Central Bank of Egypt Financial Cybersecurity Framework
Mandatory cybersecurity framework for all banks, financial institutions, and payment service providers regulated by the Central Bank of Egypt. 5 functions (governance, risk management, technology and operations, cyber defence, outsourcing and vendor management) across 23 domains covering leadership, compliance, asset management, IAM, data protection, cryptography, application security, network security, SOC, incident management, and business resilience. Built on NIST CSF, ISO 27001, and SWIFT CSCF.
AC (19) AT (6) AU (11) CA (8) CM (14) CP (12) IA (11) IR (9) MA (6) MP (7) PE (17) PL (7) PM (20) PS (9) PT (8) RA (9) SA (12) SC (17) SI (13) SR (5)
AC Access Control
| Control | Name | CBE CSF References |
|---|---|---|
| AC-01 | Policy and Procedures | CTO-1 |
| AC-02 | Account Management | CD-1CTO-1 |
| AC-03 | Access Enforcement | CTO-1CTO-5 |
| AC-04 | Information Flow Enforcement | CTO-1CTO-2CTO-5CTO-6CTO-8 |
| AC-05 | Separation of Duties | CD-1CTO-1 |
| AC-06 | Least Privilege | CD-1CTO-1 |
| AC-07 | Unsuccessful Logon Attempts | CTO-1 |
| AC-08 | System Use Notification | CTO-1 |
| AC-10 | Concurrent Session Control | CTO-1 |
| AC-11 | Device Lock | CTO-1 |
| AC-12 | Session Termination | CTO-1 |
| AC-14 | Permitted Actions Without Identification or Authentication | CTO-1 |
| AC-16 | Security and Privacy Attributes | CTO-2 |
| AC-17 | Remote Access | CTO-1CTO-5CTO-6 |
| AC-18 | Wireless Access | CTO-6 |
| AC-19 | Access Control for Mobile Devices | CTO-1CTO-7 |
| AC-20 | Use of External Systems | CTO-1CTO-11 |
| AC-23 | Data Mining Protection | CTO-2 |
| AC-24 | Access Control Decisions | CTO-1 |
AT Awareness and Training
AU Audit and Accountability
| Control | Name | CBE CSF References |
|---|---|---|
| AU-02 | Event Logging | CD-1CTO-5 |
| AU-03 | Content of Audit Records | CD-1CTO-5 |
| AU-04 | Audit Log Storage Capacity | CD-1 |
| AU-05 | Response to Audit Logging Process Failures | CD-1 |
| AU-06 | Audit Record Review, Analysis, and Reporting | CD-1 |
| AU-07 | Audit Record Reduction and Report Generation | CD-1 |
| AU-08 | Time Stamps | CD-1 |
| AU-09 | Protection of Audit Information | CD-1 |
| AU-12 | Audit Record Generation | CD-1 |
| AU-13 | Monitoring for Information Disclosure | CD-1 |
| AU-14 | Session Audit | CD-1 |
CA Security Assessment and Authorization
| Control | Name | CBE CSF References |
|---|---|---|
| CA-01 | Policy and Procedures | GOV-3 |
| CA-02 | Control Assessments | GOV-3OVM-3 |
| CA-03 | Information Exchange | CTO-11GOV-3 |
| CA-05 | Plan of Action and Milestones | CRM-1GOV-3 |
| CA-06 | Authorization | GOV-3 |
| CA-07 | Continuous Monitoring | CD-1GOV-3OVM-3 |
| CA-08 | Penetration Testing | OVM-3 |
| CA-09 | Internal System Connections | CTO-11OVM-3 |
CM Configuration Management
| Control | Name | CBE CSF References |
|---|---|---|
| CM-01 | Policy and Procedures | CTO-12 |
| CM-02 | Baseline Configuration | CTO-7CTO-12 |
