Policy Studio
Structured policy builder covering all 33 Regulation 8 topics, CCMP, BCP, data retention, backup and remote access/operation procedures (Module 8.14).
Cyber Security Policy — v3.2
Owner CISO Office · Effective 24 Apr 2026 · Next review 24 Apr 2027
Regulation 8 topic coverage29 of 33 topics covered
| # | Regulation 8 Topic | Coverage |
|---|---|---|
| 1 | Governance & roles | Covered |
| 2 | CISO authority & reporting | Covered |
| 3 | Asset identification & classification | Covered |
| 4 | Access control & identity management | Covered |
| 5 | Network security architecture | Covered |
| 6 | OT/IT segmentation | Covered |
| 7 | Remote access management | Covered |
| 8 | Remote operation management | Covered |
| 9 | Cryptography & encryption standards | Covered |
| 10 | Data classification & handling | Covered |
| 11 | Data residency & cross-border transfer | Covered |
| 12 | Backup & recovery | Covered |
| 13 | Change management | Covered |
| 14 | Patch management | Covered |
| 15 | Vulnerability management | Covered |
| 16 | Security monitoring & logging | Covered |
| 17 | Incident response | Covered |
| 18 | Cyber sabotage reporting | Covered |
| 19 | Crisis management alignment | Covered |
| 20 | Vendor & third-party risk | Covered |
| 21 | Supply chain security | Covered |
| 22 | Procurement security requirements | Covered |
| 23 | Physical security of critical systems | Covered |
| 24 | Personnel security & background checks | Covered |
| 25 | Security awareness & training | Covered |
| 26 | Business continuity alignment | Covered |
| 27 | Disaster recovery | Covered |
| 28 | Retention & records management | Covered |
| 29 | Audit & assurance | Covered |
| 30 | Self-assessment | Gap |
| 31 | Reference time synchronization | Gap |
| 32 | Public IP & web/app security | Gap |
| 33 | Policy review & governance cadence | Gap |