272824,26304,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272825,26305,'PostID','7961'),
	(272826,26305,'PostType','law_update_articles'),
	(272827,26305,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272828,26305,'PostStatus','publish'),
	(272829,26305,'PostDate','2018-08-01 07:31:23'),
	(272830,26305,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272831,26305,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272832,26305,'ClientIP','86.98.5.18'),
	(272833,26305,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272834,26305,'CurrentUserID','8'),
	(272835,26305,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272836,26306,'PostID','7961'),
	(272837,26306,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272838,26306,'PostStatus','publish'),
	(272839,26306,'PostType','law_update_articles'),
	(272840,26306,'PostDate','2018-08-01 07:31:23'),
	(272841,26306,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272842,26306,'MetaID','224274'),
	(272843,26306,'MetaKey','content'),
	(272844,26306,'MetaValueNew','<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"wp-image-8110 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/08/shutterstock_287395955-1024x683.jpg\" alt=\"\" width=\"508\" height=\"338\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>'),
	(272845,26306,'MetaValueOld','<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"wp-image-8110 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/08/shutterstock_287395955-1024x683.jpg\" alt=\"\" width=\"485\" height=\"324\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>'),
	(272846,26306,'MetaLink','content'),
	(272847,26306,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272848,26306,'ReportText','<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"wp-image-8110 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/08/shutterstock_287395955-1024x683.jpg\" alt=\"\" width=\"485\" height=\"324\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>|<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"wp-image-8110 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/08/shutterstock_287395955-1024x683.jpg\" alt=\"\" width=\"508\" height=\"338\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>'),
	(272849,26306,'ClientIP','86.98.5.18'),
	(272850,26306,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272851,26306,'CurrentUserID','8'),
	(272852,26306,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272853,26307,'PostID','7961'),
	(272854,26307,'PostType','law_update_articles'),
	(272855,26307,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272856,26307,'PostStatus','publish'),
	(272857,26307,'PostDate','2018-08-01 07:31:23'),
	(272858,26307,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272859,26307,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272860,26307,'ClientIP','86.98.5.18'),
	(272861,26307,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272862,26307,'CurrentUserID','8'),
	(272863,26307,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272864,26308,'PostID','7961'),
	(272865,26308,'PostType','law_update_articles'),
	(272866,26308,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272867,26308,'PostStatus','publish'),
	(272868,26308,'PostDate','2018-08-01 07:31:23'),
	(272869,26308,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272870,26308,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272871,26308,'ClientIP','86.98.5.18'),
	(272872,26308,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272873,26308,'CurrentUserID','8'),
	(272874,26308,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272875,26309,'PostID','7961'),
	(272876,26309,'PostType','law_update_articles'),
	(272877,26309,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272878,26309,'PostStatus','publish'),
	(272879,26309,'PostDate','2018-08-01 07:31:23'),
	(272880,26309,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272881,26309,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272882,26309,'ClientIP','86.98.5.18'),
	(272883,26309,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
	(272884,26309,'CurrentUserID','8'),
	(272885,26309,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(272886,26310,'PostID','7961'),
	(272887,26310,'PostTitle','Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
	(272888,26310,'PostStatus','publish'),
	(272889,26310,'PostType','law_update_articles'),
	(272890,26310,'PostDate','2018-08-01 07:31:23'),
	(272891,26310,'PostUrl','http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
	(272892,26310,'MetaID','224274'),
	(272893,26310,'MetaKey','content'),
	(272894,26310,'MetaValueNew','<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"wp-image-8110 alignright\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/08/shutterstock_287395955-1024x683.jpg\" alt=\"\" width=\"508\" height=\"338\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>'),
	(272895,26310,'MetaValueOld','<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"wp-image-8110 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/08/shutterstock_287395955-1024x683.jpg\" alt=\"\" width=\"508\" height=\"338\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>'),
	(272896,26310,'MetaLink','content'),
	(272897,26310,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=7961&amp;action=edit'),
	(272898,26310,'ReportText','<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"wp-image-8110 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/08/shutterstock_287395955-1024x683.jpg\" alt=\"\" width=\"508\" height=\"338\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>|<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"wp-image-8110 alignright\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/08/shutterstock_287395955-1024x683.jpg\" alt=\"\" width=\"508\" height=\"338\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>'),