| CM-03 | Configuration Change Control | CTO-7CTO-9CTO-12 |
| CM-04 | Impact Analyses | CTO-9CTO-12 |
| CM-05 | Access Restrictions for Change | CTO-12 |
| CM-06 | Configuration Settings | CTO-6CTO-7CTO-12 |
| CM-07 | Least Functionality | CTO-6CTO-7 |
| CM-08 | System Component Inventory | CRM-2 |
| CM-09 | Configuration Management Plan | CRM-2CTO-12 |
| CM-10 | Software Usage Restrictions | CTO-7 |
| CM-11 | User-installed Software | CTO-7 |
| CM-12 | Information Location | CRM-2CTO-2 |
| CM-13 | Data Action Mapping | CRM-2 |
| CM-14 | Signed Components | CTO-4 |
CP Contingency Planning
| Control | Name | CBE CSF References |
|---|---|---|
| CP-01 | Policy and Procedures | OVM-2 |
| CP-02 | Contingency Plan | OVM-2 |
| CP-03 | Contingency Training | OVM-2 |
| CP-04 | Contingency Plan Testing | OVM-2 |
| CP-06 | Alternate Storage Site | OVM-2 |
| CP-07 | Alternate Processing Site | OVM-2 |
| CP-08 | Telecommunications Services | OVM-2 |
| CP-09 | System Backup | OVM-2 |
| CP-10 | System Recovery and Reconstitution | OVM-2 |
| CP-11 | Alternate Communications Protocols | OVM-2 |
| CP-12 | Safe Mode | OVM-2 |
| CP-13 | Alternative Security Mechanisms | OVM-2 |
IA Identification and Authentication
| Control | Name | CBE CSF References |
|---|---|---|
| IA-01 | Policy and Procedures | CTO-1 |
| IA-02 | Identification and Authentication (Organizational Users) | CTO-1CTO-5 |
| IA-03 | Device Identification and Authentication | CTO-1 |
| IA-04 | Identifier Management | CTO-1 |
| IA-05 | Authenticator Management | CTO-1CTO-5 |
| IA-06 | Authentication Feedback | CTO-1 |
| IA-07 | Cryptographic Module Authentication | CTO-3 |
| IA-08 | Identification and Authentication (Non-organizational Users) | CTO-1CTO-5 |
| IA-09 | Service Identification and Authentication | CTO-1 |
| IA-11 | Re-authentication | CTO-1 |
| IA-12 | Identity Proofing | CTO-1 |
IR Incident Response
| Control | Name | CBE CSF References |
|---|---|---|
| IR-01 | Policy and Procedures | CD-2 |
| IR-02 | Incident Response Training | CD-2 |
| IR-03 | Incident Response Testing | CD-2 |
| IR-04 | Incident Handling | CD-2 |
| IR-05 | Incident Monitoring | CD-2 |
| IR-06 | Incident Reporting | CD-2 |
| IR-07 | Incident Response Assistance | CD-2 |
| IR-08 | Incident Response Plan | CD-2 |
| IR-09 | Information Spillage Response | CD-2 |
MA Maintenance
MP Media Protection
PE Physical and Environmental Protection
| Control | Name | CBE CSF References |
|---|---|---|
| PE-01 | Policy and Procedures | CTO-10 |
| PE-02 | Physical Access Authorizations | CTO-10 |
| PE-03 | Physical Access Control | CTO-10 |
| PE-04 | Access Control for Transmission | CTO-10 |
| PE-05 | Access Control for Output Devices | CTO-10 |
| PE-06 | Monitoring Physical Access | CD-1CTO-10 |
| PE-07 | Visitor Control | CTO-10 |
| PE-08 | Visitor Access Records | CTO-10 |
| PE-09 | Power Equipment and Cabling | CTO-10 |
| PE-10 | Emergency Shutoff | CTO-10 |
| PE-11 | Emergency Power | CTO-10 |
