Discuss an engagement
MenuClose

Security testing rules, United States and the Gulf.

What 71 US and Gulf rules require of banks and government bodies: who must test, how often, who may test, and which seams the test must cross. Every code cites its source. Reviewed October 30, 2026.

Compare every rule Download as CSV
Oil painting of a walled city at night across a dry moat. The great gate is shut and dark, and a small side door beside it stands open, lamplight spilling onto the stones.
71

US and Gulf testing rules coded on 17 dimensions, 67 read in full, 2 in part and 2 with no public text, plus 13 international benchmarks1

7 of 71

US and Gulf rules that require threat intelligence to shape the test. In one, the firm first decides whether a test is needed1

7 of 71

US and Gulf rules that require a test of people, such as social engineering. In one, the firm first decides whether a test is needed1

1 of 71

US and Gulf rules that require a physical intrusion test1

By country.

The short answer for each state, from its rules as coded. Each page gives every rule in full, with the clause and the quote behind each code.

United States

Yes for most regulated firms and federal agencies, on different cycles. New York and the FTC require an annual penetration test, federal bank rules leave the interval to risk, and no US financial rule requires threat-led red teaming.

19 rules coded

Saudi Arabia

Yes. NCA and SAMA rules require penetration tests, from every three months for the most critical OT facilities and every six months for critical systems to once a year for internet-facing services, and SAMA’s FEER framework calls for a threat-led red team test of each financial institution at least every three years.

10 rules coded

United Arab Emirates

Yes. The DFSA and ADGM’s FSRA require tests at least once a year for internet-facing systems, and the Capital Market Authority, for virtual asset firms, for internet-connected systems. The Central Bank’s operational risk regulation requires periodic testing with no interval, and an independent penetration test of critical functions.

10 rules coded

Qatar

Yes. Qatar Central Bank requires banks, insurers and payment service providers to run penetration tests twice a year, and payment firms and financial services operators must use an external provider. NCSA accredits penetration testing providers on a voluntary basis.

9 rules coded

Bahrain

Yes. The Central Bank of Bahrain requires banks to run penetration tests at least twice a year by certified testers, who should be changed at least every two years, and to send every report to the CBB. It can also order red teaming.

9 rules coded

Kuwait

Yes. The Central Bank of Kuwait’s CORF, which covers banks and the other firms it regulates, requires red teaming at least once a year with scenarios shaped by threat intelligence, and annual penetration tests of IoT and OT.

3 rules coded

Oman

Yes. The Central Bank of Oman requires annual penetration tests of internet-facing systems and, under a January 2026 framework, a threat-led penetration test or red team exercise of critical systems at least every three years. Government assessments must use accredited providers. The Cyber Defence Centre has run that accreditation in place of MTCIT since August 9, 2026.

11 rules coded

Every rule compared

All 84 rules side by side, benchmarks included: legal force, cycle, threat intelligence, testers, the seams, replay, retest, the regulator’s role and automation.

84 rules

To have your own program checked against the rules that apply to you, see regulated work.

Where the rules stop.

Attackers move from people to systems, from suppliers to their customers and from buildings into networks. A rule counts as Required only when it makes the tester cross that seam. 43 of the 69 US and Gulf rules with public text require none of these five. The CBUAE retail payment services regulation counts as Required for people, though its firms test only when they find a test necessary.1,2

71 US and Gulf rules, by what each says about the seam. Benchmarks are on the comparison page.
Seam RequiredControls tested or supplier assurance onlyPermittedExcludedNot addressedText not public
Human 7 US 3, Gulf 4 6 17 0 39 2
Physical 1 US 0, Gulf 1 14 5 0 49 2
Supplier 17 US 8, Gulf 9 24 6 0 22 2
OT 5 US 2, Gulf 3 0 2 1 61 2
Cloud and SaaS 5 US 3, Gulf 2 7 12 0 45 2

Cross-border: 27 of 71 US and Gulf rules address it, by reaching foreign branches, affiliates or systems abroad, or by limiting where testers and others with access to the systems sit. A rule that only fixes where data is hosted does not count. None provides for a joint test or recognizes a specific test run elsewhere. The OCC’s GENIUS Act rule exempts foreign issuers whose home regime the Treasury finds comparable, and CBB lets foreign bank branches rely on head office functions with its approval. 10 of the 13 benchmarks address it.1

Reading the codes.

