1. DEFINITIONS
CATRION: CATRION Catering Holding Company and/or any CATRION's subsidiaries.
Cybersecurity: The protection of networks, IT systems, operational technologies systems and their components of hardware and software, their services, and the data they contain, from any penetration, disruption, modification, access, use or unauthorized exploitation. The concept Cybersecurity also includes information security and digital security.
NCA: The National Cybersecurity Authority in Saudi Arabia.
SDAIA: Saudi Data and Artificial Intelligence Authority (SDAIA).
PDPL: Saudi Personal Data Protection Law (PDPL).
External Party/Parties: Any External or Third-Party entities that have a current contractual relationship with CATRION, or that is being considered for contractual relations.
Endpoint devices: Endpoint devices are any devices that connect to a network and serve as points of entry or exit for CATRION data. This includes computers, servers, smartphones, tablets, printers, and any other devices that communicate with the network. Endpoint devices may be supplied by CATRION or utilized by vendors and their subcontractors.
Critical Systems: Information systems, applications, databases, platforms, cloud services, operational technology systems, or other technology assets designated by CATRION as critical to business operations, regulatory compliance, safety, security, or service delivery.
Confidential Information: Any non-public information disclosed by or on behalf of CATRION, regardless of format, that is designated as confidential or would reasonably be understood to be confidential due to its nature or circumstances of disclosure. The term "Confidential Information" as used in this policy includes, but is not limited to:
- trade secrets.
- technical materials, data, and information.
- product information and roadmaps.
- bid data and transaction information.
- CATRION staff personal information and details.
- customer lists.
- compilations of information, financial information, or specifications that are used in the operation of CATRION's business or that may eventually be used in the operation of CATRION's business; and
- other information relating to the CATRION's business that is not public knowledge.
Personal Data: Any information relating to an identified or identifiable natural person, directly or indirectly, as defined by the Saudi Personal Data Protection Law (PDPL).
Sensitive Personal Data: Personal data that includes genetic, biometric, health, financial, credit, security, location, or other categories classified as sensitive under applicable laws and regulations.
Data Processing: Any operation performed on personal data, whether automated or manual, including collection, recording, storage, use, modification, sharing, transfer, disclosure, deletion, or destruction.
Information Assets: Information, data, applications, systems, services, hardware, software, and supporting infrastructure that create, process, store, or transmit information for CATRION.
Cloud Services: Any service delivered through cloud computing models, including Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS), or other cloud-based offerings.
Artificial Intelligence (AI): A machine-based system that can, for a given set of objectives, generate predictions, recommendations, decisions, or content that influence real or virtual environments.
Artificial Intelligence Service Provider: Any External Party that develops, provides, hosts, supports, manages, or operates AI technologies, AI models, AI-enabled applications, or AI-related services for or on behalf of CATRION.
Operational Technology (OT): Hardware and software that monitor, control, automate, or operate physical devices, industrial processes, facilities, or critical infrastructure.
Smart Devices / Internet of Things (IoT): Physical devices equipped with sensors, software, network connectivity, or embedded technology that collect, process, or exchange data over a network.
Multi-Factor Authentication (MFA): An authentication method requiring two or more independent factors to verify a user's identity before granting access to systems or information.
Security Incident: An event that compromises, or has the potential to compromise, the confidentiality, integrity, or availability of information, systems, services, or data.
Vulnerability: A weakness in a system, application, process, or control that could be exploited by a threat to compromise security.
Subcontractor: Any External Party engaged by an External Party to perform services, process data, access systems, or otherwise fulfill obligations related to services provided to CATRION.
2. General Cybersecurity Requirements
The compliance with the following requirements is mandatory for all External Parties engaging with CATRION, including but not limited to service providers, suppliers, resellers, contractors, and any affiliated External Party entities:
2.1 Compliance with this Cybersecurity External Party Policy is mandatory for all External Parties engaged with CATRION, based on vendor classification/type as defined in this policy.
2.2 The External Party shall comply with all applicable cybersecurity and data protection regulations relevant to the services provided to CATRION. Applicable requirements shall be defined and agreed within the contract or scope of work.
2.3 The External Party shall notify CATRION of cybersecurity incidents via Cybersecurity@catrion.com and of data breach incidents via Data.Management@catrion.com without undue delay and, where feasible, within 24 hours of confirmation. A detailed report shall be provided within an agreed timeframe, not exceeding 72 hours, unless otherwise justified.
