RSK-0042Board Cybersecurity Programme
Undetected vulnerabilities in legacy systems before SOC onboarding
A risk's detail, response, contingency and residual risk.
Risk statement
From cause to event to impact — with the preventive controls before the event and the contingency after it
Cause
Legacy systems holding classified case data without regular security patching
Preventive controls
- A full vulnerability scan and fix the critical ones
- Continuous monitoring from the SOC
2 / 2
Event
Undetected vulnerabilities in legacy systems before SOC onboarding
An unpatched critical vulnerability found
Contingency
Isolate affected systems and run the response plan
Impact
Leaked party data, or a delayed NCA ECC compliance sign-off
Assessment
The level before and after the response
Inherent
Residual
Exposure
SAR 3M
Residual
60% off the score
Score trend
Last six months
- Score
- Target residual
Escalation path
Escalation engine: a high risk unreviewed for 10 days notifies the PM, 15 the programme manager, 20 the EPMO director
Last reviewed 2 days ago · Outside the engine — below «high»
Project manager
Current levelEng. Yasser M. Al-Zahrani
Currently followed up here- 2
Programme manager
Eng. Omar H. Bawazir
- 3
EPMO director
Dr. Noura M. Al-Otaibi
- 4
Executive committee
Dr. Abdullah S. Al-Qahtani
By the EPMO director’s decision
Mitigation plan
Each action with its owner and date — tick it off when complete
A full vulnerability scan and fix the critical ones
Eng. Yasser M. Al-ZahraniEng. Yasser M. Al-ZahraniDirector, CybersecurityP-026y.alzahrani@bog.gov.saIn progressIn 34 days2026-12-0121 Jumada II 1448 AHContinuous monitoring from the SOC
Eng. Yasser M. Al-ZahraniEng. Yasser M. Al-ZahraniDirector, CybersecurityP-026y.alzahrani@bog.gov.saNot startedIn 34 days2026-12-0121 Jumada II 1448 AH
Trigger
An unpatched critical vulnerability found
Contingency
Isolate affected systems and run the response plan