Each rule is coded on 17 dimensions from the regulator’s own text. Each cell carries a code, a one-line detail, the clause it rests on and, where the text is public and the code is not Not addressed, a quote of 50 words or fewer.

Codes

Required
The rule uses mandatory language such as “must” or “shall”. Where a whole text is guidance, Required is its own expectation, and legal force shows that it does not bind. For a seam, Required means the tester must cross it.
Recommended
The text advises it, with “should” or similar wording.
Permitted
The text allows it or lists it as an option or example.
Controls tested, seam not crossed
The rule requires testing of physical or people-reliant controls, but no intrusion or social engineering. Nobody has to try the door.
Supplier assurance only
The firm must get assurance about a supplier: contract rights to audit or test, the supplier’s own reports, audits or joint resilience tests. Supplier systems stay outside the firm’s own test.
Excluded
The text puts it outside the scope of the test.
Not addressed
We read the full text and it is silent. The citation records the terms we searched.
Addressed
Used for cross-border and for automation and AI: the text deals with it.
Text not public
The controlling text is not published, so the cell cannot be coded.

The 17 dimensions

Legal force
Mandatory, a supervisory expectation, voluntary, or mixed: binding rules beside guidance, or a voluntary scheme a regulator can require.
Who is covered
The firms or bodies the testing duty applies to.
How often
The minimum cycle for the strictest test the rule sets.
Threat intelligence
Whether intelligence on real attackers must shape the scenarios or scope.
Tester requirements
Accreditation, certification, qualification or independence rules for testers.
In-house testers
Whether the firm’s own staff may run the test: allowed, allowed with conditions such as independence from the systems tested, or not allowed.
Human seam
Whether the test must reach people, through social engineering.
Physical seam
Whether the test must reach buildings and physical access.
Supplier seam
Whether systems a supplier runs fall inside the test.
Operational technology
Industrial control and building systems in the test scope.
Payment systems
Payment, card, SWIFT or market infrastructure in the test scope.
Cloud and SaaS
Cloud and software-as-a-service tenancies in the test scope.
Cross-border
Foreign branches, offshore testers, residency limits or recognition of tests run elsewhere.
Purple team or replay
A joint session in which testers and defenders replay the attack.
Remediation and retest
Remediation plans, deadlines and retests of findings.
Regulator role
Whether the regulator leads or oversees the test, receives results, or examines testing in supervision without routine reports.
Automation and AI
Any mention of automated, continuous or AI-driven testing, or of testing AI systems.

Codes describe what a text says, not how a supervisor applies it. A federal regulation, an examiner booklet and an accreditation standard each count as one rule, so read counts as numbers of texts, not as a measure of how strict a country is.

How this relates to The Seam Report.

This section is the maintained successor to chapter 9 of The Seam Report 2026, which analyzed testing rules as they stood on September 28, 2026.2

Same method
The same 17 dimensions and codes, applied to each regulator’s own text. Nine coding rules written on October 30, 2026 settle questions the September coding left open, such as what counts as a cross-border provision, so that like texts get like codes in every country.
Rechecked
On October 30, 2026 we read 49 of the 50 rules of the September coding against their sources again, and corrected cells where a second reading, or one of the coding rules, found the first one wrong. The change log below lists each one. UAE IA Standard v2.1 could not be reached, so it stays as coded in September.
Rows added
We added 34 rules: 7 US, 23 Gulf and 4 benchmarks. OCC GENIUS Act rule (12 CFR 15) and SG MAS AI risk management guidelines were issued after September 28, 2026. The others were in force earlier and were missed by the first coding.
The report’s numbers
The report’s counts describe its September set and stay as published. The counts on these pages are current, so they differ: for example, the report found two Gulf central banks that require threat-led testing, and Oman’s central bank framework of January 2026 makes three.
The data
Every rule, cell, quote and source is in data.json, and one row per rule and dimension in regimes.csv.