2.4 If an incident affects the External Party, CATRION's Cybersecurity Team will notify the External Party within twenty‑four (24) hours, where feasible, and may request their cooperation, including providing any required event logs, to support effective investigation and resolution.
2.5 External Party shall ensure that all its personnel (including employees, contractors, consultants, and any subcontractors) who may access, process, transmit, store, or become aware of CATRION information sign a valid Non‑Disclosure Agreement (NDA) or are bound by equivalent confidentiality obligations before commencing any work or being granted access. External Party shall maintain records of such NDAs and provide evidence to CATRION upon request.
2.6 External Party shall establish and maintain formal personnel off‑boarding procedures to ensure the secure and orderly removal of departing staff. These procedures shall ensure the return of all assets and the immediate revocation of all access rights associated with the External Party's personnel.
2.7 External Party must establish, maintain and communicate an Asset Acceptable Use Policy (AUP) governing the use of The External Party Assets.
2.8 External Party personnel must use email in a responsible, effective, lawful, and secure manner when communicating in relation to CATRION business or when using CATRION resources.
2.9 External Party shall ensure that all users of its information systems complete mandatory annual Cybersecurity awareness and training covering acceptable use, secure computing practices, and foundational Cybersecurity awareness.
2.10 External Party must ensure that personnel requiring access to CATRION complete CATRION-provided Cybersecurity awareness and training.
2.11 External Party must immediately notify CATRION of any personnel changes involving individuals who are using CATRION user credentials, including transfers, role re‑assignments, or termination/cessation of employment, to ensure timely review and revocation/adjustment of access rights as applicable.
2.12 All External Party technology assets and systems must be protected with strong authentication and password controls.
2.13 The External Party shall ensure passwords are not stored or transmitted in clear text and are protected using secure mechanisms such as hashing, encryption, or vaulting solutions. Secure password handling practices must be enforced as part of the External Party's internal policies.
2.14 External Party must enforce multi‑factor authentication (MFA) on all privileged accounts access, remote access to information systems and applications, access from the internet, and on all access to any cloud‑based services utilized by the External Party, including cloud‑based email.
2.15 External Party must establish and maintain approved procedures to grant, modify, and revoke access to all information and technology systems that process, transmit, or store CATRION's information in line with NCA Cybersecurity requirements and objectives.
2.16 External Party must promptly revoke access and notify CATRION when any personnel with CATRION‑issued credentials no longer require access, including in cases of transfer, reassignment, resignation, retirement, or termination.
2.17 External Party shall use only their official corporate email domain for all communications with CATRION and shall ensure that their personnel do not use generic, personal, or public email accounts for any CATRION-related activities.
2.18 External Party must inspect all incoming emails originating from the Internet using anti-spam protection.
2.19 External Party must implement strong access control mechanisms (role-based access, multifactor authentication ...etc.) and ensure secured and controlled remote access.
2.20 External Party must enforce removable media Security Controls (e.g., USB ports physically secured/disabled where applicable) to reduce unauthorized data extraction risk.
3. Technical Cybersecurity Requirements
The compliance with the following requirements is mandatory for all External Parties providing technical solutions or services to CATRION, including those supplying, integrating (including API Integration), or supporting any technical components, systems, software, or technologies or providing maintenance services for such technologies:
3.1 The External Party must ensure that the Solution and all related services comply with the National Cybersecurity Authority (NCA) Controls and any other relevant frameworks where applicable. Including but not limited to:
3.1.1 Essential Cybersecurity Controls (ECC).
3.1.2 Data Cybersecurity Controls (DCC).
3.1.3 Cloud Cybersecurity Controls (CCC).
3.1.4 Telework Cybersecurity Controls (TCC).
3.1.5 Organizations' Social Media Accounts Cybersecurity Controls (OSMACC).
3.1.6 Operational Technology Cybersecurity Controls (OTCC).
3.1.7 Non-CNI Private Sector Entities Cybersecurity Controls (NCNICC).
3.2 Any additional NCA-issued controls, standards, or framework requirements expressly identified by CATRION in writing as applicable to the Solution.
3.3 If the External Party operates outside the Kingdom of Saudi Arabia, it shall demonstrate adherence to recognized international Cybersecurity standards such as ISO/IEC 27001, SOC 2 Type II, or the NIST Cybersecurity Framework.
