{ "section": "testing-rules", "path": "/testing-rules", "reviewed": "2026-10-30", "seamReportSnapshot": "2026-09-28", "dimensions": [ { "key": "legal_force", "label": "Legal force", "about": "Binding rule, supervisory expectation, voluntary guideline, or a mix of these." }, { "key": "scope", "label": "Who is covered", "about": "The firms or bodies the testing duty applies to." }, { "key": "frequency", "label": "How often", "about": "The minimum cycle for the strictest test the rule sets." }, { "key": "threat_intel", "label": "Threat intelligence", "about": "Whether intelligence on real attackers must shape the scenarios or scope." }, { "key": "provider_requirements", "label": "Tester requirements", "about": "Accreditation, certification, qualification or independence rules for testers." }, { "key": "internal_testers", "label": "In-house testers", "about": "Whether the firm’s own staff may run the test." }, { "key": "social_engineering", "label": "Human seam", "about": "Whether the test must reach people, through social engineering." }, { "key": "physical", "label": "Physical seam", "about": "Whether the test must reach buildings and physical access." }, { "key": "third_party", "label": "Supplier seam", "about": "Whether systems a supplier runs fall inside the test." }, { "key": "ot", "label": "Operational technology", "about": "Industrial control and building systems in the test scope." }, { "key": "payment_systems", "label": "Payment systems", "about": "Payment, card, SWIFT or market infrastructure in the test scope." }, { "key": "cloud_saas", "label": "Cloud and SaaS", "about": "Cloud and software-as-a-service tenancies in the test scope." }, { "key": "cross_border", "label": "Cross-border", "about": "Foreign branches, offshore testers, residency limits or recognition of tests run elsewhere." }, { "key": "purple_replay", "label": "Purple team or replay", "about": "A joint session in which testers and defenders replay the attack." }, { "key": "remediation_retest", "label": "Remediation and retest", "about": "Remediation plans, deadlines and retests of findings." }, { "key": "regulator_role", "label": "Regulator role", "about": "Whether the regulator leads the test, receives results or examines testing in supervision." }, { "key": "automated_ai", "label": "Automation and AI", "about": "Any mention of automated, continuous or AI-driven testing, or of testing AI systems." } ], "codes": { "legal_force": [ "mandatory", "supervisory_expectation", "voluntary", "mixed", "unknown_not_public" ], "scope": null, "frequency": null, "threat_intel": [ "required", "recommended", "not_addressed", "unknown_not_public" ], "provider_requirements": [ "required", "recommended", "not_addressed", "unknown_not_public" ], "internal_testers": [ "allowed", "allowed_with_conditions", "not_allowed", "not_addressed", "unknown_not_public" ], "social_engineering": [ "required", "controls_test", "permitted", "excluded", "not_addressed", "unknown_not_public" ], "physical": [ "required", "controls_test", "permitted", "excluded", "not_addressed", "unknown_not_public" ], "third_party": [ "required", "assurance_only", "permitted", "excluded", "not_addressed", "unknown_not_public" ], "ot": [ "required", "permitted", "excluded", "not_addressed", "unknown_not_public" ], "payment_systems": [ "required", "permitted", "excluded", "not_addressed", "unknown_not_public" ], "cloud_saas": [ "required", "assurance_only", "permitted", "excluded", "not_addressed", "unknown_not_public" ], "cross_border": [ "addressed", "not_addressed", "unknown_not_public" ], "purple_replay": [ "required", "recommended", "not_addressed", "unknown_not_public" ], "remediation_retest": [ "required", "recommended", "not_addressed", "unknown_not_public" ], "regulator_role": [ "leads_or_oversees_test", "receives_results", "examines", "not_addressed", "unknown_not_public" ], "automated_ai": [ "addressed", "not_addressed", "unknown_not_public" ] }, "codeLabels": { "required": "Required", "controls_test": "Controls tested, seam not crossed", "assurance_only": "Supplier assurance only", "permitted": "Permitted", "recommended": "Recommended", "excluded": "Excluded", "not_addressed": "Not addressed", "addressed": "Addressed", "unknown_not_public": "Text not public" }, "codingRules": [ { "id": "R1", "rule": "cross_border is 'addressed' when the text (a) says whether its testing duty, or the rules that carry it, reaches branches, subsidiaries, group entities, functions, systems or network connections outside the jurisdiction, or lets a foreign entity rely on its head office, group or home regime for those rules; (b) provides for multi-jurisdiction, pooled or mutually recognized tests; or (c) says where testers may be located or registered, or limits where people with access to the systems or data in scope may be located or connect from. A rule that only fixes where data or systems are hosted, or only sets conditions for outsourcing or data transfers abroad, is 'not_addressed', as decided for SAMA CSF 3.4.3(4)(b). An application rule counts only if it has a foreign element; reliance on an affiliate with no foreign element does not." }, { "id": "R2", "rule": "On the human and physical seams the code follows how far the regime's own texts take a tester toward crossing the seam: 'required' when the crossing is mandatory; 'permitted' when a text names social engineering or physical intrusion as an allowed method, option or example; 'controls_test' when a mandatory test or assessment covers people-reliant or physical controls and names no crossing method. Where a regime has both 'permitted' and 'controls_test' text, code 'permitted' and keep the controls test in the detail, as September did for FISMA CA-8(3), FedRAMP Rev5 and DORA on the physical seam. Supervisory reports that describe what firms do, such as thematic reviews, may inform the detail but do not set the code." }, { "id": "R3", "rule": "In guidance-level texts (legal_force supervisory_expectation, voluntary or mixed, and the guidance parts of binding texts), 'required' needs 'must', 'shall', 'required' or the text's own expectation words, such as 'expects' or 'is expected to'. A plain 'should' is coded 'recommended' on the dimensions that have that code and 'permitted' on the seam dimensions, as are 'could', 'may', 'encouraged' and 'consider'. legal_force already records that the text is guidance, and it does not turn a 'should' into 'required'. This is the convention September used for the FFIEC booklet, the joint UAE enabling technologies guidelines, ADGM guidance and MAS TRM, so no published September code changes." }, { "id": "R4", "rule": "When a regulator's Arabic and English texts differ on a coded point, code from the text the regulator says prevails or marks as the original (English for QFCRA and SAMA CSF). Where it says neither, code from the Arabic, the official language of the GCC states, and give both wordings in the detail." }, { "id": "R5", "rule": "threat_intel counts only text that ties test scenarios, scope or timing to information about who is likely to attack the firm or system and how: threat intelligence, threat analysis, threat models, or the tactics adversaries are expected to use against it. Text that asks for realistic tests, or for tests that simulate or replicate real or current attacks or attackers' methods in general, is 'not_addressed', as is threat intelligence that is not tied to testing (NCA CSCC-2, ECC and OTCC precedents)." }, { "id": "R6", "rule": "On the supplier and cloud seams, 'required' means a binding text makes a security test of systems a supplier runs mandatory, whether the duty sits on the firm, on the supplier directly (FedRAMP, NCA CCC) or on the supplier through terms the firm must put in its contract. 'assurance_only' means the firm must only obtain assurance: audit or access rights, the supplier's own reports or certificates, joint continuity tests or generic testing clauses." }, { "id": "R7", "rule": "A text is a row when it sets a rule or supervisory expectation that the firm, or a supplier for it, run security tests of systems: penetration tests, vulnerability assessments, red team or other adversarial tests, or threat-led tests. AI systems are the firm's systems. A text whose only tests are model validation, bias, performance or stress tests, or whose security content is reviews and audits, is not a row. Nor is a text that only encourages testing and says it sets no requirement. A standard that sets the criteria testers must meet to run such tests, such as a penetration testing accreditation standard, is also a row, as September coded the NCSA NISCF standard." }, { "id": "R8", "rule": "payment_systems is 'required' when a mandatory security test covers payment, card, clearing, settlement, trading or market-infrastructure systems, either because a testing clause names those systems or payment services delivered online, or because the regime applies only to firms whose licensed activity is a payment activity (payment services, e-money, payment stablecoins, payment system operation) or a trading, clearing or settlement venue. Continuity, capacity and stress tests do not count, and neither does a duty to comply with PCI DSS or the SWIFT CSCF without a testing clause of the regulator's own. A cross-sector regime that only counts payment firms among the entities in scope is 'not_addressed'." }, { "id": "R9", "rule": "When a later official act changes a fact a cell states, such as who accredits testers, the cell keeps its code unless the act changes what the text requires, and its detail and cite name the later act." } ], "excluded": [ { "id": "ae-cbuae-ai-ml-guidance-2026", "short": "CBUAE AI/ML Guidance 2026", "reason": "Not a testing rule under R7. The CBUAE guidance note of February 11, 2026 is consumer protection guidance on AI and ML. Its tests are bias tests (Section 3(c)), stress testing and validation of models (5(d)) and tests of automatic updates (6(c)). Its security content is independent reviews of in-house AI (8(c)) and annual cybersecurity reviews of third-party AI providers with pre-deployment checks (9(b)). None is a penetration test, vulnerability assessment or red team exercise. Cited as related guidance on the UAE page (source cbuaeAiGuidance), as September did for the QCB AI Guideline 2024." } ], "figures": [ { "figure": "71", "label": "US and Gulf testing rules coded on 17 dimensions, 67 read in full, 2 in part and 2 with no public text, plus 13 international benchmarks", "source": "testingRulesData" }, { "figure": "7 of 71", "label": "US and Gulf rules that require threat intelligence to shape the test. In one, the firm first decides whether a test is needed", "source": "testingRulesData" }, { "figure": "7 of 71", "label": "US and Gulf rules that require a test of people, such as social engineering. In one, the firm first decides whether a test is needed", "source": "testingRulesData" }, { "figure": "1 of 71", "label": "US and Gulf rules that require a physical intrusion test", "source": "testingRulesData" } ], "countries": [ { "slug": "united-states", "name": "United States", "the": "the United States", "adj": "US", "answer": "Yes for most regulated firms and federal agencies, on different cycles. New York and the FTC require an annual penetration test, federal bank rules leave the interval to risk, and no US financial rule requires threat-led red teaming.", "lede": "Yes for most regulated firms and federal agencies, on different cycles. No US financial rule we coded requires threat-led red teaming.", "statements": [ { "topic": "Who must test", "text": "Each regulator sets its own duty. Banks and credit unions test key controls under the interagency guidelines. New York-licensed firms test under Part 500, non-bank lenders under the FTC Safeguards Rule, and market infrastructure under SEC and CFTC rules. Federal agencies test under FISMA and the NIST controls, and cloud services they buy under FedRAMP.", "sources": [ "us-interagency-infosec-guidelines", "us-nydfs-part500", "us-ftc-safeguards-rule", "us-sec-reg-sci", "us-cftc-system-safeguards", "us-fisma-nist", "us-fedramp-rev5" ] }, { "topic": "How often", "text": "New York requires a penetration test from inside and outside the system boundary at least once a year. The FTC requires one a year unless the firm runs effective continuous monitoring. CFTC rules require annual external and internal tests at clearing organizations, swap data repositories and covered contract markets. Federal bank rules set no interval: testing follows the risk assessment. Regulation SCI requires penetration test reviews only once every three years.", "sources": [ "us-nydfs-part500", "us-ftc-safeguards-rule", "us-cftc-system-safeguards", "us-interagency-infosec-guidelines", "us-sec-reg-sci" ] }, { "topic": "Who may test", "text": "A qualified in-house team may run New York’s test. CFTC rules require an independent contractor for the annual external test at clearing organizations, swap data repositories and covered contract markets. High-impact federal systems need an independent penetration testing agent or team under NIST control CA-8(1). FedRAMP’s 2026 rules require assessors recognized through A2LA accreditation. No US financial rule we coded names a tester certification.", "sources": [ "us-nydfs-part500", "us-cftc-system-safeguards", "us-fisma-nist", "us-fedramp-cr26" ] }, { "topic": "Threat-led testing", "text": "No US financial rule we coded requires threat-led red teaming. CFTC rules and the SEC rule for security-based swap execution facilities require test scope to follow the firm’s current threat analysis. The Federal Reserve’s adopting release for Regulation HH says tests “could include” red team tests. The FFIEC’s voluntary assessment tool, which named red team testing as a maturity statement, was retired on August 31, 2025.", "sources": [ "us-cftc-system-safeguards", "us-sec-reg-se-sbsef", "us-frb-reg-hh", "us-ffiec-cat" ] }, { "topic": "Results and the regulator", "text": "Most financial regulators examine testing in supervision and do not collect reports. The SEC receives each Regulation SCI review report. CFTC and SEC swap facility test reports go to the regulator on request. For agencies, CISA leads assessments of Tier 1 high value assets, and CMS receives penetration test reports with raw results from state exchanges and Medicaid agencies.", "sources": [ "us-sec-reg-sci", "us-cftc-system-safeguards", "us-sec-reg-se-sbsef", "us-cisa-hva", "us-cms-arc-ampe" ] }, { "topic": "Seams", "text": "Rules that require the test to cross each seam. Human: FedRAMP Rev5 (legacy), IRS Pub 1075 and CMS ARC-AMPE. Physical: none. Supplier: SEC Reg SCI, CFTC system safeguards, FISMA + NIST 800-53, FedRAMP Rev5 (legacy), FedRAMP CR26 / 20x, CISA HVA (BOD 18-02), OMB M-22-09 and IRS Pub 1075. OT: NYDFS Part 500 and FTC Safeguards Rule. Cloud and SaaS: FedRAMP Rev5 (legacy), FedRAMP CR26 / 20x and CISA HVA (BOD 18-02). 