Saudi Aramco GI 299.226 ENTERPRISE CYBERSECURITY POLICY

This document, Saudi Aramco General Instruction Manual GI 299.226, establishes the mandatory minimum information security requirements for Saudi Aramco's enterprise cybersecurity. It details policies and procedures designed to protect the confidentiality, integrity, and availability of the company's information and technology assets.

Key topics covered include information security governance, risk management, compliance assessments, asset management, business environment considerations, data security, and incident response planning. It also outlines specific cybersecurity indicators and processes for obtaining relevant data, aligning with frameworks such as NIST Cybersecurity Framework (CSF).

This policy is crucial for ensuring robust cybersecurity practices across all Saudi Aramco organizations and their associated systems. Ideal for IT security managers, cybersecurity analysts, compliance officers, and information security officers working within the oil and gas industry or similar large enterprises.