3.4 CATRION reserves the right to conduct audits subject to reasonable notice, agreed scope, and confidentiality. Certifications (ISO, SOC2) may be accepted where direct audits are not feasible.
3.5 External Party's personnel must be fully cooperative with CATRION's Cybersecurity audits, risk assessments, event log review and compliance reviews activities whenever requested by CATRION.
3.6 The External Party is fully responsible for conducting all required security screening and vetting of its own personnel to ensure they are qualified, trustworthy, and authorized to provide services to CATRION. The External Party must also provide CATRION with necessary information about the entity and its personnel when those individuals will have access to CATRION's data.
3.7 External Party must regularly review access's rights to the email, operating system, applications and database on a semiannual basis to determine if accessing personnel still require such access.
3.8 External Party must securely store and retain all audit logs from information systems and applications storing, processing or transmitting CATRION data for one (1) year. Such logs must be made available to CATRION upon request and in compliance with applicable legal and regulatory requirements.
3.9 External Party shall implement and maintain Sender Policy Framework (SPF) on all its mail servers and publish the SPF record in DNS server.
3.10 External Party must enforce Sender Policy Framework (SPF) feature on CATRION email domains: CATRION.com and Saudiacatering.com.
3.11 External Party must restrict Internet access using content‑filtering technologies to block:
3.11.1 Malicious and suspicious websites.
3.11.2 Personal and non‑company email services.
3.11.3 Personal and non‑company‑approved public cloud services.
3.12 External Party must implement reputable and up‑to‑date malware protection (e.g., antivirus/EDR where applicable) with defined updated mechanism, and ensure that all technology assets are protected.
3.13 External Party shall ensure that all technology assets and systems are regularly updated with the latest operating system, software, and application patches.
3.14 External Party must configure and enable firewalls on endpoint devices.
3.15 External Party must encrypt data transmitted to, stored in, or transmitted in transit and at rest, aligned with NCA Cybersecurity Requirements.
3.16 The External Party must plan, develop, test and implement an appropriate Business Continuity and Disaster Recovery (BC/DR) plan to prevent the unavailability of services provided to CATRION, in alignment with CATRION's business continuity and disaster recovery requirements. The applicable Service Level Agreement (SLA) must define data recovery and return time objectives in the event of a complete disaster, based on the classification of CATRION's data.
3.17 External Party must ensure that backup media is secured and encrypted in accordance with NCA requirements to block and/or inhibit any unauthorized physical access.
3.18 External Party must not use or allow Save Cookies and Credential features in web browsers.
3.19 External service providers must have a documented Service Level Agreement (SLA) in place upon agreement process.
3.20 External Party must implement logging and monitoring for relevant infrastructure and service components supporting CATRION (e.g., firewalls, routers, servers, applications, and cloud control-plane activities).
3.21 External Party must limit, justify and review all privileged accounts.
3.22 External Party must log and monitor privileged accounts activity on a regular basis.
3.23 External Party must conduct annual external penetration testing on its IT infrastructure systems and internet‑facing applications. The report must be shared with CATRION upon request, and ensure the remediation and closure of all critical and high‑risk findings.
3.24 External Party must conduct monthly vulnerability scans to evaluate configurations, patches, and services for known vulnerabilities.
3.25 External Party must resolve or mitigate identified security vulnerabilities on systems, computers, networks, or other computing equipment within the following timeframes:
3.25.1 Critical Risk: Immediate correction up to fourteen (14) calendar days of critical vendor patch release, notification from CATRION, or discovery of a security breach, whichever is earlier.
3.25.2 High Risk: Within one (1) month of vendor patch release or discovery of a security breach, whichever is earlier.
3.25.3 Medium and Low Risk: Within three (3) months of discovery.
3.26 External Party must timely apply vendor-recommended security patches and update all assets and components provided or managed.
3.27 External Party must create and manage baseline configurations to harden information systems. The hardening process must address configurations such as:
3.27.1 Resetting default usernames/passwords
3.27.2 Disabling unneeded software
3.27.3 Disabling unneeded services
3.27.4 Removing administrative access of users on workstations.
3.28 External Party shall ensure that remote administrative access to CATRION services, systems, data, or management interfaces is only permitted through secure and controlled mechanisms (e.g., VPN, Zero Trust Network Access) and that direct administrative access over the public Internet is strictly prohibited, unless expressly approved by CATRION and subject to continuous monitoring.