What changed.

Rules this section tracks and changes to the data, newest first.

  1. We published this section: 71 US and Gulf testing rules and 13 international benchmarks, each coded on 17 dimensions. All but UAE IA Standard v2.1 were read against their sources on October 30, 2026.1

  2. Rechecked 49 of the 50 rows of the September coding against their sources: 47 unchanged, 1 amended, 1 superseded. Not reachable, so kept as coded in September: UAE IA Standard v2.1.3,4,5

  3. Added 7 US rules: OCC GENIUS Act rule (12 CFR 15), FHFA information security bulletins, FCA cyber risk management rule, Fed Regulation HH (designated FMUs), SEC Regulation SE system safeguards, IRS Pub 1075 and CMS ARC-AMPE. OCC GENIUS Act rule (12 CFR 15) was issued after September 28, 2026. The others were issued earlier and missed by the first coding.6,7,8,9,10,11,12

  4. Added 4 Saudi rules: CMA Cybersecurity Guidelines, NCA CCC-2:2024, NCA TCC-1:2021 and SAMA IPO Rules. All were issued earlier and missed by the first coding.13,14,15,16

  5. Added 3 UAE rules: CMA VASP and ATS Regulation 2026, CBUAE retail payment systems regulation and CBUAE electronic insurance regulations. All were issued earlier and missed by the first coding.17,18,19

  6. Added 1 Qatari rule: NCSA vulnerability management guidelines. It was issued earlier and missed by the first coding.20

  7. Added 5 Bahraini rules: CBB GR-12.2 payments and open banking, CBB CRA-5.8 crypto-asset, CBB SIO-9.6 stablecoin issuers, CBB RM-3 money changers and CBB OM-5.2 financing companies. All were issued earlier and missed by the first coding.21,22,23,24,25

  8. Added 1 Kuwaiti rule: CBK e-payment cyber minimum. It was issued earlier and missed by the first coding.26

  9. Added 9 Omani rules: CBO BCM framework, CBO open banking framework, CBO PSP licensing policy, CBO BNPL framework, CBO digital bank framework, FSA listed company guidelines, CDC external cloud policy, MTCIT managed services standards and MTCIT government mobile app standards. All were issued earlier and missed by the first coding.27,28,29,30,31,32,33,34,35

  10. Added 4 benchmarks: SG CSA CCoP 2026, SG MAS AI risk management guidelines, AU APRA AI letter 2026 and AU SOCI SoNS tests. SG MAS AI risk management guidelines was issued after September 28, 2026. The others were issued earlier and missed by the first coding.36,37,38,39

  11. Corrected 18 cells of the September coding, after a second reading of the texts and to apply the same coding rules in every country. CFTC system safeguards, Human seam: from Not addressed to Controls tested, seam not crossed. FedRAMP Rev5 (legacy), Cross-border: from Addressed to Not addressed. FedRAMP CR26 / 20x, Threat intelligence: from Recommended to Not addressed. SAMA CSF, Cloud and SaaS: from Not addressed to Supplier assurance only. NCSC national baseline controls, Supplier seam: from Not addressed to Supplier assurance only. NCSC national baseline controls, Cloud and SaaS: from Not addressed to Supplier assurance only. QCB technology risks for banks, Cross-border: from Not addressed to Addressed. QCB insurance cyber regulation, Payment systems: from Required to Not addressed. QCB insurance cyber regulation, Cross-border: from Not addressed to Addressed. QFCRA CTRL 8.5, Who is covered: from QFC authorised firms to QFC authorised firms except wholesale advisory firms. QFCRA CTRL 8.5, Cross-border: from Not addressed to Addressed. CBUAE operational risk regulation, Payment systems: from Required to Not addressed. DFSA GEN 5.5 (DIFC), Human seam: from Permitted to Controls tested, seam not crossed. DFSA GEN 5.5 (DIFC), Cross-border: from Not addressed to Addressed. ADGM FSRA GEN 3.5, Cross-border: from Not addressed to Addressed. Dubai DESC ISR, Who is covered: from Dubai Government Entities to Dubai Government Entities and DESC-classified Critical Non-government Entities. Dubai DESC ISR, Regulator role: from Text not public to Examines in supervision. SG ABS AASE, Cross-border: from Addressed to Not addressed.3,40,41,42,43,44,45,46,47,48,49,50,51