| PE-12 | Emergency Lighting | CTO-10 |
| PE-13 | Fire Protection | CTO-10 |
| PE-14 | Environmental Controls | CTO-10 |
| PE-15 | Water Damage Protection | CTO-10 |
| PE-17 | Alternate Work Site | CTO-10 |
| PE-18 | Location of System Components | CTO-10 |
PL Planning
| Control | Name | CBE CSF References |
|---|---|---|
| PL-01 | Policy and Procedures | GOV-1GOV-3 |
| PL-02 | System Security and Privacy Plans | GOV-1GOV-3 |
| PL-04 | Rules of Behavior | GOV-3 |
| PL-08 | Security and Privacy Architectures | GOV-1 |
| PL-09 | Central Management | GOV-1 |
| PL-10 | Baseline Selection | CRM-1GOV-1 |
| PL-11 | Baseline Tailoring | CRM-1GOV-1 |
PM Program Management
| Control | Name | CBE CSF References |
|---|---|---|
| PM-01 | Information Security Program Plan | GOV-1 |
| PM-02 | Information Security Program Leadership Role | GOV-1GOV-2 |
| PM-03 | Information Security and Privacy Resources | GOV-1 |
| PM-04 | Plan of Action and Milestones Process | GOV-3 |
| PM-05 | System Inventory | CRM-2 |
| PM-06 | Measures of Performance | GOV-3 |
| PM-08 | Critical Infrastructure Plan | OVM-2 |
| PM-09 | Risk Management Strategy | CRM-1GOV-1 |
| PM-10 | Authorization Process | GOV-1GOV-3 |
| PM-11 | Mission and Business Process Definition | GOV-1OVM-2 |
| PM-12 | Insider Threat Program | CD-1 |
| PM-13 | Security and Privacy Workforce | GOV-1GOV-2GOV-4 |
| PM-14 | Testing, Training, and Monitoring | CD-1OVM-3 |
| PM-15 | Security and Privacy Groups and Associations | GOV-3GOV-4 |
| PM-16 | Threat Awareness Program | CD-1CTO-9 |
| PM-28 | Risk Framing | CRM-1GOV-1 |
| PM-29 | Risk Management Program Leadership Roles | GOV-1GOV-2 |
| PM-30 | Supply Chain Risk Management Strategy | CTO-11OVM-1 |
| PM-31 | Continuous Monitoring Strategy | CTO-11OVM-1 |
| PM-32 | Purposing | OVM-1 |
PS Personnel Security
| Control | Name | CBE CSF References |
|---|---|---|
| PS-01 | Policy and Procedures | GOV-2 |
| PS-02 | Position Risk Designation | CD-1GOV-2 |
| PS-03 | Personnel Screening | CD-1GOV-2 |
| PS-04 | Personnel Termination | CD-1GOV-2 |
| PS-05 | Personnel Transfer | GOV-2 |
| PS-06 | Access Agreements | CD-1GOV-2 |
| PS-07 | External Personnel Security | GOV-2 |
| PS-08 | Personnel Sanctions | CD-1GOV-2 |
| PS-09 | Position Descriptions | GOV-1GOV-2 |
PT Personally Identifiable Information Processing and Transparency
| Control | Name | CBE CSF References |
|---|---|---|
| PT-01 | Policy and Procedures | CTO-2 |
| PT-02 | Authority to Process Personally Identifiable Information | CTO-2 |
| PT-03 | Personally Identifiable Information Processing Purposes | CTO-2 |
| PT-04 | Consent | CTO-2 |
| PT-05 | Privacy Notice | CTO-2 |
| PT-06 | System of Records Notice | CTO-2 |
| PT-07 | Specific Categories of Personally Identifiable Information | CTO-2 |
| PT-08 | Computer Matching Requirements | CTO-2 |
RA Risk Assessment
| Control | Name | CBE CSF References |
|---|---|---|
| RA-01 | Policy and Procedures | CRM-1 |