3.29 External Party must have a process for Cybersecurity Risk Management, to identify, assess and remediate Risks to data and information systems on regular basis.
3.30 The External Party shall establish, implement, and maintain a formal change management process in compliance with applicable NCA change management requirements, ensuring that all changes to CATRION's information and technology assets are reviewed and tested prior to implementation in the production environment, and that any major planned or implemented changes, including patch updates, infrastructure changes, relocation to different regions, or the use of subcontractors are communicated in advance to CATRION's relevant stakeholders.
3.31 External Party must implement Intrusion Detection Systems (IDS) and/or Intrusion Prevention Systems (IPS) at the network perimeter.
3.32 External Party must not use, deploy, or attempt to use any tools, techniques, or methods that bypass, disable, evade, or weaken CATRION's security controls or Cybersecurity systems.
3.33 External Party must ensure that all systems (routers, switches, servers, and firewalls) are housed in a secure communication room and placed in locked racks. Access to the communication room must be controlled using security mechanisms such as access card readers or biometric devices.
3.34 External Party must ensure that wireless networks accessing information systems use strong encryption for authentication and transmission, such as WPA2 or WPA2‑Enterprise.
4. General Data Management and Protection Requirements
The compliance with the following requirements is mandatory for External Parties engaged in processing CATRION's data, whether directly or indirectly. For the purpose of this policy, "process"/"processing" shall mean any operation carried out on CATRION's data by any means, whether manual or automated, including but not limited to collecting, recording, saving, indexing, organizing, formatting, storing, modifying, updating, consolidating, retrieving, using, disclosing, transmitting, publishing, sharing, linking, blocking, erasing, and destroying data:
4.1 The External Party shall also comply with all relevant Data Management and data privacy regulations, including Saudi's Personal Data Protection Law (PDPL), General Data Protection Regulation (GDPR), and any other applicable local or international data protection requirements.
4.2 External Party associated with services require processing of Personal Data for CATRION must assign a responsible role/function for data protection whom responsible to provide the assurance of protecting personal data, in line with applicable legal obligations.
4.3 External Party must promptly assist and cooperate with CATRION in fulfilling data subject requests (including access, correction, deletion, restriction, or portability of personal data) and must provide all necessary information and support required to enable CATRION to comply with applicable data protection laws and regulatory requirements.
4.4 External Party must maintain appropriate documentation of its data processing activities and shall, upon request, provide CATRION with sufficient information to support compliance obligations, including contributing to or supporting DPIAs where processing is likely to result in high risk to individuals.
4.5 External Party must establish and maintain policies and procedures to classify information in based of its value, criticality, and confidentiality.
4.6 CATRION's information and data residing on all systems, and processed or stored by the External Party, must be classified according to SDAIA Data Classification Policy and in align with CATRION.
4.7 External Party must process, store, and destruct CATRION's information and data according to Saudi National Cybersecurity Authority (NCA) and National Data Management Office (NDMO)'s requirements for Data and Information Protection.
4.8 The External Party must maintain the confidentiality of CATRION's data and is strictly prohibited from using or disclosing such data without CATRION's prior written consent, as all data remains the sole property of CATRION.
4.9 Data generated from engagements with CATRION and not publicly available must not be used by External Parties to develop new services or for benchmarking without CATRION's prior written approval.
4.10 During and after the engagement, the External Party must ensure that its personnel do not disclose, share, or use any CATRION confidential information or data outside the approved scope of the engagement or with unauthorized individuals. Where any confidential information is required to be shared prior to contract signing, a valid Non‑Disclosure Agreement (NDA) must be signed in advance.
4.11 External Party must maintain the sharing of CATRION data only with authorized individuals and strictly within the approved scope of work.
4.12 External Party must be responsible for managing and mitigating all risks associated with any subcontractors they are engaging with. Ensuring that subcontractors comply with all relevant contractual obligations, policies, and standards applicable to this agreement.
4.13 The External Party is obligated to return data and securely delete it within 14 days upon completion or termination of the service or contractual relationship. Evidence shall be provided upon request.
4.14 External Party must securely delete CATRION's data at the External Party's side, including backups, at the end or termination of the contractual relationship, with the provision of official certificate or evidence confirming such deletion. Data deletion must be performed using secure practices such as NIST 800-88 that ensure the data is non‑recoverable and that all access to the data by the External Party or any other party is permanently revoked.
