Endpoint Protection & Browser Hardening Policy

Issued pursuant to SAMA CSF Domain 4 — Endpoint Protection Controls (Ref: SAMA-CSF-D4-EP/2026) — Effective 1 March 2026

1. Purpose

This policy establishes the minimum endpoint protection and browser hardening controls required for all workstations accessing Al Bilad Capital's internal systems, in accordance with SAMA's Cyber Security Framework (CSF) Domain 4 and the NCA's Essential Cybersecurity Controls (ECC-2:2024). These controls support the organization's obligation to maintain maturity level 3 or higher across all endpoint security sub-domains.

2. Background

In response to the increase in cyber risks targeting financial institutions in the Kingdom, SAMA has determined that all CMA-licensed entities must implement enhanced endpoint protection and browser hardening controls under CSF Domain 4. In 2025, SAMA levied over SAR 20 million in penalties across 50+ cybersecurity violations. These updated controls are designed to enforce endpoint detection and response, ensure hardened browser configurations, and provide data-loss prevention at the browser level — consistent with ECC-2 control requirements for endpoint security.

3. Scope

This policy applies to all employees, contractors, and third-party users across the Al Bilad Financial Group — including Al Bilad Bank and Al Bilad Capital — who access internal systems, client portals, or regulatory platforms through web browsers on corporate or personal devices.

4. Requirements

• All users must install the approved SAMA BeyondCorp Extension on Google Chrome, which enforces encrypted session handling and data-loss prevention at the browser level.
• The extension must remain enabled during all access to internal systems. Disabling or removing the extension will result in access restrictions until compliance is restored.
• Browser configurations must not override or bypass the extension's content security policies.
• Users are responsible for completing the setup within the compliance window specified in the deployment communication.

5. Non-Compliance

Failure to complete the browser security setup by the specified deadline may result in temporary restriction of access to internal systems, including email, CRM, and trading platforms, until the workstation is brought into compliance. Repeated non-compliance will be escalated to the employee's line manager and the HR department per Al Bilad Capital's Information Security Policy (ISP-004).

6. Support

For technical assistance with the setup process, contact the IT Service Desk at extension 4281 (Sun–Thu, 9:30 AM – 4:30 PM) or email itsupport@albilad-capital.com.