Kuwait NCF cross-cutting Supply Chain + People. Third Party and Supply Chain Security: vendor risk management programme + onboarding due diligence + cybersecurity questionnaire (SIG + CAIQ + custom) + right-to-audit + SOC 2 Type II + ISO 27001 + ISMS-P + Kuwait NCSC accreditation requirements + cybersecurity clauses in contracts + Service Level Agreements (SLA) for security + Subprocessor authorisation + Cloud provider classification per CITRA Cloud First Policy + Cloud Security Alliance (CSA) CCM + AWS/Azure/GCP shared responsibility model + Software-as-a-Service (SaaS) risk assessment + open-source software (OSS) risk + Software Bill of Materials (SBOM) + Supply chain attack mitigation (SolarWinds + Kaseya + log4j precedents) + ongoing vendor monitoring + concentration risk analysis + termination + offboarding + data return + deletion. Operational Technology (OT) + Industrial Control Systems (ICS) + Internet of Things (IoT) security: IEC 62443 + NIST SP 800-82 + ISA-99 + asset visibility + network segmentation from IT + safety-criticality + Purdue Model + Kuwait NCSC OT/CNI requirements (energy + oil + gas + water + electricity sectors). Awareness and Workforce Capability: mandatory annual cybersecurity awareness training for all personnel + role-based deep training + phishing simulation + Kuwait NCSC certification programmes + Kuwait Institute for Scientific Research (KISR) + Kuwait University cybersecurity programmes + GCC cybersecurity certifications + CISO development + CISSP + CISM + CISA + CEH + GIAC + cybersecurity workforce gap analysis + succession planning + retention strategies + female workforce inclusion + bug bounty community engagement + Capture the Flag (CTF) competitions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.