4.15 Assets used to process or store CATRION data and information must be sanitized at the end of the data lifecycle or upon expiry of the data retention period as defined in the contract, if applicable. This includes all data copies, such as backup copies, created at any External Party site(s). Data sanitization must be performed in accordance with industry best practices (e.g., NIST SP 800‑88). The External Party must certify, through a signed written confirmation to CATRION, that data sanitization has been successfully completed.
4.16 External Party must apply appropriate encryption controls to protect CATRION's information and data based on their classification and ensure confidentiality, integrity, and availability in line with NCA's National Cryptographic Standards.
4.17 External Parties must regularly back up CATRION's information and data in line with national and international best practices to prevent data loss, and must periodically test the backups (by performing restore/recovery tests) to verify they are recoverable and effective.
4.18 CATRION's information and data residing in critical systems and personal data processed by External Party must not be processed, stored, or used in any testing/non‑production environment unless strict controls are applied to protect such data (e.g., data masking, data scrambling, or data anonymization) and after obtaining the necessary approvals from the concerned departments in CATRION, in line with the guidelines and requirements of the National Data Management Office (NDMO).
4.19 CATRION's information and data residing in critical systems and processed or stored by External Parties must not be transmitted out of the production environment.
4.20 The External Party shall ensure, through its internal policies and governance processes, that all personnel are clearly instructed that the use of personal or generic accounts to share, transmit, or otherwise handle CATRION's classified data is strictly prohibited.
4.21 External Party must not use their own organization's AI systems or any external AI platforms to process CATRION data unless those systems are explicitly approved by CATRION.
4.22 Where AI or Machine Learning services are used, External Party shall ensure that models and algorithms comply with ethical standards and regulatory requirements, including transparency and bias mitigation.
4.23 Sensitive CATRION data must never be uploaded to public, non‑CATRION‑owned, or externally hosted AI systems.
4.24 External Party must not access or use CATRION data for any secondary purpose beyond delivering the contracted services.
4.25 External Party must support CATRION in the event of legal action that involves CATRION information handled by the External Party.
4.26 Unauthorized devices must not be used by the External Party to access, process, store, or transmit CATRION's data or information and technology assets.
4.27 External Party must notify and obtain approval from CATRION prior sharing any CATRION data to a subcontractor.
4.28 External Party must implement data validation on all input fields to only accept input with valid data type, syntax, and length.
4.29 External Party must restrict administrative users (e.g., operating system, database, and application administrators) from accessing CATRION's data unless explicitly authorized.
4.30 Critical Data Processor Requirements: The compliance with the following requirements is mandatory for External Parties that process CATRION's critical or sensitive data, either directly or indirectly, for the purpose of this policy, "process"/"processing" shall mean any operation carried out on CATRION's data by any means, whether manual or automated, including but not limited to collecting, recording, saving, indexing, organizing, formatting, storing, modifying, updating, consolidating, retrieving, using, disclosing, transmitting, publishing, sharing, linking, blocking, erasing, and destroying data:
4.30.1 The External Party shall take the necessary organizational, administrative, and technical measures to ensure CATRION's and personal data security and privacy, and shall comply with the following:
- Implement necessary security and technical measures to limit security risks related to Data breach.
- Adopt all relevant controls, standards, and rules issued by the National Cybersecurity Authority, or adopt recognized best practices and cybersecurity standards If the External Party is not obligated to follow the controls, standards, and rules issued by the National Cybersecurity Authority.
4.30.2 CATRION reserves the right to request specific nationality-based talent restrictions to provide relevant support services.
4.30.3 CATRION reserves the right to request on-site resources as needed (According to the classification of CATRION's data they need to view/access).
4.30.4 External Party must implement Mobile Device Management (MDM) on all assets used to receive, store, process, or transmit CATRION data, such as enforcing controls to disable the use of external storage media.
4.30.5 External Party must ensure that remote wipe solutions are installed on all tablets and mobile phones used to receive, store, and/or produce CATRION Critical Data.
5. Software Development Requirements
The compliance with the following requirements is mandatory for External Parties responsible for the development, enhancement, and deployment of the system, application or any software:
5.1 The External Party is responsible for the development, enhancement, and deployment of the system within scope across all environments, in accordance with CATRION's approved designs and requirements.
5.2 The project and software must be fully designed, tested, and deployed in both testing and production environments in accordance with CATRION's specifications.
