Catrion

Cybersecurity &
Data Protection

“Today, protecting CATRION’s critical assets and data is fundamental. By integrating robust cybersecurity measures into every business function, we ensure operational resilience, build stakeholder trust, and drive sustainable growth.”

— Director of Cybersecurity

Mirroring IT’s transformational vision, the Cybersecurity department dedicated 2024 to strengthening CATRION’s cyber resilience,

through increasing and consolidating its continuing compliance with both the National Cybersecurity Authority (NCA) standards and the Personal Data Protection Laws (PDPL), as well as aligning with international best practices.

Operating under a mission to protect confidentiality, integrity, and availability across all technological layers, the department aligned each initiative with overarching business objectives, risk management imperatives, and the ongoing push toward digital transformation.

A Year of Resilience and Protection

Enhanced Threat Detection & Response

Notable progress included elevating NCA ECC compliance significantly, driven by advanced threat detection and response technologies to safeguard networks and endpoints like Network Detection & Response (NDR), Network Access Control (NAC), Domain Name Security (DNS), and SOAR for automated incident handling. The team also implemented tools to prevent impersonation and protect CATRION’s identity, brand, and online services.
Compliance and Data Privacy

CATRION also prioritized protecting data privacy, introducing a Data Privacy Policy and systematic processes such as the Record of Processing Activities (RoPA) and Data Protection Impact Assessments (DPIAs) to meet both national regulations and international standards.

Also, to facilitate asset protection, the IT department ensured comprehensive tracking of all new IT assets through Asset Inventory Onboarding, reinforcing control over potential vulnerabilities.
Ongoing Risk Management and Governance

Through monthly reviews of Cybersecurity organizational risks, multiple physical audits conducted across 28 CATRION locations, coupled with 27 risk assessments pertaining to projects or events, and 24 Cybersecurity Standard implementation checks against the NCA ECC Framework, CATRION demonstrated its accomplished approach to managing risk and governing its assets.

Additionally, to improve incident response, the Outsourced Security Operations Center (SOC) provided 24/7 monitoring, handling procedures like processing Haseen threat notifications (109 this year) and safeguarding critical infrastructure.
Fostering a Secure Culture

Complementing these technical safeguards, the department ramped up security awareness, implementing and conducting ongoing Cybersecurity induction awareness sessions, 4 simulating quarterly phishing exercises, 11 online awareness campaigns, and 137 new-hire training sessions.

These initiatives collectively foster a culture where employees recognize their role in safeguarding the organization. Moreover, the division is keen to continuously update its internal controls. This year, the team reviewed or created 79 documents to govern Cybersecurity practices in CATRION and updated online privacy statements for transparency. The cybersecurity department also partnered with internal departments (IT, BCM, Audit) and external vendors to ensure synergy in implementing advanced cybersecurity solutions.

Cybersecurity
by Numbers

0

impactful incidents affecting
CATRION information
or technical assets

+21

advanced security
tools or solutions
in operation

246

of change
requests reviewed

3,174

hours of training
and awareness delivered
to CATRION employees

79

documents reviewed or
created to govern CS
practices in CATRION

28

Cybersecurity physical
location inspection
audits carried out

3,035

suspected phishing
emails reported
by CATRION employees

24

CATRION Cybersecurity
Standard implementation checks
against the NCA ECC Framework

1,224

CATRION employees participated
in Phishing simulations

3

roadmaps defined in relation
to data privacy,
data classification,
and data leakage prevention

81%

of record of processed
activities were documented

15

Data Protection Impact
Assessments (DPIAs)
have been completed

100%

completion of
planned privacy
training sessions

Value Creation & Alignment
with Vision 2030

By reducing vulnerability exposures, ensuring compliance, and training employees to uphold best practices, Cybersecurity played a decisive role in protecting shareholder value and sustaining market confidence.

These efforts underpinned CATRION’s strategic alignment with Vision 2030 by reinforcing a secure digital backbone, essential for economic diversification and a thriving digital economy.

As part of its next phase, the department will expand AI usage for threat analysis, enhance data governance with automated compliance checks, and further integrate privacy measures into everyday business processes. This roadmap safeguards not just the daily operations but the integrity and reputation CATRION depends on to grow sustainably.