  12. Two proposed changes did not pass review. A row for the European Supervisory Authorities’ statement of July 31, 2026 on ICT risks from frontier AI models was left out: it encourages firms and lists testing only as actions to consider. A recode of the SAMA CSF cross-border cell was rejected, since its cloud location clause is a data location rule, not a testing rule.43,52

  13. A row for the CBUAE’s guidance note of February 11, 2026 on AI and machine learning was left out. Its tests are bias tests, model stress tests and validation, and tests of automatic updates, none of them a security test. Its security content is reviews, including annual cybersecurity reviews of AI providers, which the coding rules do not count as tests, so we cite it as related guidance.53

  14. Dubai’s DESC Cyber Force register listed 33 penetration testing companies and 82 individuals, against 32 and 77 on September 28. Three of the 33 listings showed expiry dates before October 30.50

  15. Saudi Arabia’s NCA posted CSCC-2:2026 on its Arabic CSCC page, replacing CSCC-1:2019. The document gives only its year of issue. Critical systems are still penetration tested at least every six months by a qualified team. Critical systems are now identified through NCA’s Haseen portal.4

    Previously: Critical Systems Cybersecurity Controls CSCC-1:2019.

  16. The OCC issued its final GENIUS Act rule for payment stablecoin issuers, 12 CFR part 15. It requires periodic independent testing and takes effect on January 18, 2027.6

  17. The Monetary Authority of Singapore finalized its AI risk management guidelines. They take effect on October 7, 2027.37

  18. The Seam Report 2026 published its analysis of 50 testing regimes as of September 28, 2026, chapter 9. This section continues it.2

  19. The CBUAE’s Operational Risk Management Regulation, C 1/2026, took effect. It requires an independent third-party penetration test of critical functions.47

  20. Bahrain’s NCSC issued Decision No. 36 of 2026, mandatory cybersecurity standards for critical sectors. Its Annex 1 is not public.54

  21. FedRAMP’s Consolidated Rules 2026 became optional for cloud providers. They become mandatory on January 1, 2027.42

  22. QFCRA rule change RM/2026-1 took wholesale advisory firms out of the ICT risk rules in CTRL Part 8.5.3

  23. Kuwait’s NCSC Decision No. 2 of 2026, national baseline controls, was published in the official gazette, with 18 months to comply.44

  24. The UAE Capital Market Authority’s regulation for virtual asset service providers took effect, with resilience testing at least once a year for internet-connected systems.17

  25. The CBUAE issued its guidance note on AI and machine learning, with yearly bias tests and independent cybersecurity reviews of AI providers.53

  26. ADGM’s FSRA cyber risk rules, GEN 3.5, came into force, with testing at least once a year for internet-facing systems.49

  27. The Central Bank of Oman issued its business continuity framework, with a threat-led penetration test or red team exercise of critical systems at least every three years.27

  28. The Central Bank of Kuwait issued CORF v1.0, with red teaming at least once a year.55

  29. QFCRA’s ICT and information security risk rules, CTRL Part 8.5, took effect.3

  30. The FFIEC retired its voluntary Cybersecurity Assessment Tool.56

  31. The SEC withdrew its proposed Regulation SCI amendments, which would have made penetration testing annual for SCI entities.57

What we are watching.

We check these every week. When one lands, it goes into the pages and the change log above, with the date.