5.3 The External Party must conduct appropriate source code reviews and Static Application Security Testing (SAST) on code developed for CATRION, preferably by an independent External Party, and provide the relevant reports.
5.4 The External Party must conduct and share updated source code review and SAST reports with CATRION for every new code update or release.
5.5 The External Party must comply with CATRION's Secure Software Development Lifecycle (SSDLC) requirements throughout the development lifecycle.
5.6 Prior to delivering executables to CATRION, the External Party must ensure that all identified Open Web Application Security Project (OWASP) vulnerabilities discovered during source code reviews are remediated and closed.
5.7 The External Party must provide professional guidance on development requirements to ensure UX/UI compatibility, code reuse, feasibility, technical complexity, platform and device compatibility, and backend functionality reuse.
5.8 The solution must implement appropriate error handling and exception logging mechanisms to manage system data issues (e.g., missing or invalid data) while preventing interface or service disruptions and avoiding the disclosure of sensitive technical information.
5.9 The External Party must address the following areas during solution design and implementation:
5.9.1 Business process design
5.9.2 Application architecture
5.9.3 Database design
5.9.4 Quality assurance, deployment, and maintenance
5.9.5 Testing (unit, system, performance, stress, and usability testing)
5.9.6 Deployment planning and change/configuration management
5.9.7 Training, including manuals and guideline documentation
5.9.8 End‑user documentation
5.10 All changes, updates, and upgrades must follow CATRION's change management process and require advance notification and approval.
5.11 All External Party components used within the solution must be disclosed and supported by valid licenses or subscriptions that include patch updates and upgrades.
5.12 The External Party must validate the security and authenticity of any open‑source or third‑party code, libraries, or components used throughout the development lifecycle.
5.13 External Parties providing software development for CATRION must establish an escrow facility using a trusted provider to ensure that CATRION can continue using, maintaining, and developing software even if the external vendor fails to support it, goes out of business, or the contract relationship ends.
6. Cloud Service Requirements
The compliance with the following requirements is mandatory for Cloud Service Providers:
6.1 External Party must comply with all applicable Saudi Cybersecurity regulations related to Cloud Services, especially NCA Cloud Cybersecurity Controls (CCC) and all other applicable Saudi regulatory requirements.
6.2 The External Party shall ensure that the use of cloud computing services complies with all applicable data protection, privacy laws, and regulatory requirements, and shall maintain clearly defined and documented responsibilities within its governance framework for ensuring compliance with such privacy requirements.
6.3 External Party shall establish and mutually agree upon with CATRION to clearly define roles and responsibilities related to cloud computing, including documented RACI (Responsible, Accountable, Consulted, Informed) assignments.
6.4 External Party must ensure that the cloud service's data center(s) (or hosting facilities used to deliver the service) should be certified by an internationally/nationally recognized entity, as applicable to the service.
6.5 External Party must ensure that all CATRION's data is hosted and stored in countries with established regulations for privacy, data security, and Cybersecurity.
6.6 External Party must support and cooperate with CATRION to classify the data and apply the required handling and protection measures based on its classification before hosting, storing, or processing any data using cloud computing or hosting services.
6.7 External Party must ensure CATRION's environment within cloud computing services is logically and/or physically segregated from other entities' environments to prevent unauthorized access and interference.
6.8 CATRION's data must be logically segregated from other data held by the External Party, such as virtual servers. This includes the ability of the External Party to consistently identify and differentiate CATRION's data from other types of data.
6.9 External Party must define and implement a data handling process to prevent CATRION's data from being transferred outside the approved cloud instance.
6.10 External Party must restrict physical access to facilities where information systems reside to authorized personnel and ensure such access is reviewed on a regular basis.
6.11 External Party must enforce Multi-Factor Authentication (MFA) for all users accessing the public cloud computing services that store or host CATRION Critical Data.
6.12 External Party must encrypt user sessions and servers' communication (e.g., using HTTPS, TLS) whenever CATRION Critical information or data is transmitted to or from the External Party's public cloud computing services, and must enforce secure session controls including session authentication, account lockout, and session timeout/termination.
6.13 The External Party provider must ensure that Cloud Services Provider shall implement and monitor cybersecurity measures as identified in the risk assessment to protect the confidentiality, integrity, and availability of CATRION's Data.
6.14 External Party must ensure that an encryption key management capability, covering key preservation (e.g., archiving/backup) and secure retrieval/recovery, is defined, implemented, and periodically reviewed.
