-
Define, Implement, enforce, follow up and Measure the Information Security Policies in the group to protect the Company data and the end-user and stakeholder’s data.
-
Identifying the Group Business Environment and the Group place in the sector and build the required plan to ensure the confidentiality, integrity and availability for the group Data.
-
Identifying legal and regulatory requirements regarding the cybersecurity capabilities of the organization and ensure the compatibility with these requirements.
-
Identifying Asset/Application vulnerabilities, threats to internal and external organizational resources, and follow to close these vulnerabilities and gaps.
-
Coordinate with the Risk Committee to Identifying and Evaluating Cyber Security Risk and Propose the proper controls in the Risk Reduction plan.
-
Implementing an enterprise-wide security Awareness and Training program.
-
Establishing Data Security protection to ensure the confidentiality, integrity, and availability for the Group data and assets.
-
Implementing Information Protection Processes and Procedures to maintain and manage the protections of information systems and assets.
-
Managing Protective Technology to ensure the security and resilience of systems and assets are consistent with The Group policies and procedures.
-
Ensuring Anomalies and Events are detected, and their potential impact is understood.
-
Implementing Security Continuous Monitoring capabilities to monitor cybersecurity events and verify the effectiveness of protective measures including network and physical activities.
-
Maintaining Detection Processes to provide awareness of anomalous events.
-
Establishing the Information Security Incident and Response Plan as part of the Group Business Continuity Plan
-
Ensuring Response Planning process are executed during and after an incident.
-
Managing Communications during and after an event with stakeholders, law enforcement, external stakeholders as appropriate
-
Analysis is conducted to ensure effective response and support recovery activities including forensic analysis and determining the impact of incidents.
-
Mitigation activities are performed to prevent expansion of an event and to resolve the incident.
-
Continuous Improvements by incorporating lessons learned from current and previous detection / response activities.
-
Working with Business Continuity to Ensure the group implements Recovery Planning processes and procedures to restore systems and/or assets affected by cybersecurity incidents.
-
Implementing Improvements based on lessons learned and reviews of existing strategies.