7 more ask only for assurance about suppliers, such as audit rights or the supplier’s own reports. Cross-border provisions, such as foreign branches in scope or limits on where testers sit: OCC GENIUS Act rule (12 CFR 15) and IRS Pub 1075.", "sources": [ "us-fedramp-rev5", "us-irs-pub1075", "us-cms-arc-ampe", "us-sec-reg-sci", "us-cftc-system-safeguards", "us-fisma-nist", "us-fedramp-cr26", "us-cisa-hva", "us-omb-m22-09", "us-nydfs-part500", "us-ftc-safeguards-rule", "us-ffiec-is-booklet", "us-interagency-infosec-guidelines", "us-occ-genius-part15", "us-fhfa-ab-2017-02", "us-fca-609-930", "us-frb-reg-hh" ] }, { "topic": "What changed", "text": "The OCC issued its final GENIUS Act rule for payment stablecoin issuers on October 23, 2026. It requires periodic independent testing and takes effect on January 18, 2027. FedRAMP’s Consolidated Rules 2026 become mandatory on January 1, 2027. In 2025 the SEC withdrew proposed Regulation SCI amendments that would have made penetration testing annual.", "sources": [ "us-occ-genius-part15", "us-fedramp-cr26", "secSciWithdrawal" ] }, { "topic": "What is not public", "text": "Partly public: CISA HVA (BOD 18-02).", "sources": [ "us-cisa-hva" ] } ], "faq": [ { "q": "Is penetration testing mandatory for banks and government bodies in the United States?", "a": "16 of the 19 US testing rules we coded are binding: NYDFS Part 500, annual; SEC Reg SCI, every 3 years; CFTC system safeguards, annual (DCOs, SDRs, covered DCMs); Interagency security guidelines, risk-based; FTC Safeguards Rule, annual (unless continuous monitoring); FISMA + NIST 800-53, annual (statute), CA-8 org-defined; FedRAMP Rev5 (legacy), annual; FedRAMP CR26 / 20x, annual independent assessment; CISA HVA (BOD 18-02), every 3 years; OMB M-22-09, periodic, as systems change; OCC GENIUS Act rule (12 CFR 15), periodic, no interval set; FCA cyber risk management rule, risk-based; Fed Regulation HH (designated FMUs), annual (business continuity), periodic and after major changes (other tests); SEC Regulation SE system safeguards, risk-based; IRS Pub 1075, every 3 years; CMS ARC-AMPE, annual. 3 more are guidance, voluntary or mixed: FFIEC IS booklet, risk-based; FFIEC CAT (sunset), risk-based; FHFA information security bulletins, risk-based. The cycle after each name is the minimum for the strictest test that rule sets.", "sources": [ "us-nydfs-part500", "us-ffiec-is-booklet", "us-ffiec-cat", "us-sec-reg-sci", "us-cftc-system-safeguards", "us-interagency-infosec-guidelines", "us-ftc-safeguards-rule", "us-fisma-nist", "us-fedramp-rev5", "us-fedramp-cr26", "us-cisa-hva", "us-omb-m22-09", "us-occ-genius-part15", "us-fhfa-ab-2017-02", "us-fca-609-930", "us-frb-reg-hh", "us-sec-reg-se-sbsef", "us-irs-pub1075", "us-cms-arc-ampe" ] }, { "q": "Who may run a penetration test in the United States? Can an in-house team do it?", "a": "In-house teams may run the test under NYDFS Part 500 and FFIEC IS booklet. In-house teams may test if they meet conditions, such as independence, under SEC Reg SCI, CFTC system safeguards, Interagency security guidelines, FISMA + NIST 800-53, FedRAMP Rev5 (legacy), FedRAMP CR26 / 20x, CISA HVA (BOD 18-02), OMB M-22-09, OCC GENIUS Act rule (12 CFR 15), FHFA information security bulletins, FCA cyber risk management rule, SEC Regulation SE system safeguards, IRS Pub 1075 and CMS ARC-AMPE. The rule is silent on who tests in FFIEC CAT (sunset), FTC Safeguards Rule and Fed Regulation HH (designated FMUs). Rules that set tester requirements, such as qualification, certification or independence: NYDFS Part 500, SEC Reg SCI, CFTC system safeguards, FISMA + NIST 800-53, FedRAMP Rev5 (legacy), FedRAMP CR26 / 20x, CISA HVA (BOD 18-02), OMB M-22-09, OCC GENIUS Act rule (12 CFR 15), FCA cyber risk management rule, SEC Regulation SE system safeguards and CMS ARC-AMPE.", "sources": [ "us-nydfs-part500", "us-ffiec-is-booklet", "us-ffiec-cat", "us-sec-reg-sci", "us-cftc-system-safeguards", "us-interagency-infosec-guidelines", "us-ftc-safeguards-rule", "us-fisma-nist", "us-fedramp-rev5", "us-fedramp-cr26", "us-cisa-hva", "us-omb-m22-09", "us-occ-genius-part15", "us-fhfa-ab-2017-02", "us-fca-609-930", "us-frb-reg-hh", "us-sec-reg-se-sbsef", "us-irs-pub1075", "us-cms-arc-ampe" ] }, { "q": "Is threat-led red teaming required in the United States?", "a": "2 rules require threat intelligence to shape the test. CFTC system safeguards: Test scope must cover what the entity's current cybersecurity threat analysis shows is needed to find paths for an intruder, unauthorized user or insider. This ties scope to threat analysis; it does not prescribe intelligence-led scenarios. SEC Regulation SE system safeguards: Test scope must cover what the facility's current cybersecurity threat analysis shows is needed. Same wording and same code as the CFTC row. It is recommended under FFIEC CAT (sunset), FISMA + NIST 800-53, FedRAMP Rev5 (legacy), CISA HVA (BOD 18-02), IRS Pub 1075 and CMS ARC-AMPE.", "sources": [ "us-cftc-system-safeguards", "us-sec-reg-se-sbsef", "us-ffiec-cat", "us-fisma-nist", "us-fedramp-rev5", "us-cisa-hva", "us-irs-pub1075", "us-cms-arc-ampe" ] }, { "q": "Do penetration test results go to the regulator in the United States?", "a": "The regulator leads or oversees the test under CISA HVA (BOD 18-02). The regulator receives test results under SEC Reg SCI, FedRAMP Rev5 (legacy) and CMS ARC-AMPE. The regulator examines testing in supervision, without routine reports, under NYDFS Part 500, FFIEC IS booklet, CFTC system safeguards, Interagency security guidelines, FISMA + NIST 800-53, FedRAMP CR26 / 20x, OMB M-22-09, OCC GENIUS Act rule (12 CFR 15), FHFA information security bulletins, SEC Regulation SE system safeguards and IRS Pub 1075. The text gives the regulator no role in testing under FFIEC CAT (sunset), FTC Safeguards Rule, FCA cyber risk management rule and Fed Regulation HH (designated FMUs).", "sources": [ "us-nydfs-part500", "us-ffiec-is-booklet", "us-ffiec-cat", "us-sec-reg-sci", "us-cftc-system-safeguards", "us-interagency-infosec-guidelines", "us-ftc-safeguards-rule", "us-fisma-nist", "us-fedramp-rev5", "us-fedramp-cr26", "us-cisa-hva", "us-omb-m22-09", "us-occ-genius-part15", "us-fhfa-ab-2017-02", "us-fca-609-930", "us-frb-reg-hh", "us-sec-reg-se-sbsef", "us-irs-pub1075", "us-cms-arc-ampe" ] }, { "q": "Do US rules require social engineering, physical or supplier testing?", "a": "Rules that require the test to cross each seam. Human: FedRAMP Rev5 (legacy), IRS Pub 1075 and CMS ARC-AMPE. Physical: none. Supplier: SEC Reg SCI, CFTC system safeguards, FISMA + NIST 800-53, FedRAMP Rev5 (legacy), FedRAMP CR26 / 20x, CISA HVA (BOD 18-02), OMB M-22-09 and IRS Pub 1075. OT: NYDFS Part 500 and FTC Safeguards Rule. Cloud and SaaS: FedRAMP Rev5 (legacy), FedRAMP CR26 / 20x and CISA HVA (BOD 18-02). 7 more ask only for assurance about suppliers, such as audit rights or the supplier’s own reports. Cross-border provisions, such as foreign branches in scope or limits on where testers sit: OCC GENIUS Act rule (12 CFR 15) and IRS Pub 1075.", "sources": [ "us-fedramp-rev5", "us-irs-pub1075", "us-cms-arc-ampe", "us-sec-reg-sci", "us-cftc-system-safeguards", "us-fisma-nist", "us-fedramp-cr26", "us-cisa-hva", "us-omb-m22-09", "us-nydfs-part500", "us-ftc-safeguards-rule", "us-ffiec-is-booklet", "us-interagency-infosec-guidelines", "us-occ-genius-part15", "us-fhfa-ab-2017-02", "us-fca-609-930", "us-frb-reg-hh" ] } ] }, { "slug": "saudi-arabia", "name": "Saudi Arabia", "the": "Saudi Arabia", "adj": "Saudi", "answer": "Yes. NCA and SAMA rules require penetration tests, from every three months for the most critical OT facilities and every six months for critical systems to once a year for internet-facing services, and SAMA’s FEER framework calls for a threat-led red team test of each financial institution at least every three years.", "lede": "Yes. NCA and SAMA require penetration tests every 3 to 12 months, depending on the system, and SAMA’s FEER calls for a threat-led red team test at least every three years.", "statements": [ { "topic": "Who must test", "text": "SAMA’s Cyber Security Framework applies to banks, financing companies, payment service providers and credit bureaus. Its 2017 text also names insurers and financial market infrastructure, but SAMA’s Rulebook no longer lists insurance in its scope. NCA’s controls apply to government bodies and to private owners and operators of critical national infrastructure. The Capital Market Authority’s guidelines cover capital market institutions such as brokers and asset managers.", "sources": [ "sa-sama-csf", "sa-nca-ecc", "sa-cma-cyber-guidelines" ] }, { "topic": "How often", "text": "NCA requires critical systems to be penetration tested at least every six months, and cloud providers serving government and CNI tenants to test their technology stack as often. OT facilities test every 3, 6 or 12 months by criticality level. SAMA requires an annual penetration test of customer and internet-facing services, and tests twice a year at entities seeking a SAMA license or a place in its sandbox. The CMA expects external online services to be tested at least once a year.", "sources": [ "sa-nca-cscc", "sa-nca-ccc", "sa-nca-otcc", "sa-sama-csf", "sa-sama-crfr", "sa-cma-cyber-guidelines" ] }, { "topic": "Who may test", "text": "Under FEER, the provider is external and is selected and appointed by SAMA’s Green Team. NCA requires a qualified team for critical system and OT tests but does not define qualified. Any provider of cybersecurity services in the Kingdom has had to register with NCA since August 1, 2022. A draft NCA framework (RFCS-1:2026) would license penetration testing and red teaming; it was not final on October 30, 2026.", "sources": [ "sa-sama-feer", "sa-nca-cscc", "sa-nca-otcc", "sa-nca-ecc", "ncaRfcs" ] }, { "topic": "Threat-led testing", "text": "Yes, for SAMA-regulated institutions. Under FEER, SAMA’s Green Team and the institution’s White Team supply threat intelligence, the provider derives the scenarios, and a joint red and blue team replay closes the test. SAMA can also ask for a test at any time.", "sources": [ "sa-sama-feer" ] }, { "topic": "Results and the regulator", "text": "SAMA leads FEER tests: it approves the provider, scope and scenarios and receives the final report. Under the other Saudi rules, results stay with the entity, and SAMA, NCA and the CMA assess compliance through self-assessments and audits. CSCC-2:2026 moves NCA’s checks to its Haseen portal and on-site audits.", "sources": [ "sa-sama-feer", "sa-sama-csf", "sa-nca-ecc", "sa-cma-cyber-guidelines", "sa-nca-cscc" ] }, { "topic": "Seams", "text": "Rules that require the test to cross each seam. Human: NCA OTCC-1:2022. Physical: NCA OTCC-1:2022. Supplier: NCA CCC-2:2024. OT: NCA OTCC-1:2022. Cloud and SaaS: NCA CCC-2:2024. 3 more ask only for assurance about suppliers, such as audit rights or the supplier’s own reports. Cross-border provisions, such as foreign branches in scope or limits on where testers sit: NCA ECC-2:2024, NCA CSCC-2:2026, NCA OTCC-1:2022, CMA Cybersecurity Guidelines, NCA CCC-2:2024 and SAMA IPO Rules.", "sources": [ "sa-nca-otcc", "sa-nca-ccc", "sa-sama-csf", "sa-cma-cyber-guidelines", "sa-nca-ecc", "sa-nca-cscc", "sa-sama-ipo-rules" ] }, { "topic": "What changed", "text": "NCA posted CSCC-2:2026, in Arabic only, on its CSCC page on October 29, 2026, replacing CSCC-1:2019. The six-monthly test, the qualified-team rule and the ban on remote access to critical systems from outside the Kingdom stay. NCA has also consulted on licensing testing providers and on AI cybersecurity guidelines that call for penetration testing of AI systems. Neither text is final.", "sources": [ "sa-nca-cscc", "ncaRfcs", "ncaAicg" ] }, { "topic": "What is not public", "text": "Every one of the 10 rules we coded is public. NCA says the Arabic text of its controls binds. CSCC-2:2026 has no English version yet, so its coding reads the Arabic.", "sources": [ "sa-nca-cscc" ] } ], "faq": [ { "q": "Is penetration testing mandatory for banks and government bodies in Saudi Arabia?", "a": "9 of the 10 Saudi testing rules we coded are binding: SAMA CSF, annual; SAMA FEER, every 3 years; SAMA CRFR, every 6 months; NCA ECC-2:2024, periodic (entity-defined); NCA CSCC-2:2026, every 6 months; NCA OTCC-1:2022, 3, 6 or 12 months by facility level; NCA CCC-2:2024, every 6 months; NCA TCC-1:2021, annual; SAMA IPO Rules, not specified. One more is guidance, voluntary or mixed: CMA Cybersecurity Guidelines, annual. The cycle after each name is the minimum for the strictest test that rule sets.", "sources": [ "sa-sama-csf", "sa-sama-feer", "sa-sama-crfr", "sa-nca-ecc", "sa-nca-cscc", "sa-nca-otcc", "sa-cma-cyber-guidelines", "sa-nca-ccc", "sa-nca-tcc", "sa-sama-ipo-rules" ] }, { "q": "Who may run a penetration test in Saudi Arabia? Can an in-house team do it?", "a": "An outside tester is required under SAMA FEER. The rule is silent on who tests in SAMA CSF, SAMA CRFR, NCA ECC-2:2024, NCA CSCC-2:2026, NCA OTCC-1:2022, CMA Cybersecurity Guidelines, NCA CCC-2:2024, NCA TCC-1:2021 and SAMA IPO Rules. Rules that set tester requirements, such as qualification, certification or independence: SAMA CSF, SAMA FEER, NCA CSCC-2:2026, NCA OTCC-1:2022 and CMA Cybersecurity Guidelines.", "sources": [ "sa-sama-csf", "sa-sama-feer", "sa-sama-crfr", "sa-nca-ecc", "sa-nca-cscc", "sa-nca-otcc", "sa-cma-cyber-guidelines", "sa-nca-ccc", "sa-nca-tcc", "sa-sama-ipo-rules" ] }, { "q": "Is threat-led red teaming required in Saudi Arabia?", "a": "One rule requires threat intelligence to shape the test. SAMA FEER: SAMA's Green Team and the entity's White Team each supply threat intelligence; the provider adds its own and derives the scenarios. Detailed scenarios are mapped to critical assets using external, internal and sector-wide intelligence and must be agreed with the Green Team. The scenario phase lasts up to five weeks.", "sources": [ "sa-sama-feer" ] }, { "q": "Do penetration test results go to the regulator in Saudi Arabia?", "a": "The regulator leads or oversees the test under SAMA FEER. The regulator examines testing in supervision, without routine reports, under SAMA CSF, SAMA CRFR, NCA ECC-2:2024, NCA CSCC-2:2026, NCA OTCC-1:2022, CMA Cybersecurity Guidelines, NCA CCC-2:2024, NCA TCC-1:2021 and SAMA IPO Rules.", "sources": [ "sa-sama-csf", "sa-sama-feer", "sa-sama-crfr", "sa-nca-ecc", "sa-nca-cscc", "sa-nca-otcc", "sa-cma-cyber-guidelines", "sa-nca-ccc", "sa-nca-tcc", "sa-sama-ipo-rules" ] }, { "q": "Do Saudi rules require social engineering, physical or supplier testing?", "a": "Rules that require the test to cross each seam. Human: NCA OTCC-1:2022. Physical: NCA OTCC-1:2022. Supplier: NCA CCC-2:2024. OT: NCA OTCC-1:2022. Cloud and SaaS: NCA CCC-2:2024. 