29 items, dated ones first
What Expected Where we look
FedRAMP Consolidated Rules 2026 become mandatory; no new Rev5 certifications after June 11, 2027 January 1, 2027 FedRAMP rules repository, timeline and effective dates
CBO outsourcing circular BM 1234 takes effect. It sets no security testing duty; check whether CBO pairs it with supplier testing instructions January 1, 2027 CBO circulars (cbo.gov.om)
The OCC’s GENIUS Act rule, 12 CFR part 15, takes effect for payment stablecoin issuers January 18, 2027 Federal Register and eCFR title 12 part 15
Full compliance deadline for Kuwait’s NCSC baseline controls, 18 months from gazette publication by our count October 5, 2027 Kuwait Al-Youm gazette index and ncsc.gov.kw
Repeal date of the FedRAMP Authorization Act unless Congress extends it December 23, 2027 44 U.S.C. 3607 notes and congress.gov, including the FY2027 NDAA
Final FDIC, NCUA and Federal Reserve GENIUS Act rules for the stablecoin issuers each supervises Checked weekly Federal Register
IRS Publication 1075 Rev. 12-2026, now an early release draft that keeps the three-year penetration test of the federal tax information environment Checked weekly irs.gov Safeguards program and draft forms
NIST SP 800-82r4, guide to OT security, final after the September 21, 2026 draft Checked weekly NIST CSRC publications
NCA licensing framework for cybersecurity services (RFCS-1:2026), which would license penetration testing and red teaming Checked weekly NCA public consultations and regulatory documents (nca.gov.sa)
NCA AI Cybersecurity Guidelines (AICG-1:2026), final text Checked weekly NCA public consultations (nca.gov.sa)
English text of NCA CSCC-2:2026 Checked weekly NCA English CSCC page
DFSA final operational resilience rules (CP170), with scenario testing of critical business services Checked weekly DFSA consultation papers and the GEN module
CBUAE standards under the Operational Risk Management Regulation, which could set a test interval or tester rules Checked weekly CBUAE Rulebook, risk management section
DESC classification of critical non-government entities and certification rules under Dubai Law No. 15 of 2024 Checked weekly Dubai Official Gazette and desc.gov.ae regulations
A UAE IA Standard edition after v2.1, which we could not rule out while csc.gov.ae was unreachable Checked weekly csc.gov.ae policies listing
A revised NCSA accreditation standard or recognition route after NCSA’s memorandum with CREST International Checked weekly NCSA publications and news (ncsa.gov.qa)
An NCSA scheme for OT cybersecurity assessments Checked weekly NCSA publications and news (ncsa.gov.qa)
QFMA’s adoption decision and official publication date for the NIA controls for market participants Checked weekly QFMA legal decisions library
Publication of Annex 1 of Bahrain NCSC Decision 36/2026, or retirement of the 2022 baseline Checked weekly NCSC standards and controls pages (ncsc.gov.bh)
Licensing of cybersecurity service providers in Bahrain, planned in the national strategy for 2025 to 2028 Checked weekly NCSC executive decisions (ncsc.gov.bh)
The CBB Payment Service Requirements Module, consulted on in February 2026 Checked weekly CBB consultations and the Volume 5 rulebook
CBK’s final open banking framework and any API security testing it sets Checked weekly CBK press releases and instructions (cbk.gov.kw)
CBK instructions on approval of external CORF assessors for exchange and payment companies Checked weekly CBK instruction compendia for exchange companies and e-payment firms
CBO licensing and emergency policies adopted by its board but not yet published Checked weekly CBO news and circulars (cbo.gov.om)
Whether MTCIT still accredits cloud providers that serve government under its Cloud and Hosting Services Standard (GC_S2), now that MTCIT says regulating cloud hosting has moved to the TRA. We hold the standard out of the set until this is clear Checked weekly MTCIT accreditation program page and the TRA legal library
FSA instructions under the securities law executive regulations, which could add testing rules for capital market firms Checked weekly FSA legislation encyclopedia (e.fsa.gov.om)
HKMA Cyber Resilience Testing Framework for banks Checked weekly HKMA circulars and the Cybersecurity Fortification Initiative page
CSA technical guidance for the Singapore CCoP on adversarial attack simulation and penetration testing Checked weekly CSA codes of practice page
Bank of England and PRA consultation on cyber and ICT risk management Checked weekly PRA consultation papers

The data.

Everything in this section is one dataset. Each review will be archived here under its date, so a citation can point to the version it used.

Current version (JSON)
Reviewed October 30, 2026. It holds every statement, table row, term and source on these pages.

Sources.

Primary sources unless marked. Each shows the date we last opened it and confirmed what we cite.

