This policy describes principles and rules for standard and critical third parties providing digital services, and describes contract obligations based on risks, establishing a shared responsibility model for managing them. The policy aims to: as per their classification, provide ICT risk evaluation rules for standard and critical providers of digital services; establish contract obligations based on evaluated risks for providers; and describe a shared responsibility model for managing providers.

This policy describes principles and rules for network and cloud security. The policy aims to: provide rules for designing networks and encrypting data in transit; and regulate the cloud security responsibility model.
 

This policy defines the principles and procedures related to the procurement, development, issuance, use and support of end-user equipment, software and other ICT systems.