3 more ask only for assurance about suppliers, such as audit rights or the supplier’s own reports. Cross-border provisions, such as foreign branches in scope or limits on where testers sit: NCA ECC-2:2024, NCA CSCC-2:2026, NCA OTCC-1:2022, CMA Cybersecurity Guidelines, NCA CCC-2:2024 and SAMA IPO Rules.", "sources": [ "sa-nca-otcc", "sa-nca-ccc", "sa-sama-csf", "sa-cma-cyber-guidelines", "sa-nca-ecc", "sa-nca-cscc", "sa-sama-ipo-rules" ] } ] }, { "slug": "uae", "name": "United Arab Emirates", "the": "the UAE", "adj": "UAE", "answer": "Yes. The DFSA and ADGM’s FSRA require tests at least once a year for internet-facing systems, and the Capital Market Authority, for virtual asset firms, for internet-connected systems. The Central Bank’s operational risk regulation requires periodic testing with no interval, and an independent penetration test of critical functions.", "lede": "Yes. The DFSA and ADGM’s FSRA require tests at least once a year for internet-facing systems, and the Capital Market Authority, for virtual asset firms, for internet-connected systems. The Central Bank’s operational risk regulation sets no interval.", "statements": [ { "topic": "Who must test", "text": "The rule depends on the regulator. The Central Bank (CBUAE) covers licensed financial institutions, payment providers and insurers. The DFSA covers firms in the DIFC, and the FSRA firms in Abu Dhabi Global Market. The Capital Market Authority’s rule covers virtual asset service providers and alternative trading system operators. The Cyber Security Council’s IA Standard covers federal bodies and non-government critical infrastructure, and DESC’s ISR covers Dubai government entities.", "sources": [ "ae-cbuae-oprisk-2026", "ae-cbuae-retail-payments", "ae-cbuae-e-insurance-regulation", "ae-dfsa-gen-5-5", "ae-adgm-fsra-gen-3-5", "ae-cma-vasp-regulation-2026", "ae-csc-ia-standard-v2-1", "ae-desc-isr" ] }, { "topic": "How often", "text": "DFSA GEN 5.5 and FSRA GEN 3.5 require testing at least once a year for internet-facing systems, and the CMA’s 2026 virtual asset regulation for internet-connected systems, in nearly the same words. The joint enabling technologies guidelines expect API and cloud penetration tests at least once a year. The CBUAE’s operational risk regulation, in force since September 14, 2026, requires periodic control tests with no interval. The CBUAE’s exchange house standards (N 35/2018, 14.9.1) require internal and external vulnerability scans and penetration tests at least once a year.", "sources": [ "ae-dfsa-gen-5-5", "ae-adgm-fsra-gen-3-5", "ae-cma-vasp-regulation-2026", "ae-joint-enabling-tech-guidelines", "ae-cbuae-oprisk-2026", "cbuaeExchangeHouses" ] }, { "topic": "Who may test", "text": "The CBUAE requires an independent third party for the penetration test of critical functions. Dubai Law No. 15 of 2024 bars Dubai government entities, and the critical non-government entities DESC classifies, from hiring a security company DESC has not certified. Firms that test for federal government must comply with the Cyber Security Council’s accreditation program (NCAP). DFSA, FSRA and CMA rules set no tester requirement.", "sources": [ "ae-cbuae-oprisk-2026", "ae-desc-isr", "ae-csc-ia-standard-v2-1", "ae-dfsa-gen-5-5", "ae-adgm-fsra-gen-3-5", "ae-cma-vasp-regulation-2026" ] }, { "topic": "Threat-led testing", "text": "No UAE rule with public text requires threat-led red teaming. The CBUAE’s retail payment services regulation requires test scope to follow the provider’s cyber risk profile and the cyber intelligence available. FSRA guidance describes red teaming as one testing method.", "sources": [ "ae-cbuae-retail-payments", "ae-adgm-fsra-gen-3-5" ] }, { "topic": "Results and the regulator", "text": "UAE financial regulators do not collect test reports by default. The CBUAE, DFSA, FSRA and CMA review testing in supervision. Under the IA Standard, the Cyber Security Council may perform or commission tests of entities.", "sources": [ "ae-cbuae-oprisk-2026", "ae-dfsa-gen-5-5", "ae-adgm-fsra-gen-3-5", "ae-cma-vasp-regulation-2026", "ae-csc-ia-standard-v2-1" ] }, { "topic": "Seams", "text": "Rules that require the test to cross each seam. Human: CBUAE retail payment services regulation. Physical: none. Supplier: CBUAE electronic insurance regulations. OT: none. Cloud and SaaS: none. 3 more ask only for assurance about suppliers, such as audit rights or the supplier’s own reports. Under the CBUAE retail payment services regulation, payment service providers whose payments average AED 10 million or more a month must regularly assess whether a test is needed, and their testing must cover social engineering. Cross-border provisions, such as foreign branches in scope or limits on where testers sit: DFSA GEN 5.5 (DIFC) and ADGM FSRA GEN 3.5. The text of Dubai DESC ISR is not public, so its seam codes are unknown.", "sources": [ "ae-cbuae-retail-payments", "ae-cbuae-e-insurance-regulation", "ae-cbuae-oprisk-2026", "ae-dfsa-gen-5-5", "ae-cma-vasp-regulation-2026", "ae-adgm-fsra-gen-3-5", "ae-desc-isr" ] }, { "topic": "What changed", "text": "The CBUAE’s operational risk regulation C 1/2026 took effect on September 14, 2026. The Capital Market Authority, formerly the Securities and Commodities Authority, brought in an annual testing rule for virtual asset firms in force since February 28, 2026. The CBUAE’s AI guidance note of February 11, 2026 expects yearly bias tests of deployed AI and independent cybersecurity reviews of AI providers. It does not add a penetration testing duty.", "sources": [ "ae-cbuae-oprisk-2026", "ae-cma-vasp-regulation-2026", "cbuaeAiGuidance" ] }, { "topic": "What is not public", "text": "Not public: Dubai DESC ISR. DESC provides the ISR to Dubai government entities by email request only. The Cyber Security Council’s site refused connections on October 30, 2026, so the IA Standard keeps its September coding.", "sources": [ "ae-desc-isr", "ae-desc-isr", "ae-csc-ia-standard-v2-1" ] } ], "faq": [ { "q": "Is penetration testing mandatory for banks and government bodies in the UAE?", "a": "8 of the 10 UAE testing rules we coded are binding: CBUAE operational risk regulation, periodic, interval not set; CBUAE retail payment services regulation, risk-based; DFSA GEN 5.5 (DIFC), annual (internet-facing); UAE IA Standard v2.1, no cycle set; Dubai DESC ISR, text not public; CMA VASP and ATS Regulation 2026, annual (internet-connected systems); CBUAE retail payment systems regulation, periodic, interval not set; CBUAE electronic insurance regulations, regular, interval not set. 2 more are guidance, voluntary or mixed: Enabling technologies guidelines, annual; ADGM FSRA GEN 3.5, annual (internet-facing). The cycle after each name is the minimum for the strictest test that rule sets.", "sources": [ "ae-cbuae-oprisk-2026", "ae-cbuae-retail-payments", "ae-joint-enabling-tech-guidelines", "ae-dfsa-gen-5-5", "ae-adgm-fsra-gen-3-5", "ae-csc-ia-standard-v2-1", "ae-desc-isr", "ae-cma-vasp-regulation-2026", "ae-cbuae-retail-payment-systems", "ae-cbuae-e-insurance-regulation" ] }, { "q": "Who may run a penetration test in the UAE? Can an in-house team do it?", "a": "In-house teams may test if they meet conditions, such as independence, under CBUAE operational risk regulation, Enabling technologies guidelines, UAE IA Standard v2.1 and CBUAE retail payment systems regulation. The rule is silent on who tests in CBUAE retail payment services regulation, DFSA GEN 5.5 (DIFC), ADGM FSRA GEN 3.5, CMA VASP and ATS Regulation 2026 and CBUAE electronic insurance regulations. The text is not public for Dubai DESC ISR. Rules that set tester requirements, such as qualification, certification or independence: CBUAE operational risk regulation, UAE IA Standard v2.1 and Dubai DESC ISR.", "sources": [ "ae-cbuae-oprisk-2026", "ae-cbuae-retail-payments", "ae-joint-enabling-tech-guidelines", "ae-dfsa-gen-5-5", "ae-adgm-fsra-gen-3-5", "ae-csc-ia-standard-v2-1", "ae-desc-isr", "ae-cma-vasp-regulation-2026", "ae-cbuae-retail-payment-systems", "ae-cbuae-e-insurance-regulation" ] }, { "q": "Is threat-led red teaming required in the UAE?", "a": "One rule requires threat intelligence to shape the test. CBUAE retail payment services regulation: Test coverage and scope must be based on the cyber risk profile and the cyber intelligence available. Annex II adds guidance on subscribing to threat intelligence services. It is recommended under ADGM FSRA GEN 3.5.", "sources": [ "ae-cbuae-retail-payments", "ae-adgm-fsra-gen-3-5" ] }, { "q": "Do penetration test results go to the regulator in the UAE?", "a": "The regulator leads or oversees the test under UAE IA Standard v2.1. The regulator examines testing in supervision, without routine reports, under CBUAE operational risk regulation, DFSA GEN 5.5 (DIFC), ADGM FSRA GEN 3.5, Dubai DESC ISR, CMA VASP and ATS Regulation 2026, CBUAE retail payment systems regulation and CBUAE electronic insurance regulations. The text gives the regulator no role in testing under CBUAE retail payment services regulation and Enabling technologies guidelines.", "sources": [ "ae-cbuae-oprisk-2026", "ae-cbuae-retail-payments", "ae-joint-enabling-tech-guidelines", "ae-dfsa-gen-5-5", "ae-adgm-fsra-gen-3-5", "ae-csc-ia-standard-v2-1", "ae-desc-isr", "ae-cma-vasp-regulation-2026", "ae-cbuae-retail-payment-systems", "ae-cbuae-e-insurance-regulation" ] }, { "q": "Do UAE rules require social engineering, physical or supplier testing?", "a": "Rules that require the test to cross each seam. Human: CBUAE retail payment services regulation. Physical: none. Supplier: CBUAE electronic insurance regulations. OT: none. Cloud and SaaS: none. 3 more ask only for assurance about suppliers, such as audit rights or the supplier’s own reports. Under the CBUAE retail payment services regulation, payment service providers whose payments average AED 10 million or more a month must regularly assess whether a test is needed, and their testing must cover social engineering. Cross-border provisions, such as foreign branches in scope or limits on where testers sit: DFSA GEN 5.5 (DIFC) and ADGM FSRA GEN 3.5. The text of Dubai DESC ISR is not public, so its seam codes are unknown.", "sources": [ "ae-cbuae-retail-payments", "ae-cbuae-e-insurance-regulation", "ae-cbuae-oprisk-2026", "ae-dfsa-gen-5-5", "ae-cma-vasp-regulation-2026", "ae-adgm-fsra-gen-3-5", "ae-desc-isr" ] } ] }, { "slug": "qatar", "name": "Qatar", "the": "Qatar", "adj": "Qatari", "answer": "Yes. Qatar Central Bank requires banks, insurers and payment service providers to run penetration tests twice a year, and payment firms and financial services operators must use an external provider. NCSA accredits penetration testing providers on a voluntary basis.", "lede": "Yes. Qatar Central Bank requires banks, insurers and payment service providers to run penetration tests twice a year. NCSA accreditation of testers is voluntary.", "statements": [ { "topic": "Who must test", "text": "QCB rules cover banks, insurers, payment service providers and financial services operators such as exchange houses and investment companies. QFCRA rules cover firms in the Qatar Financial Centre, and QFMA and NCSA controls cover financial market participants. NCSA’s National Information Assurance Standard applies to all organizations in Qatar.", "sources": [ "qa-qcb-technology-risks-banks", "qa-qcb-insurance-cyber", "qa-qcb-psp-cyber-2022", "qa-qcb-fso-tech-risk-2022", "qa-qfcra-ctrl-ict-risk", "qa-qfma-ncsa-nia-fmp", "qa-ncsa-nia-standard" ] }, { "topic": "How often", "text": "Banks and insurers run two penetration tests a year, test infrastructure and network devices every six months and test wireless infrastructure every quarter. Payment service providers run vulnerability assessments, code reviews and penetration tests at least twice a year. QCB’s instructions for financial services operators and QFCRA’s rules require regular testing with no interval.", "sources": [ "qa-qcb-technology-risks-banks", "qa-qcb-insurance-cyber", "qa-qcb-psp-cyber-2022", "qa-qcb-fso-tech-risk-2022", "qa-qfcra-ctrl-ict-risk" ] }, { "topic": "Who may test", "text": "Payment service providers and financial services operators must use an external, reputable provider with “the required certificates” and regional offices. QCB does not name the certificates. The bank and insurance rules do not say who tests. NCSA accredits penetration testing providers registered in Qatar. Accreditation is voluntary, but firms that add cybersecurity services, including penetration testing and red teaming, as a business activity need NCSA approval.", "sources": [ "qa-qcb-psp-cyber-2022", "qa-qcb-fso-tech-risk-2022", "qa-qcb-technology-risks-banks", "qa-ncsa-niscf-pentest-accreditation" ] }, { "topic": "Threat-led testing", "text": "QCB requires payment service providers to run periodic cyberattack simulation tests whose coverage and scope follow their risk profile and the threat intelligence available. No Qatari rule we coded requires a threat-led red team exercise. On October 30, 2026, none of the six penetration testing providers on NCSA’s register was accredited for red teaming.", "sources": [ "qa-qcb-psp-cyber-2022", "qa-ncsa-niscf-pentest-accreditation" ] }, { "topic": "Results and the regulator", "text": "Test reports stay with the firm. Banks send QCB an annual board-signed compliance report, and QCB may audit at any time. NCSA certifies organizations against the NIA Standard through accredited auditors.", "sources": [ "qa-qcb-technology-risks-banks", "qa-ncsa-nia-standard" ] }, { "topic": "Seams", "text": "Rules that require the test to cross each seam. Human: QCB financial services operator instructions. Physical: none. Supplier: none. OT: none. Cloud and SaaS: none. 4 more ask only for assurance about suppliers, such as audit rights or the supplier’s own reports. Cross-border provisions, such as foreign branches in scope or limits on where testers sit: QCB technology risks for banks, QCB insurance cyber regulation, QCB payment service provider regulation, QCB financial services operator instructions, QFCRA CTRL 8.5 and NCSA penetration testing accreditation.", "sources": [ "qa-qcb-fso-tech-risk-2022", "qa-qcb-technology-risks-banks", "qa-qcb-insurance-cyber", "qa-qfcra-ctrl-ict-risk", "qa-qfma-ncsa-nia-fmp", "qa-qcb-psp-cyber-2022", "qa-ncsa-niscf-pentest-accreditation" ] }, { "topic": "What changed", "text": "QFCRA’s ICT risk rules, CTRL Part 8.5, took effect on October 1, 2025. Since May 1, 2026 they no longer apply to wholesale advisory firms. QFMA and NCSA’s NIA controls for financial market participants, version 1.0, are dated March 2026. On October 5, 2026 NCSA and CREST International signed a memorandum to support mutual recognition of requirements for accredited penetration testing providers. No revised standard had followed by October 30.", "sources": [ "qa-qfcra-ctrl-ict-risk", "qa-qfma-ncsa-nia-fmp", "ncsaConference" ] }, { "topic": "What is not public", "text": "Every one of the 9 rules we coded is public.", "sources": [] } ], "faq": [ { "q": "Is penetration testing mandatory for banks and government bodies in Qatar?", "a": "5 of the 9 Qatari testing rules we coded are binding: QCB technology risks for banks, every 6 months; QCB insurance cyber regulation, every 6 months; QCB payment service provider regulation, every 6 months; QCB financial services operator instructions, regularly (not specified); QFMA and NCSA controls for markets, monthly scans, no pentest. 4 more are guidance, voluntary or mixed: QFCRA CTRL 8.5, risk-based; NCSA NIA Standard v2.1, annual (pentest optional); NCSA penetration testing accreditation, no cycle set; NCSA vulnerability management guidelines, daily scans (agent assets), no pentest cycle. The cycle after each name is the minimum for the strictest test that rule sets.", "sources": [ "qa-qcb-technology-risks-banks", "qa-qcb-insurance-cyber", "qa-qcb-psp-cyber-2022", "qa-qcb-fso-tech-risk-2022", "qa-qfcra-ctrl-ict-risk", "qa-ncsa-nia-standard", "qa-ncsa-niscf-pentest-accreditation", "qa-qfma-ncsa-nia-fmp", "qa-ncsa-vuln-mgmt-guidelines" ] }, { "q": "Who may run a penetration test in Qatar? Can an in-house team do it?", "a": "In-house teams may run the test under NCSA vulnerability management guidelines. In-house teams may test if they meet conditions, such as independence, under NCSA NIA Standard v2.1. An outside tester is required under QCB payment service provider regulation and QCB financial services operator instructions. The rule is silent on who tests in QCB technology risks for banks, QCB insurance cyber regulation, QFCRA CTRL 8.5, NCSA penetration testing accreditation and QFMA and NCSA controls for markets. Rules that set tester requirements, such as qualification, certification or independence: QCB payment service provider regulation, QCB financial services operator instructions and NCSA penetration testing accreditation.", "sources": [ "qa-qcb-technology-risks-banks", "qa-qcb-insurance-cyber", "qa-qcb-psp-cyber-2022", "qa-qcb-fso-tech-risk-2022", "qa-qfcra-ctrl-ict-risk", "qa-ncsa-nia-standard", "qa-ncsa-niscf-pentest-accreditation", "qa-qfma-ncsa-nia-fmp", "qa-ncsa-vuln-mgmt-guidelines" ] }, { "q": "Is threat-led red teaming required in Qatar?", "a": "One rule requires threat intelligence to shape the test. QCB payment service provider regulation: PSPs must run periodic cyberattack simulation testing whose coverage and scope are based on their risk profile and available threat intelligence. This is the only Qatari financial text found that ties test scope to threat intelligence.", "sources": [ "qa-qcb-psp-cyber-2022" ] }, { "q": "Do penetration test results go to the regulator in Qatar?", "a": "The regulator examines testing in supervision, without routine reports, under QCB technology risks for banks, QCB insurance cyber regulation, QCB financial services operator