  1. 1
    Security testing rules dataset, Bendings, reviewed October 30, 2026 Checked October 30, 2026.
  2. 2
    The Seam Report 2026, Bendings, chapter 9: testing rules stop at the seams attackers cross, data as of September 28, 2026 Checked October 30, 2026.
  3. 3
    Governance and Controlled Functions Rules 2020 (CTRL), Part 8.5 ICT and information security risks (with Parts 8.3 and 8.4), Qatar Financial Centre Regulatory Authority (QFCRA) Checked October 30, 2026.
  4. 4
    Critical Systems Cybersecurity Controls (CSCC-2:2026), National Cybersecurity Authority (NCA) Checked October 30, 2026.
  5. 5
    UAE Information Assurance Standard, UAE Cyber Security Council (CSC) Checked September 28, 2026.
  6. 6
    Implementing the Guiding and Establishing National Innovation for U.S. Stablecoins Act for the Issuance of Stablecoins by Entities Subject to the Jurisdiction of the Office of the Comptroller of the Currency, final rule, 12 CFR part 15 (91 FR 67000, Oct. 23, 2026), Office of the Comptroller of the Currency (OCC) Checked October 30, 2026.
  7. 7
    FHFA Advisory Bulletin AB 2017-02, Information Security Management (Sept. 28, 2017), with AB 2023-02, Supplemental Guidance to AB 2017-02 (Jan. 13, 2023), Federal Housing Finance Agency (FHFA) Checked October 30, 2026.
  8. 8
    Farm Credit Administration, Cyber Risk Management, 12 CFR 609.930 (final rule 88 FR 85825, Dec. 11, 2023; effective Jan. 1, 2025), Farm Credit Administration (FCA) Checked October 30, 2026.
  9. 9
    Regulation HH, Designated Financial Market Utilities, 12 CFR 234.3(a)(17) operational risk standard, as amended 89 FR 18749 (Mar. 15, 2024), Board of Governors of the Federal Reserve System Checked October 30, 2026.
  10. 10
    Regulation SE, Core Principle 13, System safeguards for security-based swap execution facilities, 17 CFR 242.830 (adopted 88 FR 87156, Dec. 15, 2023; effective Feb. 13, 2024), U.S. Securities and Exchange Commission (SEC) Checked October 30, 2026.
  11. 11
    Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (Rev. 11-2021), Internal Revenue Service, Office of Safeguards Checked October 30, 2026.
  12. 12
    Acceptable Risk Controls for ACA, Medicaid, and Partner Entities (ARC-AMPE), Volume I v1.02 and Volume II ACA Administering Entities Mandatory Baseline v1.02, Centers for Medicare & Medicaid Services, Center for Consumer Information and Insurance Oversight Checked October 30, 2026.
  13. 13
    Cybersecurity Guidelines for Capital Market Institutions, Capital Market Authority (CMA) Checked October 30, 2026.
  14. 14
    Cloud Cybersecurity Controls (CCC-2:2024), National Cybersecurity Authority (NCA) Checked October 30, 2026.
  15. 15
    Telework Cybersecurity Controls (TCC-1:2021), National Cybersecurity Authority (NCA) Checked October 30, 2026.
  16. 16
    Initial Public Offering (IPO) Rules for Receiving and Lending Banks, Saudi Central Bank (SAMA) Checked October 30, 2026.
  17. 17
    The Regulation Concerning Virtual Assets Service Providers and the Alternative Trading System Operator (Chairman's Resolution No. (04/Chairman) of 2026), Capital Market Authority (CMA), formerly the Securities and Commodities Authority (SCA) Checked October 30, 2026.
  18. 18
    Retail Payment Systems Regulation (C 10/2020), Article (8): Ongoing Requirements of Designated Retail Payment Systems, Central Bank of the UAE (CBUAE) Checked October 30, 2026.
  19. 19
    Insurance Authority Board of Directors' Resolution No. (18) of 2020 Concerning the Electronic Insurance Regulations, Central Bank of the UAE (CBUAE); issued by the former Insurance Authority Checked October 30, 2026.
  20. 20
    Qatar National Vulnerability Management Guidelines [IAG-NAT-VMG] V1.0, National Cyber Security Agency (NCSA) Checked October 30, 2026.
  21. 21