6.15 If External Party is hosting an application or a website for CATRION or providing a cloud‑based web application, Web Application Firewall (WAF) must be implemented to inspect all incoming traffic for potential threats and malicious activity (e.g., SQL injection and Cross‑Site Scripting).
6.16 If External Party hosts a website for CATRION or providing a Cloud Computing Service, the website/Cloud Computing Service must be secured by a Distributed Denial of Service (DDoS) protection.
6.17 External Party must conduct annual external penetration testing on Cloud Computing Service(s) used by CATRION.
6.18 The cloud service must support high business resilience configurations to maximize availability.
6.19 External Party shall ensure that all CATRION-hosted data is backed up in accordance with agreed backup scope and frequency, and that such backups (or restored copies) are made available to CATRION upon request through a controlled and logged recovery process.
6.20 External Party should recommend and implement recovery time objectives (RTO) and recovery point objectives (RPO) based on the CATRION's capabilities.
6.21 External Party must implement Disaster Recovery and Business Continuity procedures related to cloud services and coordinate with CATRION's personnel, BCM, IT and Cybersecurity Team, as applicable.
7. AI Service Requirements
The compliance with the following requirements is mandatory for all External Parties acting as AI Service Providers, Suppliers, or any party that develops, provides, integrates, embeds, accesses, or utilizes Artificial Intelligence (AI) capabilities as part of the services delivered to CATRION, whether directly or indirectly. These requirements shall apply regardless of whether AI capabilities are: developed internally by the External Party, provided by a External Party or subcontractor, or embedded within commercial off-the-shelf (COTS) solutions or cloud services:
7.1 External Party must comply with Saudi AI and data regulations, including SDAIA AI Adoption Framework, Saudi National Cybersecurity Data Cybersecurity Controls, Personal Data Protection, and Generative AI Guidelines.
7.2 External Party must make the use of AI models private, with restricted access limited to vetted, authorized and trained users only.
7.3 External Party must apply appropriate security controls during AI model training, fine‑tuning, deployment, and monitoring to prevent unauthorized access.
7.4 All data, content, recordings, videos, outputs, and AI-generated materials created, processed, or generated under this provided service shall be the exclusive property of CATRION. The External Party shall not access, retain, disclose, reuse, train, test, or improve any artificial intelligence or machine learning model using such data or materials without CATRION's prior written consent.
7.5 External Party must ensure that any use of Personally Identifiable Information (PII) in AI systems must:
7.5.1 Have a lawful basis.
7.5.2 Comply with privacy requirements (privacy notices, retention rules, DPIAs).
7.5.3 Apply protections such as anonymization, pseudonymization, and encryption, where feasible.
7.6 CATRION's intellectual property must not be uploaded to public or external AI systems unless explicit permission is granted by the intellectual property's owner.
7.7 External Party must ensure that AI outputs and training data do not violate intellectual property laws.
7.8 External Party must not use Non‑open‑source code or non‑CATRION materials to train AI models.
7.9 CATRION retails the intellectual property ownership and data ownership of any data processed via the AI models, including prompt and output data.
7.10 External Party retains liable for any damages or losses arising from the use of their generative AI models.
7.11 External Party involved in the use of Artificial Intelligence (AI) for CATRION shall, upon completion, termination, or expiration of services, or upon CATRION's request, securely return or permanently destroy all CATRION data within 14 days, including AI training data, model inputs and outputs, logs, metadata, and backups. Data destruction shall be performed using secure, industry‑recognized methods and shall apply to all environments. CATRION data shall not be retained, reused, or incorporated into AI models beyond the approved purpose. Written confirmation of data return or destruction shall be provided upon request, and any exception must be formally approved by CATRION's Data Management Department.
8. OT Component Requirements
The compliance with the following requirements is mandatory for all External Parties providing OT components, services, or systems to CATRION:
8.1 External Party must comply with all applicable Cybersecurity regulations related to Operational Technology (OT) environments, especially NCA Operational Technology Cybersecurity Controls (OTCC).
8.2 External Party must maintain a detailed and up-to-date inventory of all their OT assets involved in the project (hardware or software provided or used).
8.3 External Party must ensure only the vetted, authorized and trained personnel have access to OT systems related to CATRION's projects.
8.4 Implement strong access control mechanisms (role-based access, multifactor authentication if applicable) and ensure secure remote access solutions are used when connecting to OT systems.