instructions, NCSA NIA Standard v2.1, NCSA penetration testing accreditation, QFMA and NCSA controls for markets and NCSA vulnerability management guidelines. The text gives the regulator no role in testing under QCB payment service provider regulation and QFCRA CTRL 8.5.", "sources": [ "qa-qcb-technology-risks-banks", "qa-qcb-insurance-cyber", "qa-qcb-psp-cyber-2022", "qa-qcb-fso-tech-risk-2022", "qa-qfcra-ctrl-ict-risk", "qa-ncsa-nia-standard", "qa-ncsa-niscf-pentest-accreditation", "qa-qfma-ncsa-nia-fmp", "qa-ncsa-vuln-mgmt-guidelines" ] }, { "q": "Do Qatari rules require social engineering, physical or supplier testing?", "a": "Rules that require the test to cross each seam. Human: QCB financial services operator instructions. Physical: none. Supplier: none. OT: none. Cloud and SaaS: none. 4 more ask only for assurance about suppliers, such as audit rights or the supplier’s own reports. Cross-border provisions, such as foreign branches in scope or limits on where testers sit: QCB technology risks for banks, QCB insurance cyber regulation, QCB payment service provider regulation, QCB financial services operator instructions, QFCRA CTRL 8.5 and NCSA penetration testing accreditation.", "sources": [ "qa-qcb-fso-tech-risk-2022", "qa-qcb-technology-risks-banks", "qa-qcb-insurance-cyber", "qa-qfcra-ctrl-ict-risk", "qa-qfma-ncsa-nia-fmp", "qa-qcb-psp-cyber-2022", "qa-ncsa-niscf-pentest-accreditation" ] } ] }, { "slug": "bahrain", "name": "Bahrain", "the": "Bahrain", "adj": "Bahraini", "answer": "Yes. The Central Bank of Bahrain requires banks to run penetration tests at least twice a year by certified testers, who should be changed at least every two years, and to send every report to the CBB. It can also order red teaming.", "lede": "Yes. The Central Bank of Bahrain requires banks to run penetration tests at least twice a year, by certified testers, and to send every report to the CBB.", "statements": [ { "topic": "Who must test", "text": "CBB rules cover conventional banks, insurers, investment firms, money changers, financing companies that offer internet services, payment and open banking providers, crypto-asset licensees and stablecoin issuers. NCSC controls cover government and private entities in critical sectors.", "sources": [ "bh-cbb-om55-banks", "bh-cbb-rm9-insurance-investment", "bh-cbb-rm3-money-changers", "bh-cbb-om52-financing", "bh-cbb-gr12-ancillary-payments", "bh-cbb-cra58-crypto", "bh-cbb-sio96-stablecoin", "bh-ncsc-baseline-controls" ] }, { "topic": "How often", "text": "Banks, payment service providers, crypto-asset licensees and stablecoin issuers test at least twice a year, and so do financing companies that offer internet services. Insurers and investment firms test once a year, in June. Money changers test once a year, or twice if they offer digital channels. NCSC’s baseline controls require an annual penetration test and a vulnerability assessment at least every three months.", "sources": [ "bh-cbb-om55-banks", "bh-cbb-gr12-ancillary-payments", "bh-cbb-cra58-crypto", "bh-cbb-sio96-stablecoin", "bh-cbb-om52-financing", "bh-cbb-rm9-insurance-investment", "bh-cbb-rm3-money-changers", "bh-ncsc-baseline-controls" ] }, { "topic": "Who may test", "text": "Under every CBB rule but the one for financing companies, testers must be certified and qualified, and independent testers change at least every two years. The bank and money changer rules say they “should be changed”, and the other rules require it. The CBB names no certification scheme. Banks may use internal and external independent parties. Payment and open banking providers must use external, independent testers, and so must crypto-asset licensees and stablecoin issuers for the twice-yearly test. Financing companies must use security professionals “such as ethical hackers”, with no certification or independence rule.", "sources": [ "bh-cbb-om55-banks", "bh-cbb-rm9-insurance-investment", "bh-cbb-rm3-money-changers", "bh-cbb-gr12-ancillary-payments", "bh-cbb-cra58-crypto", "bh-cbb-sio96-stablecoin", "bh-cbb-om52-financing" ] }, { "topic": "Threat-led testing", "text": "The CBB may require a bank to run a red team exercise, which may attack people, premises and third parties, but it sets no cycle. Tests must simulate real-world attacks. CBB rules say threat intelligence should keep incident scenario tests current, but they do not tie penetration test or red team scenarios to it.", "sources": [ "bh-cbb-om55-banks" ] }, { "topic": "Results and the regulator", "text": "The CBB receives every penetration test report: within two months of the test month for banks, and by September 30 for June tests at insurers and investment firms. It receives red team results within one month. It does not lead tests or accredit testers.", "sources": [ "bh-cbb-om55-banks", "bh-cbb-rm9-insurance-investment" ] }, { "topic": "Seams", "text": "Rules that require the test to cross each seam. Human: none. Physical: none. Supplier: CBB OM-5.5 banks, CBB RM-9 insurance and investment, CBB GR-12.2 payments and open banking, CBB CRA-5.8 crypto-asset, CBB SIO-9.6 stablecoin issuers and CBB RM-3 money changers. OT: NCSC baseline controls. Cloud and SaaS: none. One more asks only for assurance about suppliers, such as audit rights or the supplier’s own reports. Cross-border provisions, such as foreign branches in scope or limits on where testers sit: CBB OM-5.5 banks, CBB RM-9 insurance and investment, CBB GR-12.2 payments and open banking, CBB SIO-9.6 stablecoin issuers and CBB RM-3 money changers. The text of NCSC critical-sector standards is not public, so its seam codes are unknown.", "sources": [ "bh-cbb-om55-banks", "bh-cbb-rm9-insurance-investment", "bh-cbb-gr12-ancillary-payments", "bh-cbb-cra58-crypto", "bh-cbb-sio96-stablecoin", "bh-cbb-rm3-money-changers", "bh-ncsc-baseline-controls", "bh-cbb-om52-financing", "bh-ncsc-cni-standards-2026" ] }, { "topic": "What changed", "text": "NCSC Decision No. 36 of 2026, issued August 19, 2026, made cybersecurity standards mandatory for critical sectors, but its Annex 1 is restricted to the entities it covers. We added 5 CBB rules on October 30, 2026; all were in force before September 28.", "sources": [ "bh-ncsc-cni-standards-2026", "bh-cbb-gr12-ancillary-payments", "bh-cbb-cra58-crypto", "bh-cbb-sio96-stablecoin", "bh-cbb-rm3-money-changers", "bh-cbb-om52-financing" ] }, { "topic": "What is not public", "text": "Not public: NCSC critical-sector standards. NCSC restricts Annex 1 of Decision 36/2026, the critical-sector standards, to the entities it covers. The published NCSC baseline still carries a “Draft v 0.2” label.", "sources": [ "bh-ncsc-cni-standards-2026", "bh-ncsc-baseline-controls" ] } ], "faq": [ { "q": "Is penetration testing mandatory for banks and government bodies in Bahrain?", "a": "9 of the 9 Bahraini testing rules we coded are binding: CBB OM-5.5 banks, every 6 months; CBB RM-9 insurance and investment, annual; NCSC baseline controls, annual; NCSC critical-sector standards, text not public; CBB GR-12.2 payments and open banking, every 6 months; CBB CRA-5.8 crypto-asset, every 6 months; CBB SIO-9.6 stablecoin issuers, every 6 months; CBB RM-3 money changers, every 6 months; CBB OM-5.2 financing companies, every 6 months. The cycle after each name is the minimum for the strictest test that rule sets.", "sources": [ "bh-cbb-om55-banks", "bh-cbb-rm9-insurance-investment", "bh-ncsc-baseline-controls", "bh-ncsc-cni-standards-2026", "bh-cbb-gr12-ancillary-payments", "bh-cbb-cra58-crypto", "bh-cbb-sio96-stablecoin", "bh-cbb-rm3-money-changers", "bh-cbb-om52-financing" ] }, { "q": "Who may run a penetration test in Bahrain? Can an in-house team do it?", "a": "In-house teams may test if they meet conditions, such as independence, under CBB OM-5.5 banks, CBB RM-9 insurance and investment, CBB CRA-5.8 crypto-asset, CBB SIO-9.6 stablecoin issuers and CBB RM-3 money changers. An outside tester is required under CBB GR-12.2 payments and open banking. The rule is silent on who tests in NCSC baseline controls and CBB OM-5.2 financing companies. The text is not public for NCSC critical-sector standards. Rules that set tester requirements, such as qualification, certification or independence: CBB OM-5.5 banks, CBB RM-9 insurance and investment, CBB GR-12.2 payments and open banking, CBB CRA-5.8 crypto-asset, CBB SIO-9.6 stablecoin issuers, CBB RM-3 money changers and CBB OM-5.2 financing companies.", "sources": [ "bh-cbb-om55-banks", "bh-cbb-rm9-insurance-investment", "bh-ncsc-baseline-controls", "bh-ncsc-cni-standards-2026", "bh-cbb-gr12-ancillary-payments", "bh-cbb-cra58-crypto", "bh-cbb-sio96-stablecoin", "bh-cbb-rm3-money-changers", "bh-cbb-om52-financing" ] }, { "q": "Is threat-led red teaming required in Bahrain?", "a": "None of the 9 Bahraini rules we coded requires threat intelligence to shape the test. It is recommended under CBB OM-5.5 banks, CBB RM-9 insurance and investment, CBB GR-12.2 payments and open banking, CBB CRA-5.8 crypto-asset, CBB SIO-9.6 stablecoin issuers and CBB RM-3 money changers.", "sources": [ "bh-cbb-om55-banks", "bh-cbb-rm9-insurance-investment", "bh-cbb-gr12-ancillary-payments", "bh-cbb-cra58-crypto", "bh-cbb-sio96-stablecoin", "bh-cbb-rm3-money-changers" ] }, { "q": "Do penetration test results go to the regulator in Bahrain?", "a": "The regulator receives test results under CBB OM-5.5 banks, CBB RM-9 insurance and investment, CBB GR-12.2 payments and open banking, CBB CRA-5.8 crypto-asset, CBB SIO-9.6 stablecoin issuers, CBB RM-3 money changers and CBB OM-5.2 financing companies. The regulator examines testing in supervision, without routine reports, under NCSC baseline controls and NCSC critical-sector standards.", "sources": [ "bh-cbb-om55-banks", "bh-cbb-rm9-insurance-investment", "bh-ncsc-baseline-controls", "bh-ncsc-cni-standards-2026", "bh-cbb-gr12-ancillary-payments", "bh-cbb-cra58-crypto", "bh-cbb-sio96-stablecoin", "bh-cbb-rm3-money-changers", "bh-cbb-om52-financing" ] }, { "q": "Do Bahraini rules require social engineering, physical or supplier testing?", "a": "Rules that require the test to cross each seam. Human: none. Physical: none. Supplier: CBB OM-5.5 banks, CBB RM-9 insurance and investment, CBB GR-12.2 payments and open banking, CBB CRA-5.8 crypto-asset, CBB SIO-9.6 stablecoin issuers and CBB RM-3 money changers. OT: NCSC baseline controls. Cloud and SaaS: none. One more asks only for assurance about suppliers, such as audit rights or the supplier’s own reports. Cross-border provisions, such as foreign branches in scope or limits on where testers sit: CBB OM-5.5 banks, CBB RM-9 insurance and investment, CBB GR-12.2 payments and open banking, CBB SIO-9.6 stablecoin issuers and CBB RM-3 money changers. The text of NCSC critical-sector standards is not public, so its seam codes are unknown.", "sources": [ "bh-cbb-om55-banks", "bh-cbb-rm9-insurance-investment", "bh-cbb-gr12-ancillary-payments", "bh-cbb-cra58-crypto", "bh-cbb-sio96-stablecoin", "bh-cbb-rm3-money-changers", "bh-ncsc-baseline-controls", "bh-cbb-om52-financing", "bh-ncsc-cni-standards-2026" ] } ] }, { "slug": "kuwait", "name": "Kuwait", "the": "Kuwait", "adj": "Kuwaiti", "answer": "Yes. The Central Bank of Kuwait’s CORF, which covers banks and the other firms it regulates, requires red teaming at least once a year with scenarios shaped by threat intelligence, and annual penetration tests of IoT and OT.", "lede": "Yes. The Central Bank of Kuwait’s CORF requires red teaming at least once a year, with scenarios shaped by threat intelligence, and annual tests of IoT and OT.", "statements": [ { "topic": "Who must test", "text": "CORF covers Kuwaiti banks, foreign banks in Kuwait, and exchange, finance, e-payment and credit information companies and open banking providers. NCSC’s baseline controls, Decision 2 of 2026, cover government bodies and private entities in NCSC’s remit.", "sources": [ "kw-cbk-corf", "kw-ncsc-nbcc" ] }, { "topic": "How often", "text": "CORF requires red teaming at least once a year and annual penetration tests of IoT and OT; other tests are periodic or follow significant change. The NCSC baseline requires monthly vulnerability scans of internet-facing systems but no penetration test. E-payment and e-money providers must test each product before launch.", "sources": [ "kw-cbk-corf", "kw-ncsc-nbcc", "kw-cbk-epay-cyber-min" ] }, { "topic": "Who may test", "text": "CORF requires a dedicated, qualified team with specialized expertise and names no certification. It does not say whether the team may be in-house. E-payment providers must have the pre-launch test run by an independent party, in CBK’s Arabic text, or a third party, in its English text.", "sources": [ "kw-cbk-corf", "kw-cbk-epay-cyber-min" ] }, { "topic": "Threat-led testing", "text": "Yes. Threat intelligence must shape CORF red team scenarios, red teams must assess people as well as systems, and the exercise runs without prior knowledge of the monitoring, incident response and asset owner teams.", "sources": [ "kw-cbk-corf" ] }, { "topic": "Results and the regulator", "text": "Red team findings go to senior management, not to CBK. CBK receives annual self-assessments and annual assessments by CBK-approved third parties, and runs its own CORF assessments.", "sources": [ "kw-cbk-corf" ] }, { "topic": "Seams", "text": "Rules that require the test to cross each seam. Human: CBK CORF. Physical: none. Supplier: none. OT: CBK CORF. Cloud and SaaS: none. 2 more ask only for assurance about suppliers, such as audit rights or the supplier’s own reports. Cross-border provisions, such as foreign branches in scope or limits on where testers sit: CBK CORF.", "sources": [ "kw-cbk-corf", "kw-ncsc-nbcc" ] }, { "topic": "What changed", "text": "CBK issued CORF v1.0 on December 3, 2025. NCSC Decision 2 of 2026 was published in the official gazette on April 5, 2026 and gives entities 18 months to comply in full.", "sources": [ "kw-cbk-corf", "kw-ncsc-nbcc" ] }, { "topic": "What is not public", "text": "Partly public: NCSC national baseline controls. The NCSC baseline sits behind a gazette login, so we coded it from a law firm’s reproduction.", "sources": [ "kw-ncsc-nbcc", "kw-ncsc-nbcc" ] } ], "faq": [ { "q": "Is penetration testing mandatory for banks and government bodies in Kuwait?", "a": "3 of the 3 Kuwaiti testing rules we coded are binding: CBK CORF, annual; NCSC national baseline controls, monthly scans, no pentest; CBK e-payment cyber minimum, pre-launch only. The cycle after each name is the minimum for the strictest test that rule sets.", "sources": [ "kw-cbk-corf", "kw-ncsc-nbcc", "kw-cbk-epay-cyber-min" ] }, { "q": "Who may run a penetration test in Kuwait? Can an in-house team do it?", "a": "In-house teams may test if they meet conditions, such as independence, under CBK e-payment cyber minimum. The rule is silent on who tests in CBK CORF and NCSC national baseline controls. Rules that set tester requirements, such as qualification, certification or independence: CBK CORF and CBK e-payment cyber minimum.", "sources": [ "kw-cbk-corf", "kw-ncsc-nbcc", "kw-cbk-epay-cyber-min" ] }, { "q": "Is threat-led red teaming required in Kuwait?", "a": "One rule requires threat intelligence to shape the test. CBK CORF: Threat intelligence must shape red team scenarios. A threat intelligence platform is also required (5.15.1.4).", "sources": [ "kw-cbk-corf" ] }, { "q": "Do penetration test results go to the regulator in Kuwait?", "a": "The regulator examines testing in supervision, without routine reports, under CBK CORF and NCSC national baseline controls. The text gives the regulator no role in testing under CBK e-payment cyber minimum.", "sources": [ "kw-cbk-corf", "kw-ncsc-nbcc", "kw-cbk-epay-cyber-min" ] }, { "q": "Do Kuwaiti rules require social engineering, physical or supplier testing?", "a": "Rules that require the test to cross