SABIC Compliance Assessment - Waves Telecom & Technology

Contact Information

Vendor Company Name *

Primary Contact Name *

Contact Email (For Report) *

Job Title/Role *

SECTION 1: Cybersecurity Governance & Risk Management (GV.RM)

This section assesses your organization's leadership, policy structure, and risk management processes related to cybersecurity.

**GV.01:** Is there a documented, executive-approved policy specifically addressing the SABIC Cyber Trust Standard requirements?

Yes No Partial

**GV.02:** Do you have a formally assigned Risk Owner responsible for managing cybersecurity risk related to the SABIC engagement?

Yes No Partial

**GV.03:** Is a recurring, formal cybersecurity risk assessment performed on all systems and assets connected to or supporting SABIC data?

Yes No Partial

**GV.04:** Do all employees, including contractors, receive mandatory annual security awareness training that covers data handling and the consequences of non-compliance?

Yes No Partial

SECTION 2: Cybersecurity Defense (DF.AM, DF.NS, DF.VM)

This section evaluates your technical controls protecting your IT and corporate infrastructure.

**DF.01:** Are all endpoints (servers, laptops, mobile devices) protected by up-to-date antivirus and Endpoint Detection and Response (EDR) solutions?

Yes No Partial

**DF.02:** Is Multi-Factor Authentication (MFA) mandatory for all remote access and access to critical systems handling SABIC data?

Yes No Partial

**DF.03:** Do you have a documented Vulnerability Management process, including patch deployment, running monthly security scans on all internet-facing assets?

Yes No Partial

**DF.04:** Are network security controls (firewalls) formally reviewed and configured to explicitly restrict access only to necessary services and ports (Principle of Least Privilege)?

Yes No Partial

**DF.05:** Do you regularly test and verify that backups of critical SABIC-related data are complete, secure, and restorable?

Yes No Partial

SECTION 3: Cybersecurity Resilience (RS.IR, RS.BC)

This section covers your ability to respond to and recover from a cybersecurity incident or disaster.

**RS.01:** Is a formal Incident Response (IR) plan documented, maintained, and **tested** at least annually?

Yes No Partial

**RS.02:** Does the IR plan include specific procedures for communicating an incident to SABIC, as required by the standard?

Yes No Partial

**RS.03:** Do you have a Business Continuity (BC) and Disaster Recovery (DR) plan in place to ensure critical business functions resume within defined recovery objectives (RTO/RPO)?

Yes No Partial

SECTION 4: Third-Party & Supply Chain Management (TP.SM)

This section focuses on the security of any vendors or subcontractors you use to support the SABIC engagement.

**TP.01:** Do you conduct formal cybersecurity due diligence (assessments, reviews) before onboarding any new third-party vendor handling SABIC data?

Yes No Partial

**TP.02:** Are security clauses requiring NCA alignment and adherence to SABIC standards included in all relevant vendor contracts?

Yes No Partial

SECTION 5: Industrial Control Systems (ICS) Security (If Applicable)

This section is only relevant if your organization operates or maintains an Industrial Control System (OT) connected to the SABIC ecosystem.

**ICS.01:** Is your ICS network physically and logically separated (network segmentation) from your corporate IT network using industrial firewalls and/or a DMZ?

Yes No Partial N/A

**ICS.02:** Are all remote access sessions into the ICS environment strictly logged and require Multi-Factor Authentication (MFA)?

Yes No Partial N/A

**ICS.03:** Are regular backups of PLC/SCADA configurations performed, and is the backup media stored securely offline?

Yes No Partial N/A