8.5 External Party shall implement and maintain appropriate network segmentation controls within its OT environments to ensure the logical and/or physical separation of networks based on criticality, functionality, and risk, including segregation between operational technology, corporate IT networks, and external networks.
8.6 External Party must conduct periodic security assessments and vulnerability scans of OT Systems.
8.7 External Party shall apply vendor-recommended security patches and updates on all OT/ICS assets and components provided or managed in a timely manner.
8.8 External Party must use secure communication protocols for any data transmitted to/from OT systems.
8.9 External Party must log and monitor all access and activities within OT systems and report suspicious behavior to CATRION Cybersecurity Team via: Cybersecurity@catrion.com
8.10 External Party must implement Disaster Recovery and Business Continuity procedures related to OT systems and coordinate with CATRION's personnel, as applicable.
9. Smart Devices / IoT / Sensors Requirements
The compliance with the following requirements is mandatory for all External Parties providing, managing, or maintaining smart devices, Internet of Things (IoT) solutions, sensors, or similar systems, including any associated components, services, or technologies, for CATRION:
9.1 External Party must ensure that all smart devices, IoT devices, and sensors are securely configured and deployed in accordance with industry's best practices and CATRION Cybersecurity requirements.
9.2 External Party must ensure that all IoT and smart devices are uniquely identifiable and maintain an up-to-date inventory of all such devices connected to CATRION's environment.
9.3 External Party must implement strong authentication and access control mechanisms for all devices, including disabling default credentials and enforcing secure password policies.
9.4 External Party must ensure that all communications between IoT devices, sensors, and associated systems are encrypted and protected against unauthorized access or interception.
9.5 External Party must ensure that smart devices and IoT components are segmented from other networks to prevent unauthorized access and lateral movement.
9.6 External Party must ensure that unnecessary services, ports, and interfaces on all devices are disabled to minimize the attack surface.
9.7 External Party must establish and maintain vulnerability and patch management processes, ensuring that firmware, software, and device components are regularly updated and secured.
9.8 External Party must ensure that all IoT and smart device activities are logged and monitored for security events and anomalies.
9.9 External Party must ensure that physical security controls are implemented to prevent unauthorized access, tampering, or theft of IoT devices and sensors.
9.10 External Party must ensure that data collected, processed, or transmitted by IoT devices is protected in accordance with CATRION data protection and privacy requirements.
9.11 External Party must ensure secure remote access to IoT and smart devices, if applicable, and restrict such access to authorized users only.
9.12 External Party must ensure that IoT devices are not directly exposed to untrusted networks, including the internet, unless explicitly approved and protected by adequate security controls.
9.13 External Party must ensure that incident detection and response capabilities are in place for IoT environments, including timely reporting of any security incidents to CATRION.
10. MANDATORY DATA MANAGEMENT FORMS
10.1 Data Sharing and Disclosure: External Parties shall not disclose, transfer, share, or otherwise make CATRION data available to any subcontractor, government entity, service provider, or other third party without filling the Data Disclosing Request Form and obtaining CATRION's prior written authorization. Where authorization is granted, the External Party shall ensure that the data is used solely for the approved purpose and handled in accordance with the specified legal, contractual, security, confidentiality, retention, and data protection requirements. The External Party shall remain accountable for the protection and authorized use of CATRION data by any third party to whom access is granted.
10.2 Data Return and Secure Destruction: Upon completion, expiration, or termination of the applicable engagement, or upon CATRION's written request, External Parties shall securely return or destroy all CATRION data and assets, including all copies held by authorized third parties, and submit a completed Data Return & Destruction Notice as evidence of completion. No CATRION data shall be retained unless legally required or expressly authorized in writing by CATRION.
11. DEVIATIONS
In case the compliance with this policy is not technically feasible, a waiver must be requested.
12. REVISION
CATRION reserves the right to modify, amend, or update this Cybersecurity External Party Policy at any time to reflect changes in legal, regulatory, contractual, operational, security, or business requirements.
The most current version of this Policy will be published on CATRION's website and will become effective upon publication, unless otherwise stated. External parties are responsible for regularly reviewing this Policy and ensuring their continued compliance with its requirements, including any future updates, revisions, or amendments.
Continued engagement with, provision of services to, or access to CATRION systems, networks, information, or data after the publication of an updated Policy constitutes acknowledgment of and agreement to comply with the updated requirements.
CATRION External Party Cybersecurity Policy Version 6