each seam. Human: CBK CORF. Physical: none. Supplier: none. OT: CBK CORF. Cloud and SaaS: none. 2 more ask only for assurance about suppliers, such as audit rights or the supplier’s own reports. Cross-border provisions, such as foreign branches in scope or limits on where testers sit: CBK CORF.", "sources": [ "kw-cbk-corf", "kw-ncsc-nbcc" ] } ] }, { "slug": "oman", "name": "Oman", "the": "Oman", "adj": "Omani", "answer": "Yes. The Central Bank of Oman requires annual penetration tests of internet-facing systems and, under a January 2026 framework, a threat-led penetration test or red team exercise of critical systems at least every three years. Government assessments must use accredited providers. The Cyber Defence Centre has run that accreditation in place of MTCIT since August 9, 2026.", "lede": "Yes. The Central Bank of Oman requires annual tests of internet-facing systems and a threat-led test or red team exercise of critical systems at least every three years.", "statements": [ { "topic": "Who must test", "text": "CBO rules cover banks, finance and leasing companies, payment service providers, open banking and BNPL providers, and digital banks. The FSA’s guidelines cover listed companies. MTCIT and the Cyber Defence Centre set rules for government units and their IT providers.", "sources": [ "om-cbo-csrf", "om-cbo-psp-licensing", "om-cbo-open-banking", "om-cbo-bnpl", "om-cbo-digital-banks", "om-fsa-infosec-guidelines", "om-mtcit-gov-security-assessment", "om-cdc-external-cloud" ] }, { "topic": "How often", "text": "CBO’s Cyber Security and Resilience Framework requires penetration tests of internet-facing systems at least once a year or on significant change. Payment service and BNPL providers test online services before licensing, then every year. Government websites and applications are assessed before launch, then every one or two years.", "sources": [ "om-cbo-csrf", "om-cbo-psp-licensing", "om-cbo-bnpl", "om-mtcit-gov-security-assessment" ] }, { "topic": "Who may test", "text": "Government security assessments must use providers accredited under the security services accreditation program, which the Cyber Defence Centre took over from MTCIT on August 9, 2026. MTCIT’s GC_S1 standard requires assessors to hold listed certifications and security clearance, and says they should work on site without remote access unless asked. Circular 15/2026 does not say whether the Centre keeps those criteria. Listed companies must involve an independent third party in regular testing. CBO’s main framework sets no tester qualification.", "sources": [ "om-mtcit-gov-security-assessment", "om-fsa-infosec-guidelines", "om-cbo-csrf" ] }, { "topic": "Threat-led testing", "text": "Yes, for banks and finance and leasing companies. CBO’s business continuity framework, issued January 6, 2026, requires a threat-led penetration test or an equivalent red team exercise of critical systems at least once every three years. It does not define critical systems or say when the first test is due.", "sources": [ "om-cbo-bcm-framework" ] }, { "topic": "Results and the regulator", "text": "Most test results stay with the firm. CBO receives business continuity and disaster recovery test reports within six weeks, and open banking applicants file a penetration test report with their license application. Government units that use offshore cloud send the Cyber Defence Centre technical audit reports every six months.", "sources": [ "om-cbo-bcm-framework", "om-cbo-open-banking", "om-cdc-external-cloud" ] }, { "topic": "Seams", "text": "Rules that require the test to cross each seam. Human: none. Physical: none. Supplier: MTCIT managed services standards. OT: none. Cloud and SaaS: CDC external cloud policy. 4 more ask only for assurance about suppliers, such as audit rights or the supplier’s own reports. Cross-border provisions, such as foreign branches in scope or limits on where testers sit: CBO CS&RF, MTCIT government security assessment, CBO BCM framework, CDC external cloud policy and MTCIT managed services standards.", "sources": [ "om-mtcit-managed-services", "om-cdc-external-cloud", "om-cbo-csrf", "om-cbo-bcm-framework", "om-cbo-open-banking", "om-mtcit-gov-security-assessment" ] }, { "topic": "What changed", "text": "We added 9 Omani rules on October 30, 2026, most of them CBO licensing and resilience texts that set testing duties. The September analysis had 2 Omani rows.", "sources": [ "om-cbo-bcm-framework", "om-cbo-open-banking", "om-cbo-psp-licensing", "om-cbo-bnpl", "om-cbo-digital-banks", "om-fsa-infosec-guidelines", "om-cdc-external-cloud", "om-mtcit-managed-services", "om-mtcit-gov-mobile-apps" ] }, { "topic": "What is not public", "text": "Every one of the 11 rules we coded is public. Several MTCIT and Cyber Defence Centre texts are published in Arabic only; the English in their cells is our translation.", "sources": [ "om-mtcit-gov-security-assessment", "om-cdc-external-cloud" ] } ], "faq": [ { "q": "Is penetration testing mandatory for banks and government bodies in Oman?", "a": "10 of the 11 Omani testing rules we coded are binding: CBO CS&RF, annual (internet-facing); MTCIT government security assessment, every 1 to 2 years; CBO open banking framework, periodic, before go-live and on change; CBO PSP licensing policy, annual (online services); CBO BNPL framework, annual (online services); CBO digital bank framework, on CBO request; FSA listed company guidelines, annual; CDC external cloud policy, not specified; MTCIT managed services standards, periodic (not specified); MTCIT government mobile app standards, before launch. One more is guidance, voluntary or mixed: CBO BCM framework, every 3 years (TLPT of critical systems). The cycle after each name is the minimum for the strictest test that rule sets.", "sources": [ "om-cbo-csrf", "om-mtcit-gov-security-assessment", "om-cbo-bcm-framework", "om-cbo-open-banking", "om-cbo-psp-licensing", "om-cbo-bnpl", "om-cbo-digital-banks", "om-fsa-infosec-guidelines", "om-cdc-external-cloud", "om-mtcit-managed-services", "om-mtcit-gov-mobile-apps" ] }, { "q": "Who may run a penetration test in Oman? Can an in-house team do it?", "a": "In-house teams may test if they meet conditions, such as independence, under FSA listed company guidelines. An outside tester is required under CBO digital bank framework and MTCIT government mobile app standards. The rule is silent on who tests in CBO CS&RF, MTCIT government security assessment, CBO BCM framework, CBO open banking framework, CBO PSP licensing policy, CBO BNPL framework, CDC external cloud policy and MTCIT managed services standards. Rules that set tester requirements, such as qualification, certification or independence: MTCIT government security assessment, CBO digital bank framework, FSA listed company guidelines and MTCIT government mobile app standards.", "sources": [ "om-cbo-csrf", "om-mtcit-gov-security-assessment", "om-cbo-bcm-framework", "om-cbo-open-banking", "om-cbo-psp-licensing", "om-cbo-bnpl", "om-cbo-digital-banks", "om-fsa-infosec-guidelines", "om-cdc-external-cloud", "om-mtcit-managed-services", "om-mtcit-gov-mobile-apps" ] }, { "q": "Is threat-led red teaming required in Oman?", "a": "One rule requires threat intelligence to shape the test. CBO BCM framework: The test is threat-led by name, and the glossary defines a red team exercise as intelligence-led. The text does not say who supplies the threat intelligence or how scenarios are chosen.", "sources": [ "om-cbo-bcm-framework" ] }, { "q": "Do penetration test results go to the regulator in Oman?", "a": "The regulator receives test results under CBO open banking framework and CBO BNPL framework. The regulator examines testing in supervision, without routine reports, under CBO CS&RF, CBO PSP licensing policy, CBO digital bank framework, CDC external cloud policy and MTCIT government mobile app standards. The text gives the regulator no role in testing under MTCIT government security assessment, CBO BCM framework, FSA listed company guidelines and MTCIT managed services standards.", "sources": [ "om-cbo-csrf", "om-mtcit-gov-security-assessment", "om-cbo-bcm-framework", "om-cbo-open-banking", "om-cbo-psp-licensing", "om-cbo-bnpl", "om-cbo-digital-banks", "om-fsa-infosec-guidelines", "om-cdc-external-cloud", "om-mtcit-managed-services", "om-mtcit-gov-mobile-apps" ] }, { "q": "Do Omani rules require social engineering, physical or supplier testing?", "a": "Rules that require the test to cross each seam. Human: none. Physical: none. Supplier: MTCIT managed services standards. OT: none. Cloud and SaaS: CDC external cloud policy. 4 more ask only for assurance about suppliers, such as audit rights or the supplier’s own reports. Cross-border provisions, such as foreign branches in scope or limits on where testers sit: CBO CS&RF, MTCIT government security assessment, CBO BCM framework, CDC external cloud policy and MTCIT managed services standards.", "sources": [ "om-mtcit-managed-services", "om-cdc-external-cloud", "om-cbo-csrf", "om-cbo-bcm-framework", "om-cbo-open-banking", "om-mtcit-gov-security-assessment" ] } ] } ], "regimes": [ { "id": "us-nydfs-part500", "jurisdiction": "United States", "region": "US", "sector": "financial", "name": "Cybersecurity Requirements for Financial Services Companies, 23 NYCRR Part 500 (as amended by the Second Amendment)", "short": "NYDFS Part 500", "issuer": "New York State Department of Financial Services (DFS)", "version": "Second Amendment, effective November 1, 2023. Consolidated text PDF re-posted by DFS (file modified 2026-10-22); text identical to the July 2026 PDF coded in September.", "status": "In force as of 2026-09-28. Second Amendment effective November 1, 2023; the last transitional periods (§ 500.12 MFA and § 500.13(a) asset inventory) ran two years from that date, to November 1, 2025 (§ 500.22(d)(4)). Checked the DFS Part 500 page (redirects to a July 2026 PDF of the Second Amendment text), the Cybersecurity Resource Center and the industry letter index on 2026-09-28; found no third amendment.", "public": "full", "primary_url": "https://www.dfs.ny.gov/system/files/documents/2026/07/NYCRR-part-500-Cybersecurity-Regulation.pdf", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No code changes. The DFS Part 500 page now redirects to a new PDF (SHA-256 afb0684ed4b7846ca625179a492683c614296f53b076091486a1ec1484b93684). A word-by-word comparison with the September copy found no difference. The July 2026 PDF URL that all 17 cells cite returned HTTP 403 on 2026-10-30, so the cell URLs should move to the October PDF. The DFS banking and insurance regulatory activity pages (updated 2026-10-21 and 2026-09-23) list no proposal to amend Part 500. One industry letter since September: a Cybersecurity Alert on PHP vulnerabilities (October 22, 2026), which urges patching and sets no testing duty. The cybersecurity FAQ page changed only by a typo fix in an MFA answer. The October 16, 2024 AI letter cited in the social_engineering cell now has a shorter page title; its text is unchanged." }, "notes": "Transition: the Second Amendment took effect November 1, 2023; most new duties applied 180 days later (§ 500.22(c)), § 500.5(a)(2) scanning after 18 months (§ 500.22(d)(3)), and MFA (§ 500.12) and asset inventory (§ 500.13(a)) after two years, November 1, 2025 (§ 500.22(d)(4)). The consolidated PDF DFS links from its Part 500 page carries a disclaimer that it is not the official version; the § 500.1(i), § 500.1(l) and § 500.5 text was cross-checked against the promulgated Second Amendment PDF (rf_fs_2amend23NYCRR500_text_20231101.pdf), which shows the amendment struck the earlier wording that each year's test be 'determined each given year based on relevant identified risks in accordance with the risk assessment'. 2025/2026 guidance, none of which adds requirements: Oct. 16, 2024 AI risks letter; Oct. 21, 2025 third-party service provider letter; May 21, 2026 frontier AI advisory and heightened threat environment guidance; Sept. 10, 2026 risk assessment guidance, which lists penetration testing among the inputs a risk assessment methodology should use. The FTC Safeguards Rule copies much of this structure.", "cells": { "legal_force": { "code": "mandatory", "detail": "A regulation promulgated by the DFS Superintendent under the Banking, Insurance and Financial Services Laws. A single failure to meet an obligation is a violation.", "cite": "§ 500.20(a)-(b)", "url": "https://www.dfs.ny.gov/system/files/documents/2026/07/NYCRR-part-500-Cybersecurity-Regulation.pdf", "quote": "The commission of a single act prohibited by this Part or the failure to act to satisfy an obligation required by this Part shall constitute a violation hereof.", "confidence": "verified" }, "scope": { "code": "DFS-licensed covered entities", "detail": "Any person licensed or chartered under the New York Banking, Insurance or Financial Services Law. Entities with fewer than 20 staff, under $7.5 million revenue or under $15 million assets are exempt from § 500.5 under § 500.19(a). Class A companies (§ 500.1(d)) carry extra duties but the same penetration testing rule.", "cite": "§ 500.1(e); § 500.19(a)", "url": "https://www.dfs.ny.gov/system/files/documents/2026/07/NYCRR-part-500-Cybersecurity-Regulation.pdf", "quote": "Covered entity means any person operating under or required to operate under a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law", "confidence": "verified" }, "frequency": { "code": "annual", "detail": "Penetration testing from inside and outside the system boundary at least once a year. Automated vulnerability scans run at a risk-based frequency and after material system changes (§ 500.5(a)(2)).", "cite": "§ 500.5(a)(1)", "url": "https://www.dfs.ny.gov/system/files/documents/2026/07/NYCRR-part-500-Cybersecurity-Regulation.pdf", "quote": "penetration testing of their information systems from both inside and outside the information systems’ boundaries by a qualified internal or external party at least annually", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "No rule that threat intelligence drive test scenarios. Vulnerability management policies follow the risk assessment, which by definition incorporates threat and vulnerability analyses (§ 500.1(p)). The Second Amendment deleted the older wording that tied each year's test to risks identified in the risk assessment.", "cite": "No provision; full text reviewed (searched: threat intelligence, scenario, threat-led, red team)", "url": "https://www.dfs.ny.gov/system/files/documents/2026/07/NYCRR-part-500-Cybersecurity-Regulation.pdf", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Testers must be a qualified internal or external party. The rule names no accreditation, certification or independence test and does not define qualified.", "cite": "§ 500.5(a)(1)", "url": "https://www.dfs.ny.gov/system/files/documents/2026/07/NYCRR-part-500-Cybersecurity-Regulation.pdf", "quote": "by a qualified internal or external party at least annually", "confidence": "verified" }, "internal_testers": { "code": "allowed", "detail": "In-house testers may run the annual test if qualified.", "cite": "§ 500.5(a)(1)", "url": "https://www.dfs.ny.gov/system/files/documents/2026/07/NYCRR-part-500-Cybersecurity-Regulation.pdf", "quote": "by a qualified internal or external party", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "The rule requires annual awareness training that includes social engineering (§ 500.14(a)(3)), not social engineering testing. DFS guidance of October 16, 2024 lists simulated phishing and voice and video impersonation exercises as a way to deliver that training.", "cite": "§ 500.14(a)(3); DFS Industry Letter, Oct. 16, 2024, Training section", "url": "https://www.dfs.ny.gov/industry-guidance/industry-letters/il20241016-cyber-risks-ai-and-strategies-combat-related-risks", "quote": "Training on social engineering, including on deepfake attacks, can be effectively delivered through simulated phishing, and voice and video impersonation exercises.", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Physical security appears only as a policy area (§ 500.3(j)). The penetration testing duty and definition (§ 500.1(l)) cover information systems only.", "cite": "No provision; full text reviewed (searched: physical, penetration, testing)", "url": "https://www.dfs.ny.gov/system/files/documents/2026/07/NYCRR-part-500-Cybersecurity-Regulation.pdf", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "§ 500.11(a)(4) requires periodic assessment of third-party service providers, not testing of their systems. DFS's October 21, 2025 letter says entities should request vulnerability management updates and review independent assessments such as SOC 2 or ISO 27001; it does not bring provider systems into the penetration test.", "cite": "No provision; full text reviewed (searched: third-party service provider, penetration, testing, assessment)", "url": "https://www.dfs.ny.gov/system/files/documents/2026/07/NYCRR-part-500-Cybersecurity-Regulation.pdf", "confidence": "verified" }, "ot": { "code": "required", "detail": "The annual test covers the entity's information systems, and the definition of information system names industrial and process control systems and environmental control systems. So ICS the entity owns is in scope by definition. The rule gives no OT-specific method or safety rules.", "cite": "§ 500.1(i); § 500.5(a)(1)", "url": "https://www.dfs.ny.gov/system/files/documents/2026/07/NYCRR-part-500-Cybersecurity-Regulation.pdf", "quote": "as well as any specialized system such as industrial/process controls systems, telephone switching and private branch exchange systems, and environmental control systems.", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "The regulation does not name payment, card or market infrastructure systems as a testing target. 