    CBB Rulebook Volume 5 (Specialised Licensees), Type 7 Ancillary Service Providers: Module GR Section GR-12.2 Cyber Security Risk Management, with Module OB (Open Banking) Section OB-1.1, Central Bank of Bahrain (CBB) Checked October 30, 2026.
  22. 22
    CBB Rulebook Volume 6 (Capital Markets), Module CRA Crypto-Asset, Chapter CRA-5 Technology Governance and Cyber Security (Section CRA-5.8 Cyber Security), Central Bank of Bahrain (CBB) Checked October 30, 2026.
  23. 23
    CBB Rulebook Volume 6 (Capital Markets), Module SIO Stablecoin Issuance & Offering, Chapter SIO-9 Technology Governance & Cyber Security (Section SIO-9.6 Cyber Security), Central Bank of Bahrain (CBB) Checked October 30, 2026.
  24. 24
    CBB Rulebook Volume 5 (Specialised Licensees), Type 1 Money Changers, Module RM Money Changers Risk Management, Chapter RM-3 Cyber Security Risk Management, Central Bank of Bahrain (CBB) Checked October 30, 2026.
  25. 25
    CBB Rulebook Volume 5 (Specialised Licensees), Type 3 Financing Companies, Module OM Operational Risk Management, Section OM-5.2 Internet Security (with BR-1.6), Central Bank of Bahrain (CBB) Checked October 30, 2026.
  26. 26
    Instructions on Minimum Cybersecurity and Business Continuity Requirements for E-Payment Service Providers and E-Money Service Providers (CBK Circular No. (2/PS/527/2023)), Central Bank of Kuwait (CBK) Checked October 30, 2026.
  27. 27
    Business Continuity Management Framework (Annexure to Circular BM 1225 of 6 January 2026), Central Bank of Oman (CBO) Checked October 30, 2026.
  28. 28
    Open Banking Regulatory Framework, with Annexure 3 Open Banking Data and Information Security Specification (issued with Circular BM 1219 of 4 June 2025), Central Bank of Oman (CBO) Checked October 30, 2026.
  29. 29
    Licensing Policy for Payment Service Providers (PSPs) & Ancillary Payment Service Activities in the Sultanate of Oman (Version 1.01, June 2023), issued with Circular BM 1192, Central Bank of Oman (CBO) Checked October 30, 2026.
  30. 30
    Licensing & Regulatory Framework for Buy Now Pay Later (BNPL) in the Sultanate of Oman, Central Bank of Oman (CBO) Checked October 30, 2026.
  31. 31
    Regulatory Framework for Digital Banks in the Sultanate of Oman, Central Bank of Oman (CBO) Checked October 30, 2026.
  32. 32
    Circular No. E/1/2022 Issuing Information Security Guidelines for Public Joint Stock Companies, Financial Services Authority (FSA); issued by its predecessor, the Capital Market Authority Checked October 30, 2026.
  33. 33
    Policy and controls for using external cloud computing services, with Annex 1, minimum security and technical requirements (Version 1, 27 March 2025), Cyber Defence Centre (CDC) Checked October 30, 2026.
  34. 34
    Ministerial Circular No. (7/2025) on Administrative Standards for Managed Services (Technical Support, Infrastructure, Information Systems), Ministry of Transport, Communications and Information Technology (MTCIT) Checked October 30, 2026.
  35. 35
    Ministerial Circular No. (19/2023) on Basic Standards for Developing Government Applications on Mobile and Smart Devices 2023, Ministry of Transport, Communications and Information Technology (MTCIT) Checked October 30, 2026.
  36. 36
    Cybersecurity Code of Practice for Critical Information Infrastructure 2026 (CCoP 2026, Release 1), Cyber Security Agency of Singapore (Commissioner of Cybersecurity) Checked October 30, 2026.
  37. 37
    Guidelines on Artificial Intelligence Risk Management, Monetary Authority of Singapore (MAS) Checked October 30, 2026.
  38. 38
    APRA Letter to Industry on Artificial Intelligence (AI), with attachment 'AI Supervisory Engagement Debrief: Observations for Executive Management', Australian Prudential Regulation Authority (APRA) Checked October 30, 2026.