NEXT Read

IT Systems & Infrastructure Upgrades

Meet CATRION

Towards New Horizons

Delivering Excellence

Our Governance

Financial Statements

Cybersecurity &
Data Protection

“Today, protecting CATRION’s critical assets and data is fundamental. By integrating robust cybersecurity measures into every business function, we ensure operational resilience, build stakeholder trust, and drive sustainable growth.”

— Director of Cybersecurity

Mirroring IT’s transformational vision, the Cybersecurity department dedicated 2024 to strengthening CATRION’s cyber resilience,

through increasing and consolidating its continuing compliance with both the National Cybersecurity Authority (NCA) standards and the Personal Data Protection Laws (PDPL), as well as aligning with international best practices.

Operating under a mission to protect confidentiality, integrity, and availability across all technological layers, the department aligned each initiative with overarching business objectives, risk management imperatives, and the ongoing push toward digital transformation.

A Year of Resilience and Protection

Enhanced Threat Detection & Response

Compliance and Data Privacy

CATRION also prioritized protecting data privacy, introducing a Data Privacy Policy and systematic processes such as the Record of Processing Activities (RoPA) and Data Protection Impact Assessments (DPIAs) to meet both national regulations and international standards.

Also, to facilitate asset protection, the IT department ensured comprehensive tracking of all new IT assets through Asset Inventory Onboarding, reinforcing control over potential vulnerabilities.

Ongoing Risk Management and Governance

Additionally, to improve incident response, the Outsourced Security Operations Center (SOC) provided 24/7 monitoring, handling procedures like processing Haseen threat notifications (109 this year) and safeguarding critical infrastructure.

Fostering a Secure Culture

Complementing these technical safeguards, the department ramped up security awareness, implementing and conducting ongoing Cybersecurity induction awareness sessions, 4 simulating quarterly phishing exercises, 11 online awareness campaigns, and 137 new-hire training sessions.

Cybersecurity
by Numbers

0

+21

246

3,174

79

28

3,035

24

1,224

3

81%

15

100%

Value Creation & Alignment
with Vision 2030

By reducing vulnerability exposures, ensuring compliance, and training employees to uphold best practices, Cybersecurity played a decisive role in protecting shareholder value and sustaining market confidence.

CATRION

Cybersecurity & Data Protection

“Today, protecting CATRION’s critical assets and data is fundamental. By integrating robust cybersecurity measures into every business function, we ensure operational resilience, build stakeholder trust, and drive sustainable growth.”

— Director of Cybersecurity

Mirroring IT’s transformational vision, the Cybersecurity department dedicated 2024 to strengthening CATRION’s cyber resilience,

through increasing and consolidating its continuing compliance with both the National Cybersecurity Authority (NCA) standards and the Personal Data Protection Laws (PDPL), as well as aligning with international best practices.

Operating under a mission to protect confidentiality, integrity, and availability across all technological layers, the department aligned each initiative with overarching business objectives, risk management imperatives, and the ongoing push toward digital transformation.

A Year of Resilience and Protection

Enhanced Threat Detection & Response

Compliance and Data Privacy

CATRION also prioritized protecting data privacy, introducing a Data Privacy Policy and systematic processes such as the Record of Processing Activities (RoPA) and Data Protection Impact Assessments (DPIAs) to meet both national regulations and international standards.

Also, to facilitate asset protection, the IT department ensured comprehensive tracking of all new IT assets through Asset Inventory Onboarding, reinforcing control over potential vulnerabilities.

Ongoing Risk Management and Governance

Additionally, to improve incident response, the Outsourced Security Operations Center (SOC) provided 24/7 monitoring, handling procedures like processing Haseen threat notifications (109 this year) and safeguarding critical infrastructure.

Fostering a Secure Culture

Complementing these technical safeguards, the department ramped up security awareness, implementing and conducting ongoing Cybersecurity induction awareness sessions, 4 simulating quarterly phishing exercises, 11 online awareness campaigns, and 137 new-hire training sessions.

Cybersecurity by Numbers

0

+21

246

3,174

79

28

3,035

24

1,224

3

81%

15

100%

Value Creation & Alignment with Vision 2030

By reducing vulnerability exposures, ensuring compliance, and training employees to uphold best practices, Cybersecurity played a decisive role in protecting shareholder value and sustaining market confidence.

CATRION

Cybersecurity &
Data Protection

Cybersecurity
by Numbers

Value Creation & Alignment
with Vision 2030