'Payment' appears only in extortion payment reporting (§ 500.17(c)).", "cite": "No provision; full text reviewed (searched: payment, wire, SWIFT, card)", "url": "https://www.dfs.ny.gov/system/files/documents/2026/07/NYCRR-part-500-Cybersecurity-Regulation.pdf", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "Cloud appears only in the MFA rule for remote access to cloud-based third-party applications (§ 500.12(a)(2)). DFS's October 2025 letter discusses cloud providers under vendor risk, not testing.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, penetration)", "url": "https://www.dfs.ny.gov/system/files/documents/2026/07/NYCRR-part-500-Cybersecurity-Regulation.pdf", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "No testing provision on foreign entities or data location. A covered entity may meet the Part by adopting an affiliate's program (§ 500.2(d)), and class A thresholds count affiliates 'no matter where located' (§ 500.1(d)), but neither addresses how tests run across borders.", "cite": "No provision; full text reviewed (searched: foreign, jurisdiction, cross-border, affiliate)", "url": "https://www.dfs.ny.gov/system/files/documents/2026/07/NYCRR-part-500-Cybersecurity-Regulation.pdf", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No provision on joint attacker and defender review of test results.", "cite": "No provision; full text reviewed (searched: purple, replay, red team, lessons learned)", "url": "https://www.dfs.ny.gov/system/files/documents/2026/07/NYCRR-part-500-Cybersecurity-Regulation.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Entities must remediate vulnerabilities in a timely way, prioritized by risk. There is no fixed deadline and no retest requirement. An entity that cannot certify compliance must file an acknowledgment with a remediation timeline (§ 500.17(b)(1)(ii)).", "cite": "§ 500.5(c)", "url": "https://www.dfs.ny.gov/system/files/documents/2026/07/NYCRR-part-500-Cybersecurity-Regulation.pdf", "quote": "timely remediate vulnerabilities, giving priority to vulnerabilities based on the risk they pose to the covered entity.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "Test reports are not filed with DFS. Documentation must be available on request, and the CEO and CISO certify compliance each April 15 (§ 500.17(b)). DFS reviews programs in examinations and enforcement.", "cite": "§ 500.2(e); § 500.17(b)", "url": "https://www.dfs.ny.gov/system/files/documents/2026/07/NYCRR-part-500-Cybersecurity-Regulation.pdf", "quote": "All documentation and information relevant to the covered entity’s cybersecurity program", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Automated vulnerability scans are required, with manual review of systems scans do not cover. DFS guidance of October 2024 and a May 21, 2026 advisory on frontier AI models address AI-enabled attacks and urge faster vulnerability management; neither requires AI-driven testing or testing of AI systems.", "cite": "§ 500.5(a)(2)", "url": "https://www.dfs.ny.gov/system/files/documents/2026/07/NYCRR-part-500-Cybersecurity-Regulation.pdf", "quote": "automated scans of information systems, and a manual review of systems not covered by such scans, for the purpose of discovering, analyzing and reporting vulnerabilities", "confidence": "verified" } } }, { "id": "us-ffiec-is-booklet", "jurisdiction": "United States", "region": "US", "sector": "financial", "name": "FFIEC Information Technology Examination Handbook, Information Security booklet (read with the Architecture, Infrastructure, and Operations booklet)", "short": "FFIEC IS booklet", "issuer": "Federal Financial Institutions Examination Council (FRB, FDIC, OCC, NCUA, CFPB, State Liaison Committee)", "version": "Information Security, September 2016 (PDF revised February 2026); Architecture, Infrastructure, and Operations, June 2021", "status": "Current examiner guidance as of 2026-09-28. The FFIEC IT Handbook 'What's New' page (checked 2026-09-28) lists a February 27, 2026 handbook-wide edit removing references to reputational risk under Executive Order 14331 and says the updates do not establish new requirements. No new edition of the Information Security booklet was found.", "public": "full", "primary_url": "https://ithandbook.ffiec.gov/media/swzjlcxk/ffiec_itbooklet_informationsecurity.pdf", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No code changes. Both PDFs fetched on 2026-10-30 through a headless browser (curl gets HTTP 403) have the same SHA-256 as the September copies (64c4726ae64c3ef7a34f5d60d31097f030417eae8dd36dcf19aff095eec7c050 and 2eca52eacb7a949267df1babb06e5892dd661641790fa6024129405655fe2aa0); the server reports Last-Modified 2026-03-11. The InfoBase What's New page still lists February 27, 2026 as its latest entry. OCC Bulletin 2026-48 (September 21, 2026) updated the structure of the OCC Cybersecurity Supervision Work Program, which maps to this booklet, and says it added and changed no procedures." }, "notes": "The booklet ties its testing section to the Interagency Guidelines (footnote 62 cites Information Security Standards section III.C.3). The AIO booklet (June 2021, II.A) expects management to validate infrastructure testing, including penetration testing, through audits and independent assessments, and warns (III.C.4) that unidentified shadow IT can make penetration tests incomplete. The FFIEC CAT, which drew on this booklet, was sunset on August 31, 2025 (separate row).", "cells": { "legal_force": { "code": "supervisory_expectation", "detail": "Examiner guidance, not a rule. It tells examiners how to assess security programs. The binding testing duty sits in the Interagency Guidelines, which the booklet cites.", "cite": "Introduction, p. 1; footnote 62", "url": "https://ithandbook.ffiec.gov/media/swzjlcxk/ffiec_itbooklet_informationsecurity.pdf", "quote": "This booklet provides guidance to examiners and addresses factors necessary to assess the level of security risks", "confidence": "verified" }, "scope": { "code": "FFIEC-supervised institutions and their TSPs", "detail": "Banks, savings associations and credit unions supervised by FFIEC member agencies. Examiners also use the booklet to evaluate technology service providers (footnote 3).", "cite": "Introduction, footnotes 2-3", "url": "https://ithandbook.ffiec.gov/media/swzjlcxk/ffiec_itbooklet_informationsecurity.pdf", "quote": "The term “financial institution” includes national banks, federal savings associations, state savings associations, state member banks, state nonmember banks, and credit unions.", "confidence": "verified" }, "frequency": { "code": "risk-based", "detail": "No fixed interval. Frequency follows the risk assessment. Factors that may raise it include network changes, new systems, shifts in attacker profiles and techniques, and prior results (IV.A.1).", "cite": "IV.A.2(b); IV.A.1", "url": "https://ithandbook.ffiec.gov/media/swzjlcxk/ffiec_itbooklet_informationsecurity.pdf", "quote": "The frequency and scope of a penetration test should be a function of the level of assurance needed by the institution and determined by the risk assessment process.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Threat intelligence appears under security operations (III.A, III.B), not as a driver of test scenarios. Penetration test attacks are 'selected and conducted by the testers' (IV.A.2(b)). Changes in attacker profiles and techniques may raise test frequency (IV.A.1).", "cite": "No provision; full text reviewed (searched: threat intelligence, scenario, penetration test)", "url": "https://ithandbook.ffiec.gov/media/swzjlcxk/ffiec_itbooklet_informationsecurity.pdf", "confidence": "verified" }, "provider_requirements": { "code": "recommended", "detail": "Management should review tester qualifications, require background checks and bonding for contract testers, require NDAs, and decide the level of independence (IV.A.1, IV.A.3). No certification or accreditation is named.", "cite": "IV.A.1 (Personnel; Confidentiality); IV.A.3", "url": "https://ithandbook.ffiec.gov/media/swzjlcxk/ffiec_itbooklet_informationsecurity.pdf", "quote": "Management should review qualifications of testing personnel to verify testers’ capabilities are adequate to support the test objectives.", "confidence": "verified" }, "internal_testers": { "code": "allowed", "detail": "Internal teams may test; management decides how much independence a test needs. IV.A.3 says testers are independent only if they do not design, install, maintain or operate the tested system.", "cite": "IV.A.2(b); IV.A.3", "url": "https://ithandbook.ffiec.gov/media/swzjlcxk/ffiec_itbooklet_informationsecurity.pdf", "quote": "The test can be performed internally by independent groups, internally by the organizational unit, or by an independent third party.", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "Social engineering is listed as one type of penetration test. IV.A.1 also weighs the need to test personnel reactions to unexpected activities when deciding whom to notify.", "cite": "IV.A.2(b)", "url": "https://ithandbook.ffiec.gov/media/swzjlcxk/ffiec_itbooklet_informationsecurity.pdf", "quote": "There are many types of penetration tests (e.g., network, client-side, web application, and social engineering), and management should determine the level and types of tests employed", "confidence": "verified" }, "physical": { "code": "controls_test", "detail": "The booklet expects periodic testing that physical security devices work. It does not mention physical intrusion testing.", "cite": "II.C.8", "url": "https://ithandbook.ffiec.gov/media/swzjlcxk/ffiec_itbooklet_informationsecurity.pdf", "quote": "Periodic testing provides assurance that the devices are operating correctly.", "confidence": "verified", "harmonized_from": "permitted", "harmonize_reason": "II.C.8 expects periodic testing that physical security devices operate correctly; intrusion testing not mentioned." }, "third_party": { "code": "assurance_only", "detail": "Management should obtain independent review of a provider's security through the provider's audit and test reports. Examiners may also evaluate technology service providers directly (Introduction, footnote 3). No requirement to include provider systems in the institution's own tests.", "cite": "II.C.20 (Action Summary)", "url": "https://ithandbook.ffiec.gov/media/swzjlcxk/ffiec_itbooklet_informationsecurity.pdf", "quote": "Independent review of the third party’s security through appropriate reports from audits and tests.", "confidence": "verified", "harmonized_from": "permitted", "harmonize_reason": "II.C.20: obtain independent review of the provider through its audit and test reports." }, "ot": { "code": "not_addressed", "detail": "Neither the Information Security booklet nor the AIO booklet addresses testing of OT or ICS. The AIO booklet (VII.E) notes that IoT devices can make changes to physical systems but sets no testing expectation.", "cite": "No provision; full text reviewed (searched: industrial control, SCADA, operational technology, control system)", "url": "https://ithandbook.ffiec.gov/media/swzjlcxk/ffiec_itbooklet_informationsecurity.pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "Payment systems appear only as network segments (e.g., funds transfer and ACH routers, II.C.9) and in cross-references to the Retail Payment Systems booklet, which was not reviewed for this slice. No payment-specific testing expectation in the booklet.", "cite": "No provision; full text reviewed (searched: payment, wire, ACH, SWIFT, card, penetration)", "url": "https://ithandbook.ffiec.gov/media/swzjlcxk/ffiec_itbooklet_informationsecurity.pdf", "confidence": "verified" }, "cloud_saas": { "code": "assurance_only", "detail": "The AIO booklet lists penetration tests among third-party assurance reviews that help an institution understand a cloud provider's controls. The IS booklet refers cloud oversight to the FFIEC Outsourced Cloud Computing statement (II.C.20(a)).", "cite": "AIO booklet VII.A.5", "url": "https://ithandbook.ffiec.gov/media/ywfm2ftz/ffiec_itbooklet_aio.pdf", "quote": "Third-party assurance reviews (e.g., SOC reviews, penetration tests, and vulnerability assessments) can provide an understanding of the cloud service provider’s control environment", "confidence": "verified", "harmonized_from": "permitted", "harmonize_reason": "AIO VII.A.5 lists penetration tests among third-party assurance reviews of cloud providers." }, "cross_border": { "code": "not_addressed", "detail": "The only jurisdiction reference concerns where cloud-stored data resides and its legal jurisdiction (II.C.13), not testing.", "cite": "No provision; full text reviewed (searched: foreign, cross-border, jurisdiction)", "url": "https://ithandbook.ffiec.gov/media/swzjlcxk/ffiec_itbooklet_informationsecurity.pdf", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "III.D expects incident response testing through scenario planning and tabletop tests with internal and external parties. No provision on joint attacker and defender review of penetration test results.", "cite": "No provision; full text reviewed (searched: purple, replay, red team, lessons learned)", "url": "https://ithandbook.ffiec.gov/media/swzjlcxk/ffiec_itbooklet_informationsecurity.pdf", "confidence": "verified" }, "remediation_retest": { "code": "recommended", "detail": "Internal audit should track remediation of findings from penetration tests. Issues found in pre-launch tests of external-facing applications should be fixed before launch (II.C.17). Reports should suggest remediation options and flag repeat issues (IV.A.4). No deadline and no retest expectation.", "cite": "IV.A.2(d); IV.A.4; II.C.17", "url": "https://ithandbook.ffiec.gov/media/swzjlcxk/ffiec_itbooklet_informationsecurity.pdf", "quote": "Internal audit should track the results and the remediation of control deficiencies reported in audits and additional technical reviews, such as penetration tests and vulnerability assessments.