RSK-0006Mueen Digital Platform — Release 4
Possible critical findings in the pre-launch penetration test
A risk's detail, response, contingency and residual risk.
Risk statement
From cause to event to impact — with the preventive controls before the event and the contingency after it
Cause
Out-of-date open-source components in the integration layer that carries classified case data
Preventive controls
- Automated vulnerability scanning in the deployment pipeline
- An early penetration test on pre-production
2 / 2
Event
Possible critical findings in the pre-launch penetration test
Any critical finding, or more than five high findings
Contingency
A two-week vendor fix squad after the report
Impact
Security sign-off postponed and launch delayed by at least four weeks, with a risk of exposing parties’ data
Assessment
The level before and after the response
Inherent
Residual
Exposure
SAR 600K
Residual
67% off the score
Score trend
Last six months
- Score
- Target residual
Escalation path
Escalation engine: a high risk unreviewed for 10 days notifies the PM, 15 the programme manager, 20 the EPMO director
Last reviewed 8 days ago · Outside the engine — below «high»
Project manager
Current levelEng. Sultan F. Al-Ghamdi
Currently followed up here- 2
Programme manager
Eng. Reem K. Al-Dosari
- 3
EPMO director
Dr. Noura M. Al-Otaibi
- 4
Executive committee
Dr. Abdullah S. Al-Qahtani
By the EPMO director’s decision
Mitigation plan
Each action with its owner and date — tick it off when complete
Automated vulnerability scanning in the deployment pipeline
Eng. Yasser M. Al-ZahraniEng. Yasser M. Al-ZahraniDirector, CybersecurityP-026y.alzahrani@bog.gov.saIn progressIn 18 days2026-11-155 Jumada II 1448 AHAn early penetration test on pre-production
Eng. Yasser M. Al-ZahraniEng. Yasser M. Al-ZahraniDirector, CybersecurityP-026y.alzahrani@bog.gov.saNot startedIn 34 days2026-12-0121 Jumada II 1448 AH
Trigger
Any critical finding, or more than five high findings
Contingency
A two-week vendor fix squad after the report