  39. 39
    Security of Critical Infrastructure Act 2018 (Cth), Part 2C Divisions 3 and 4: cyber security exercises and vulnerability assessments for systems of national significance, Department of Home Affairs (the Secretary gives notices); Minister for the Act declares systems of national significance (s. 52B) Checked October 30, 2026.
  40. 40
    CFTC system safeguards testing requirements for designated contract markets, swap execution facilities, derivatives clearing organizations and swap data repositories (17 CFR 38.1051, 37.1401, 39.18, 49.24), U.S. Commodity Futures Trading Commission Checked October 30, 2026.
  41. 41
    FedRAMP Rev5 security controls baselines (legacy) and FedRAMP Penetration Test Guidance, General Services Administration, FedRAMP Program Management Office Checked October 30, 2026.
  42. 42
    FedRAMP Consolidated Rules for 2026 (Rev5 and 20x rulesets), General Services Administration, FedRAMP Checked October 30, 2026.
  43. 43
    Cyber Security Framework, Saudi Central Bank (SAMA; issued as Saudi Arabian Monetary Authority) Checked October 30, 2026.
  44. 44
    Kuwait National Basic Cybersecurity Controls (Annex 1 to NCSC Decision No. 2 of 2026), National Cyber Security Center (NCSC), State of Kuwait Checked October 30, 2026. Secondary copy; the primary source could not be reached.
  45. 45
    Technology Risks (QCB cyber security circular for banks), Qatar Central Bank (QCB) Checked October 30, 2026.
  46. 46
    Insurance Sector Cyber Security Regulation, Qatar Central Bank (QCB) Checked October 30, 2026.
  47. 47
    Operational Risk Management Regulation (Circular C 1/2026), Central Bank of the UAE (CBUAE) Checked October 30, 2026.
  48. 48
    DFSA Rulebook General Module (GEN) section 5.5 Cyber risk management, Dubai Financial Services Authority (DFSA), Dubai International Financial Centre Checked October 30, 2026.
  49. 49
    FSRA General Rulebook (GEN) Rule 3.5 Cyber Risk Management, with the FSRA Information Technology Risk Management Guidance, Financial Services Regulatory Authority (FSRA), Abu Dhabi Global Market Checked October 30, 2026.
  50. 50
    Dubai Government Information Security Regulation (ISR), Dubai Electronic Security Center (DESC) Checked October 30, 2026.
  51. 51
    Red Team: Adversarial Attack Simulation Exercise Guidelines for the Financial Industry in Singapore, The Association of Banks in Singapore (ABS), Standing Committee for Cyber Security Checked October 30, 2026.
  52. 52
    Regulation (EU) 2022/2554 (Digital Operational Resilience Act) Articles 24 to 27, with Commission Delegated Regulation (EU) 2025/1190 (RTS on threat-led penetration testing), European Parliament and Council (DORA); European Commission (RTS, drafted by EBA, EIOPA and ESMA in agreement with the ECB) Checked October 30, 2026.
  53. 53
    Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., Central Bank of the UAE, February 11, 2026 Checked October 30, 2026.
  54. 54
    Cyber Security Standards for Critical Sectors (Annex 1 to NCSC Decision No. (36) of 2026), National Cyber Security Center (NCSC), Kingdom of Bahrain Checked October 30, 2026.
  55. 55
    Cyber and Operational Resilience Framework for All Local Banks and Financial Institutions (CORF), Central Bank of Kuwait (CBK) Checked October 30, 2026.
  56. 56
    FFIEC Cybersecurity Assessment Tool, Federal Financial Institutions Examination Council Checked October 30, 2026.
  57. 57
    Withdrawal of proposed regulatory actions, SEC Release 33-11377, June 12, 2025 Checked September 28, 2026.

Discuss an engagement privately.

Write from your organization’s email address. Tell us what is in scope, your deadline and who can authorize testing. Leave sensitive details out of the first message.

Email engage@bendings.com What happens next