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "Examiners assess whether management uses penetration tests, vulnerability assessments, self-assessments and audits with adequate coverage, depth and independence. Results are not filed with the agencies.", "cite": "Appendix A, Objective 10", "url": "https://ithandbook.ffiec.gov/media/swzjlcxk/ffiec_itbooklet_informationsecurity.pdf", "quote": "Determine whether assurance activities provide sufficient confidence that the security program is operating as expected and reaching intended goals.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Scanners and other tools may run continuously. The booklet does not mention AI.", "cite": "IV.A.2(c)", "url": "https://ithandbook.ffiec.gov/media/swzjlcxk/ffiec_itbooklet_informationsecurity.pdf", "quote": "Scanners and other tools can be run continuously, generating metrics that are reported and acted upon continuously.", "confidence": "verified" } } }, { "id": "us-ffiec-cat", "jurisdiction": "United States", "region": "US", "sector": "financial", "name": "FFIEC Cybersecurity Assessment Tool", "short": "FFIEC CAT (sunset)", "issuer": "Federal Financial Institutions Examination Council", "version": "May 2017 update; sunset August 31, 2025", "status": "Sunset on August 31, 2025. FFIEC statement of August 29, 2024 announced the sunset and removal from the FFIEC website; Fed SR 24-7 (Nov. 22, 2024) superseded SR 15-9. FFIEC pointed institutions to NIST CSF 2.0, CISA Cybersecurity Performance Goals (cross-sector and financial sector), the Cyber Risk Institute Cyber Profile and CIS Critical Security Controls. NCUA continues to support its ACET. The May 2017 PDF was still retrievable at the ffiec.gov URL on 2026-09-28.", "public": "full", "primary_url": "https://www.ffiec.gov/sites/default/files/media/resources/FFIEC_CAT_May_2017.pdf", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No code changes; still sunset. The May 2017 PDF is still hosted and has the same SHA-256 as the September copy (ec155fc994efabb6a8dfc6c6117bba12186ca4927d1e0111598a9629446d3cfa). The CAT Sunset Statement PDF cited in three cells (legal_force, scope, regulator_role) (https://www.ffiec.gov/sites/default/files/media/press-releases/2024/cat-sunset-statement-ffiec-letterhead.pdf) returned \"Page Not Found\" through a browser on 2026-10-30, although the FFIEC announcement page (Announcement 2024-03) and the FFIEC Cybersecurity Awareness page still link to it. The September raw copy stays the source; OCC Bulletin 2024-25 and Fed SR 24-7, which repeat the sunset, still resolve." }, "notes": "The only federal-agency text found in this slice that mentions red team testing is the CAT's Domain 3 Advanced maturity statement (p. 42): 'Penetration tests include cyber attack simulations and/or real-world tactics and techniques such as red team testing to detect control gaps in employee behavior, security defenses, policies, and resources.' It was voluntary and is now sunset. Page numbers are the printed page numbers of the May 2017 PDF. A copy incorporated by reference in Florida Rule 69U-100.045 (Jan. 2021) was also saved; its maturity pages are mostly scanned images and it was not relied on.", "cells": { "legal_force": { "code": "voluntary", "detail": "A voluntary self-assessment. The FFIEC says such tools are not examination programs. Sunset August 31, 2025.", "cite": "CAT Sunset Statement, p. 1", "url": "https://www.ffiec.gov/sites/default/files/media/press-releases/2024/cat-sunset-statement-ffiec-letterhead.pdf", "quote": "The CAT was released in June 2015 as a voluntary assessment tool to help financial institutions identify their risks and determine their cybersecurity preparedness.", "confidence": "verified" }, "scope": { "code": "financial institutions (voluntary)", "detail": "Designed for any financial institution supervised by FFIEC member agencies to self-assess inherent risk and maturity in five domains and five maturity levels.", "cite": "CAT Sunset Statement, p. 1", "url": "https://www.ffiec.gov/sites/default/files/media/press-releases/2024/cat-sunset-statement-ffiec-letterhead.pdf", "quote": "to help financial institutions identify their risks and determine their cybersecurity preparedness", "confidence": "verified" }, "frequency": { "code": "risk-based", "detail": "Baseline maturity calls for independent testing according to the risk assessment. Evolving calls for routine independent penetration tests of the network boundary and critical web-facing applications. No fixed interval.", "cite": "Domain 3, Detective Controls, Threat and Vulnerability Detection, Baseline and Evolving (p. 41)", "url": "https://www.ffiec.gov/sites/default/files/media/resources/FFIEC_CAT_May_2017.pdf", "quote": "Independent testing (including penetration testing and vulnerability scanning) is conducted according to the risk assessment for external-facing systems and the internal network.", "confidence": "verified" }, "threat_intel": { "code": "recommended", "detail": "At Intermediate maturity, resilience testing should rest on realistic, likely and emerging threats. Domain 2 maturity statements use threat intelligence to update configuration standards and predict attacks.", "cite": "Domain 5, Incident Resilience Planning and Strategy, Testing, Intermediate (p. 53)", "url": "https://www.ffiec.gov/sites/default/files/media/resources/FFIEC_CAT_May_2017.pdf", "quote": "Resilience testing is based on analysis and identification of realistic and highly likely threats as well as new and emerging threats facing the institution.", "confidence": "verified" }, "provider_requirements": { "code": "recommended", "detail": "Testing is to be independent. At Intermediate maturity, audit or risk staff review test scope and results to decide whether to rotate testing firms based on quality. No certification named.", "cite": "Domain 3, Detective Controls, Threat and Vulnerability Detection, Intermediate (p. 41)", "url": "https://www.ffiec.gov/sites/default/files/media/resources/FFIEC_CAT_May_2017.pdf", "quote": "Audit or risk management resources review the penetration testing scope and results to help determine the need for rotating companies based on the quality of the work.", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Statements call for 'independent' testing without saying whether in-house staff can qualify.", "cite": "No provision; full text reviewed (searched: internal, independent, penetration)", "url": "https://www.ffiec.gov/sites/default/files/media/resources/FFIEC_CAT_May_2017.pdf", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "At Evolving maturity, training effectiveness is validated with social engineering or phishing tests. At Advanced maturity, penetration tests include red team testing that looks for control gaps in employee behavior (Domain 3, p. 42).", "cite": "Domain 1, Training and Culture, Evolving (p. 28)", "url": "https://www.ffiec.gov/sites/default/files/media/resources/FFIEC_CAT_May_2017.pdf", "quote": "The institution validates the effectiveness of training (e.g., social engineering or phishing tests).", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Physical access appears only as a preventive control. No statement on testing physical security.", "cite": "No provision; full text reviewed (searched: physical, penetration, red team)", "url": "https://www.ffiec.gov/sites/default/files/media/resources/FFIEC_CAT_May_2017.pdf", "confidence": "verified" }, "third_party": { "code": "permitted", "detail": "At Advanced maturity, incident response testing considers how assets at critical third parties may be targeted. At Baseline, business continuity testing involves critical third parties.", "cite": "Domain 5, Incident Resilience Planning and Strategy, Testing, Advanced (p. 53); Baseline (p. 52)", "url": "https://www.ffiec.gov/sites/default/files/media/resources/FFIEC_CAT_May_2017.pdf", "quote": "Incident response testing evaluates the institution from an attacker's perspective to determine how the institution or its assets at critical third parties may be targeted.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No statement on OT or ICS.", "cite": "No provision; full text reviewed (searched: industrial control, SCADA, operational technology)", "url": "https://www.ffiec.gov/sites/default/files/media/resources/FFIEC_CAT_May_2017.pdf", "confidence": "verified" }, "payment_systems": { "code": "permitted", "detail": "At Intermediate maturity, the institution takes part in sector exercises, with a payment processor attack exercise given as the example.", "cite": "Domain 5, Incident Resilience Planning and Strategy, Testing, Intermediate (p. 53)", "url": "https://www.ffiec.gov/sites/default/files/media/resources/FFIEC_CAT_May_2017.pdf", "quote": "The institution participates in sector-specific cyber exercises or scenarios (e.g., FS-ISAC Cyber Attack (against) Payment Processors (CAPP)).", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "Cloud appears only in the Inherent Risk Profile as a count of cloud providers, not in testing statements.", "cite": "No provision; full text reviewed (searched: cloud, SaaS)", "url": "https://www.ffiec.gov/sites/default/files/media/resources/FFIEC_CAT_May_2017.pdf", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "No statement on cross-border testing.", "cite": "No provision; full text reviewed (searched: foreign, cross-border, jurisdiction)", "url": "https://www.ffiec.gov/sites/default/files/media/resources/FFIEC_CAT_May_2017.pdf", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "Intermediate maturity uses exercise results to improve the incident response plan, but no statement on joint attacker and defender review of test results.", "cite": "No provision; full text reviewed (searched: purple, replay, lessons learned)", "url": "https://www.ffiec.gov/sites/default/files/media/resources/FFIEC_CAT_May_2017.pdf", "confidence": "verified" }, "remediation_retest": { "code": "recommended", "detail": "Baseline: issues are resolved by criticality within set time frames. Intermediate: penetration tests are repeated to confirm medium- and high-risk findings are fixed. Advanced: unresolved medium and high findings go to the board for risk acceptance.", "cite": "Domain 3, Corrective Controls, Remediation, Intermediate (p. 46)", "url": "https://www.ffiec.gov/sites/default/files/media/resources/FFIEC_CAT_May_2017.pdf", "quote": "Penetration testing is repeated to confirm that medium- and high-risk, exploitable vulnerabilities have been resolved.", "confidence": "verified" }, "regulator_role": { "code": "not_addressed", "detail": "The FFIEC states the self-assessment tools are not examination programs. Use was voluntary and results were not filed.", "cite": "CAT Sunset Statement, pp. 1-2", "url": "https://www.ffiec.gov/sites/default/files/media/press-releases/2024/cat-sunset-statement-ffiec-letterhead.pdf", "quote": "The tools are not examination programs", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Innovative maturity calls for weekly vulnerability scanning across all environments and automated code scanning in development. No AI statements.", "cite": "Domain 3, Detective Controls, Threat and Vulnerability Detection, Innovative (p. 42)", "url": "https://www.ffiec.gov/sites/default/files/media/resources/FFIEC_CAT_May_2017.pdf", "quote": "Vulnerability scanning is performed on a weekly basis across all environments.", "confidence": "verified" } } }, { "id": "us-sec-reg-sci", "jurisdiction": "United States", "region": "US", "sector": "financial", "name": "Regulation Systems Compliance and Integrity (Regulation SCI), 17 CFR 242.1000-242.1007", "short": "SEC Reg SCI", "issuer": "U.S. Securities and Exchange Commission", "version": "eCFR text current to 2026-10-28; no amendment since the September snapshot", "status": "In force as of 2026-09-28. The March 2023 proposed amendments (Release 34-97143, 88 FR 23146, Apr. 14, 2023), which would have required penetration testing at least annually instead of every three years, were formally withdrawn on June 12, 2025 (Release 33-11377; 90 FR 25531, June 17, 2025). No new Reg SCI proposal found.", "public": "full", "primary_url": "https://www.ecfr.gov/current/title-17/chapter-II/part-242", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No code changes. eCFR text of §§ 242.1000 to 242.1007 at 2026-10-28 is identical to the 2026-09-24 copies. The SEC rulemaking activity index lists no Regulation SCI release in 2026, and the SEC regulatory flexibility agenda printed in the Federal Register on August 14, 2026 (FR Doc. 2026-16619) has no Regulation SCI or cybersecurity item. The full Unified Agenda on reginfo.gov could not be reached (HTTP 502). On September 22, 2026 the SEC settled an enforcement action against the operator of an SCI alternative trading system for missing Rule 1001(a) policies, including on application vulnerability management, testing and remediation (SEC press release 2026-91). It applies the existing rule and changes no cell." }, "notes": "The withdrawn 2023 proposal would have moved the SCI review content into § 242.1000, required penetration testing at least annually, and required tests to include vulnerabilities identified under § 242.1001(a)(2)(iv) (Release 34-97143, section on penetration testing, pp. 129-130). The same June 12, 2025 notice also withdrew the SEC's proposed cybersecurity risk management rule for broker-dealers, clearing agencies, exchanges and others (88 FR 20212, Apr. 5, 2023). The SEC Division of Examinations FY2026 priorities (p. 13) list Reg SCI incident response and third-party vendor risk; this is a staff statement with no legal force.", "cells": { "legal_force": { "code": "mandatory", "detail": "An SEC rule under the Exchange Act. SCI entities must run an annual SCI review that includes penetration test reviews.", "cite": "§ 242.1003(b)(1)", "url": "https://www.ecfr.gov/current/title-17/section-242.1003", "quote": "Conduct an SCI review of the SCI entity's compliance with Regulation SCI not less than once each calendar year", "confidence": "verified" }, "scope": { "code": "SCI entities", "detail": "Exchanges, registered securities associations, registered clearing agencies, the MSRB, SCI ATSs above volume thresholds, plan processors, exempt clearing agencies subject to ARP and SCI competing consolidators. Broker-dealers and advisers are outside it.", "cite": "§ 242.1000 (SCI entity)", "url": "https://www.ecfr.gov/current/title-17/section-242.1000", "quote": "SCI entity means an SCI self-regulatory organization, SCI alternative trading system, plan processor, exempt clearing agency subject to ARP, or SCI competing consolidator.", "confidence": "verified" }, "frequency": { "code": "every 3 years", "detail": "The SCI review is annual, but penetration test reviews of the network, firewalls and production systems need only occur once every three years. Designated members must join BC/DR plan tests at least every 12 months (§ 242.1004(b)).", "cite": "§ 242.1003(b)(1)(i)", "url": "https://www.ecfr.gov/current/title-17/section-242.1003", "quote": "Penetration test reviews of the network, firewalls, and production systems shall be conducted at a frequency of not less than once every three years", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Policies must provide for regular reviews and testing to identify vulnerabilities to internal and external threats (§ 242.1001(a)(2)(iv)), but no rule that threat intelligence drive test scenarios.", "cite": "No provision; full text reviewed (searched: threat intelligence, scenario, threat-led)", "url": "https://www.ecfr.gov/current/title-17/chapter-II/part-242", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "The SCI review must be