| RA-02 | Security Categorization | CRM-1CRM-2 |
| RA-03 | Risk Assessment | CD-1CRM-1 |
| RA-04 | Risk Assessment Update | CRM-1 |
| RA-05 | Vulnerability Monitoring and Scanning | CRM-1CTO-9OVM-3 |
| RA-06 | Technical Surveillance Countermeasures Survey | CTO-9OVM-3 |
| RA-07 | Risk Response | CRM-1 |
| RA-09 | Criticality Analysis | CRM-1CRM-2OVM-3 |
| RA-10 | Threat Hunting | CD-1 |
SA System and Services Acquisition
| Control | Name | CBE CSF References |
|---|---|---|
| SA-03 | System Development Life Cycle | CTO-4 |
| SA-04 | Acquisition Process | CTO-4CTO-11OVM-1 |
| SA-08 | Security and Privacy Engineering Principles | CTO-4 |
| SA-09 | External System Services | CTO-11OVM-1 |
| SA-10 | Developer Configuration Management | CTO-4CTO-12 |
| SA-11 | Developer Testing and Evaluation | CTO-4 |
| SA-15 | Development Process, Standards, and Tools | CTO-4 |
| SA-16 | Developer-provided Training | CTO-4 |
| SA-17 | Developer Security and Privacy Architecture and Design | CTO-4 |
| SA-20 | Customized Development of Critical Components | CTO-4 |
| SA-21 | Developer Screening | CTO-4OVM-1 |
| SA-22 | Unsupported System Components | CRM-2CTO-9OVM-1 |
SC System and Communications Protection
| Control | Name | CBE CSF References |
|---|---|---|
| SC-05 | Denial-of-service Protection | CTO-6 |
| SC-07 | Boundary Protection | CRM-2CTO-5CTO-6CTO-8CTO-11 |
| SC-08 | Transmission Confidentiality and Integrity | CTO-2CTO-3CTO-5CTO-6CTO-8 |
| SC-12 | Cryptographic Key Establishment and Management | CTO-3 |
| SC-13 | Cryptographic Protection | CTO-2CTO-3CTO-5 |
| SC-17 | Public Key Infrastructure Certificates | CTO-3 |
| SC-20 | Secure Name/Address Resolution Service (Authoritative Source) | CTO-6 |
| SC-21 | Secure Name/Address Resolution Service (Recursive or Caching Resolver) | CTO-6 |
| SC-22 | Architecture and Provisioning for Name/Address Resolution Service | CTO-6 |
| SC-23 | Session Authenticity | CTO-5 |
| SC-24 | Fail in Known State | OVM-2 |
| SC-26 | Decoys | CD-1 |
| SC-28 | Protection of Information at Rest | CTO-2CTO-3 |
| SC-39 | Process Isolation | CTO-6 |
| SC-40 | Wireless Link Protection | CTO-3 |
| SC-41 | Port and I/O Device Access | CTO-6CTO-7 |
| SC-44 | Detonation Chambers | CD-1CTO-6 |
SI System and Information Integrity
| Control | Name | CBE CSF References |
|---|---|---|
| SI-02 | Flaw Remediation | CTO-9 |
| SI-03 | Malicious Code Protection | CTO-7CTO-8 |
| SI-04 | System Monitoring | CD-1CTO-6CTO-7CTO-8 |
| SI-05 | Security Alerts, Advisories, and Directives | CD-1CTO-9 |
| SI-07 | Software, Firmware, and Information Integrity | CTO-7 |
| SI-08 | Spam Protection | CTO-8 |
| SI-10 | Information Input Validation | CTO-4CTO-5 |
| SI-11 | Error Handling | CTO-4 |
| SI-12 | Information Management and Retention | CTO-2 |
| SI-13 | Predictable Failure Prevention | OVM-2 |
| SI-15 | Information Output Filtering | CTO-4 |
| SI-16 | Memory Protection | CTO-7 |
| SI-17 | Fail-safe Procedures | OVM-2 |