Adopt a cybersecurity policy, submitted to VARA at licensing and on request and reviewed at least annually by the CISO, covering information security, data classification, access control, capacity, operations and availability, network security, consensus protocol, code and smart contract validation, development and QA, physical security, strong or multi-factor authentication for client transactions above client limits or after changes such as a new withdrawal address, session and password controls, authenticated changes to client details, data privacy in transfer and against leakage, vendor management, monitoring of external protocol changes, incident response with root cause analysis, staff and supplier vetting, escalation for ransomware and other attacks, infrastructure hardening, and sharing threat intelligence where safe. The framework must also meet Dubai Electronic Security Center standards, the PDPL and UAE Data Office requirements, and CBUAE consumer protection cybersecurity rules where applicable.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.