This document has been issued based on the regulatory tasks assigned to the Communications and Information Technology Commission in accordance with the Telecommunications Law and its executive regulations, as well as the organization of the Commission, and in alignment with the protection of the public interest and the interests of users in the sector, as stated in Article Three of the Law. Telecommunications services are considered a fundamental pillar in digital transformation, which is an important contributor to the development and diversification of the national economy. It also directly contributes to driving the change necessary to enable digital health, digital education, digital commerce, and smart cities, which implies an increased reliance on the availability of telecommunications and information technology services.

The Authority has prepared this document to ensure the readiness of the service provider to face potential risks to its infrastructure by implementing the necessary measures to identify, manage, and address all infrastructure risks that threaten the resilience and availability of mobile and fixed communication networks based on international best practices.

This document aims to achieve the following:

2.1 Statement of the service provider's commitments regarding the management of communication infrastructure risks.

2.2 Identification of a list of potential risks that the service provider must include in the risk register.

2.3 Ensuring the existence of a risk assessment methodology at the service provider, and preparing a standardized template for the risk register.

2.4 Assessing the service provider's readiness for risk situations concerning communication infrastructure.

2.5 Ensuring the effectiveness of the preventive measures implemented by the service provider through conducting periodic tests.

The terms and expressions defined in the Communications System and its Executive Regulations and other regulatory documents of the Commission shall have the same meanings when used in this document, and the following words and expressions shall have the meanings associated with them unless the context requires otherwise:

3.1 The Commission: Communications and Information Technology Commission

3.2 Service Provider: A telecommunications service provider that establishes, owns, or operates telecommunications infrastructure.

3.3 Risk: Harm or negative impact that affects the continuity of telecommunications services, which can be mitigated or reduced through preventive measures.

3.4 Impact: A qualitative or quantitative description of the results of a risk occurring on telecommunications services.

3.5 Probability: A qualitative or quantitative description of the likelihood of a risk occurring on telecommunications infrastructure.

3.6 Risk Management: A set of consistent activities and approaches used to reduce risks to telecommunications infrastructure, including identifying, analyzing, assessing, and addressing risks.

3.7 Risk Identification: The process of finding, recognizing, and describing risks.

3.8 Risk Analysis: Determining the impact and probability of identified risks.

3.9 Risk Assessment: A systematic process for measuring the degree of risk based on the results of its analysis in terms of impact and probability.

3.10 Risk Treatment: Establishing preventive measures to reduce the impact and probability of risks and determining the appropriate treatment plan in case the preventive measures are insufficient.

3.11 Risk Register: A standardized template for documenting all risks, including the results of analysis, assessment, and treatment measures.

3.12 Key Risk Indicators (KRIs): Measurable indicators that reflect the degree of risk, aimed at early warning to take appropriate actions to prevent the occurrence of the risk.

3.13 Critical Telecommunications Infrastructure Elements: The essential elements of telecommunications infrastructure, including buildings and facilities, which, if damaged or

malfunctioning, will significantly affect the continuity of voice and data services on fixed and mobile telecommunications networks.

4.1 The Authority shall determine the list of potential risks that the service provider must include in the risk register.

4.2 The Authority shall issue a standardized model for the risk register to be implemented by the service provider.

4.3 The service provider is obligated to take appropriate measures to manage the risks of telecommunications infrastructure and the necessary steps to protect its infrastructure.

4.4 The service provider is obligated to conduct periodic tests for the most significant risks in accordance with the results of the risk analysis and assessment.

4.5 The service provider is obligated to provide the Authority with the risk register, test results reports, and the necessary supporting documents to fulfill the obligations mentioned in this document.

4.6 The Authority monitors the service provider's compliance with the obligations mentioned in the regulations through the auditing methods it deems appropriate.

5.1.1 The service provider must have a framework and methodology for risk management that aligns with relevant international standards for risk management, such as the international standard ISO 1000. This framework must be documented and approved by the service provider, and the document should include, but not be limited to: the roles and responsibilities of the relevant departments within the service provider, monitoring procedures, and the methodology used for managing, mitigating, and monitoring risks. The risk management process should encompass the four essential stages:

• - Risk identification.

• - Risk analysis.

• - Risk assessment.

• - Risk treatment.

5.2.1 In addition to the potential risks identified by the Authority in Appurtenance No. (11) of this document, the service provider is obligated to add any additional potential risks to its telecommunications infrastructure.

This document, the service provider is obligated to add any additional potential risks to its telecommunications infrastructure.

5.2.2 The service provider must analyze all potential risks in terms of impact and likelihood.

5.2.3 The service provider must evaluate all potential risks and identify the preventive measures in place to reduce the impact and likelihood of those risks occurring.

5.2.4 The service provider must identify remediation plans in case the preventive measures are insufficient.

5.2.5 The service provider must identify and monitor the Key Risk Indicators (KRIs) for the most significant risks to the telecommunications infrastructure.

5.2.6 The service provider must have a specific mechanism for classifying critical telecommunications infrastructure according to its importance.

5.2.7 The service provider must create a list of the most important elements of critical telecommunications infrastructure according to the specified classification mechanism.

5.2.8 The service provider must evaluate any additional risks if requested by the Authority.

5.2.9 The service provider must implement additional preventive measures if the Authority deems the preventive measures currently in place to be inadequate or insufficient.

5.4.1 The service provider is obligated to conduct periodic tests on the main risks in accordance with the results of the risk analysis and assessment.

5.4.2 The service provider must provide the authority with the plan and schedule for the tests annually at the beginning of the first quarter of each Gregorian year, or any other period or date determined by the authority.

5.4.3 The service provider must amend the plan and schedule for the tests if requested by the authority.

5.4.4 The service provider must provide the authority with reports on the results of the tests annually at the end of the fourth quarter of each Gregorian year, or any other period or date determined by the authority.

5.4.5 The service provider must conduct additional tests if requested by the authority.

6.1 The Authority shall periodically monitor the service provider's compliance with the obligations mentioned in these regulations using the revision methods it deems appropriate, which includes, but is not limited to, compliance reports and inspection operations.

6.2 The Authority has the right to appoint an independent auditing entity to carry out inspection, revision, and monitoring operations.

6.3 In the event of the service provider's non-compliance with the obligations contained in this document, the Authority has the right to take legal actions precisely, including imposing financial penalties on it in accordance with the provisions of the Telecommunications Law and its executive regulations.