performed by objective personnel with appropriate experience, following established procedures and standards. No certification named.", "cite": "§ 242.1000 (SCI review)", "url": "https://www.ecfr.gov/current/title-17/section-242.1000", "quote": "SCI review means a review, following established procedures and standards, that is performed by objective personnel having appropriate experience to conduct reviews of SCI systems and indirect SCI systems", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "The rule text does not require outside reviewers. Reviewers must be objective and experienced.", "cite": "§ 242.1000 (SCI review)", "url": "https://www.ecfr.gov/current/title-17/section-242.1000", "quote": "performed by objective personnel having appropriate experience", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: social engineering, phishing, personnel)", "url": "https://www.ecfr.gov/current/title-17/chapter-II/part-242", "confidence": "verified" }, "physical": { "code": "controls_test", "detail": "The SCI review must assess the design and effectiveness of physical security controls over SCI systems and indirect SCI systems. This is a controls assessment, not physical intrusion testing.", "cite": "§ 242.1000 (SCI review, para. (2))", "url": "https://www.ecfr.gov/current/title-17/section-242.1000", "quote": "An assessment of internal control design and effectiveness of its SCI systems and indirect SCI systems to include logical and physical security controls, development processes, and information technology governance", "confidence": "verified", "harmonized_from": "required", "harmonize_reason": "SCI review assesses design and effectiveness of physical security controls (17 CFR 242.1000); no intrusion testing." }, "third_party": { "code": "required", "detail": "SCI systems and indirect SCI systems include systems operated on behalf of the SCI entity, so vendor-operated systems fall inside the SCI review. § 242.1004 also requires designated members or participants to join BC/DR testing. The SEC's FY2026 exam priorities name third-party vendor risk and vendor systems that qualify as SCI systems.", "cite": "§ 242.1000 (SCI systems; indirect SCI systems); § 242.1004(b)", "url": "https://www.ecfr.gov/current/title-17/section-242.1000", "quote": "SCI systems means all computer, network, electronic, technical, automated, or similar systems of, or operated by or on behalf of, an SCI entity", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: industrial control, operational technology, SCADA)", "url": "https://www.ecfr.gov/current/title-17/chapter-II/part-242", "confidence": "verified" }, "payment_systems": { "code": "required", "detail": "The regime covers securities market infrastructure itself: systems supporting trading, clearance and settlement, order routing and market data.", "cite": "§ 242.1000 (SCI systems)", "url": "https://www.ecfr.gov/current/title-17/section-242.1000", "quote": "that, with respect to securities, directly support trading, clearance and settlement, order routing, market data, market regulation, or market surveillance.", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "No explicit cloud provision; cloud-hosted systems are covered only through the 'operated by or on behalf of' definition.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, hosting)", "url": "https://www.ecfr.gov/current/title-17/chapter-II/part-242", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: foreign, cross-border, jurisdiction)", "url": "https://www.ecfr.gov/current/title-17/chapter-II/part-242", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: purple, replay, red team)", "url": "https://www.ecfr.gov/current/title-17/chapter-II/part-242", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Entities must periodically review their policies and promptly remedy deficiencies. The SCI review report goes to senior management within 30 days and to the SEC and board with management's response within 60 days (§ 242.1003(b)(2)-(3)). No deadline for fixing individual test findings and no retest rule.", "cite": "§ 242.1001(a)(3)", "url": "https://www.ecfr.gov/current/title-17/section-242.1001", "quote": "take prompt action to remedy deficiencies in such policies and procedures.", "confidence": "verified" }, "regulator_role": { "code": "receives_results", "detail": "The SEC receives each SCI review report, which covers penetration test reviews, and examines SCI entities.", "cite": "§ 242.1003(b)(3)", "url": "https://www.ecfr.gov/current/title-17/section-242.1003", "quote": "Submit to the Commission, and to the board of directors of the SCI entity or the equivalent of such board, a report of the SCI review required by paragraph (b)(1) of this section, together with any response by senior management", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "'Automated' appears only in the SCI systems definition.", "cite": "No provision; full text reviewed (searched: automated testing, continuous, artificial intelligence)", "url": "https://www.ecfr.gov/current/title-17/chapter-II/part-242", "confidence": "verified" } } }, { "id": "us-cftc-system-safeguards", "jurisdiction": "United States", "region": "US", "sector": "financial", "name": "CFTC system safeguards testing requirements for designated contract markets, swap execution facilities, derivatives clearing organizations and swap data repositories (17 CFR 38.1051, 37.1401, 39.18, 49.24)", "short": "CFTC system safeguards", "issuer": "U.S. Commodity Futures Trading Commission", "version": "eCFR text current to 2026-10-28; testing provisions adopted 81 FR 64272 (September 19, 2016); no amendment since the September snapshot", "status": "In force as of 2026-09-28. The December 2023 proposed Operational Resilience Framework for futures commission merchants, swap dealers and major swap participants was withdrawn (CFTC press release 9117-25, Sept. 9, 2025; 90 FR 43949, Sept. 11, 2025), so intermediaries have no CFTC testing rule.", "public": "full", "primary_url": "https://www.ecfr.gov/current/title-17/section-38.1051", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No code changes. eCFR text of all four sections at 2026-10-28 is identical to the 2026-09-24 copies. CFTC Staff Letter 26-16 (May 29, 2026), a staff advisory on moving to 24-hour, 7-day trading and clearing, says DCOs may need revised enterprise technology risk assessments covering penetration testing, and states it \"does not create new obligations.\" It was issued before the September snapshot but not cited then; it changes no cell. A CFTC advance notice of October 13, 2026 asks how system safeguards should apply to crypto asset markets (see watch list)." }, "notes": "One row for four parallel rules. Differences: DCOs and SDRs have annual and quarterly minimums regardless of size; DCMs only if covered (5% volume test); SEFs have no minimum frequencies and no mandatory independent contractor test (§ 37.1401(h)). Only the DCO rule (§ 39.18(d)(3)) extends testing to outsourced resources. Futures commission merchants and swap dealers have no CFTC testing rule after the September 2025 withdrawal of the Operational Resilience Framework proposal.", "cells": { "legal_force": { "code": "mandatory", "detail": "CFTC regulations implementing the system safeguards core principles. Parallel text binds DCMs (§ 38.1051), SEFs (§ 37.1401), DCOs (§ 39.18) and SDRs (§ 49.24).", "cite": "§ 38.1051(h); § 37.1401(h); § 39.18(e); § 49.24(j)", "url": "https://www.ecfr.gov/current/title-17/section-38.1051", "quote": "A designated contract market shall conduct regular, periodic, objective testing and review of its automated systems to ensure that they are reliable, secure, and have adequate scalable capacity.", "confidence": "verified" }, "scope": { "code": "DCMs, SEFs, DCOs, SDRs", "detail": "All four registrant types must run vulnerability, external and internal penetration, controls, incident response plan testing and technology risk assessments. Minimum frequencies apply to all DCOs and SDRs and to covered DCMs, those with 5% or more of total DCM trading volume. SEFs and non-covered DCMs test at risk-based frequencies.", "cite": "§ 38.1051(h)(1) (Covered designated contract market)", "url": "https://www.ecfr.gov/current/title-17/section-38.1051", "quote": "Covered designated contract market means a designated contract market whose annual total trading volume in calendar year 2015, or in any subsequent calendar year, is five percent (5%) or more of the combined annual total trading volume of all designated contract markets", "confidence": "verified" }, "frequency": { "code": "annual (DCOs, SDRs, covered DCMs)", "detail": "External and internal penetration tests at least annually and vulnerability testing at least quarterly for DCOs, SDRs and covered DCMs. Key controls tested at least every three years. SEFs and non-covered DCMs: risk-based.", "cite": "§ 39.18(e)(2)-(5); § 49.24(j)(2)-(5); § 38.1051(h)(2)-(5)", "url": "https://www.ecfr.gov/current/title-17/section-39.18", "quote": "shall conduct such external penetration testing at a frequency determined by an appropriate risk analysis, but no less frequently than annually.", "confidence": "verified" }, "threat_intel": { "code": "required", "detail": "Test scope must cover what the entity's current cybersecurity threat analysis shows is needed to find paths for an intruder, unauthorized user or insider. This ties scope to threat analysis; it does not prescribe intelligence-led scenarios.", "cite": "§ 38.1051(k); § 39.18(e)(8); § 49.24(l); § 37.1401(k)", "url": "https://www.ecfr.gov/current/title-17/section-38.1051", "quote": "shall be broad enough to include the testing of automated systems and controls that the designated contract market's required program of risk analysis and oversight and its current cybersecurity threat analysis indicate is necessary", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "DCOs, SDRs and covered DCMs must use independent contractors for the annual external penetration test and for key controls testing every three years. A DCO's contractor must be independent of any outside provider that built or maintains the tested resources (§ 39.18(d)(3)). No certification named.", "cite": "§ 38.1051(h)(3)(ii); § 39.18(e)(3)(ii); § 49.24(j)(3)(ii)", "url": "https://www.ecfr.gov/current/title-17/section-38.1051", "quote": "A covered designated contract market shall engage independent contractors to conduct the required annual external penetration test.", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "Employees may run internal penetration tests, vulnerability tests and other tests if they are not responsible for developing or operating the systems tested. The required annual external test at DCOs, SDRs and covered DCMs must be by independent contractors.", "cite": "§ 38.1051(h)(4)(ii)", "url": "https://www.ecfr.gov/current/title-17/section-38.1051", "quote": "by engaging independent contractors, or by using employees of the designated contract market who are not responsible for development or operation of the systems or capabilities being tested.", "confidence": "verified" }, "social_engineering": { "code": "controls_test", "detail": "Controls testing must include testing of each control in the program of risk analysis and oversight (§ 38.1051(h)(5)(i)), and the program's information security category includes security awareness training and personnel security and screening (§ 38.1051(a)(2)). Parallel text binds SEFs (§ 37.1401), DCOs (§ 39.18) and SDRs (§ 49.24). No text names social engineering, phishing or pretexting as a test method.", "cite": "§ 38.1051(a)(2), (h)(5)(i); § 39.18(b)(2)(i), (e)(5)", "url": "https://www.ecfr.gov/current/title-17/section-38.1051", "confidence": "verified", "quote": "This category includes, but is not limited to, controls relating to: Access to systems and data (including least privilege, separation of duties, account monitoring and control); user and device identification and authentication; security awareness training", "history": [ { "date": "2026-10-30", "from": "not_addressed", "to": "controls_test", "why": "Controls testing must cover each control in the program, and the information security category lists security awareness training and personnel security and screening. A mandatory test of people-reliant controls that names no method is controls_test, as for this row's physical cell, DFSA GEN 5.5.15(a) and CMA VASP Art. 51(16)(a)." } ], "harmonized_from": "not_addressed", "harmonize_reason": "R2: Controls testing must cover each control in the program, and the information security category lists security awareness training and personnel security and screening. A mandatory test of people-reliant controls that names no method is controls_test, as for this row's physical cell, DFSA GEN 5.5.15(a) and CMA VASP Art. 51(16)(a)." }, "physical": { "code": "controls_test", "detail": "Controls testing must cover each control in the risk program, and that program must include physical access and monitoring. This is controls testing, not physical intrusion testing.", "cite": "§ 38.1051(a)(7), (h)(5)(i); § 39.18(b)(2)(vi), (e)(5)", "url": "https://www.ecfr.gov/current/title-17/section-38.1051", "quote": "Physical security and environmental controls. This category includes, but is not limited to: Physical access and monitoring", "confidence": "verified", "harmonized_from": "required", "harmonize_reason": "Controls testing covers the physical access and monitoring category (38.1051(a)(7), 39.18(b)(2)(vi)); no intrusion testing." }, "third_party": { "code": "required", "detail": "For DCOs, testing must cover outsourced resources and confirm own and outsourced resources work together. The DCM, SEF and SDR rules list outsourcing and vendor management as a program category but have no equivalent clause.", "cite": "§ 39.18(d)(3)", "url": "https://www.ecfr.gov/current/title-17/section-39.18", "quote": "The testing referred to in paragraph (e) of this section shall apply to all of the derivatives clearing organization's own and outsourced resources, and shall verify that all such resources will work together effectively.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: industrial control, operational technology, SCADA)", "url": "https://www.ecfr.gov/current/title-17/section-38.1051", "confidence": "verified" }, "payment_systems": { "code": "required", "detail": "The rules apply to derivatives market infrastructure itself: trading venues, clearing houses and trade repositories. Testing covers the automated systems that run these functions.", "cite": "§ 38.1051(c), (h)", "url": "https://www.ecfr.gov/current/title-17/section-38.1051", "quote": "Order processing and trade matching; transmission of matched orders to a designated clearing organization for clearing; price reporting; market surveillance; and maintenance of a comprehensive audit trail.", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "No provision naming cloud.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, hosting)", "url": "https://www.ecfr.gov/current/title-17/section-38.1051", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: foreign, cross-border, jurisdiction)", "url": "https://www.ecfr.gov/current/title-17/section-38.1051", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "Incident response plan testing may use walk-throughs, tabletop exercises, simulations and comprehensive exercises (§ 38.1051(h)(1)), but no joint attacker and defender review.", "cite": "No provision; full text reviewed (searched: purple, replay, red team)", "url": "https://www.ecfr.gov/current/title-17/section-38.1051", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Entities must document findings, decide whether to remediate or accept each risk, and remediate in a timely manner. Senior management and the board review results (§ 38.1051(l)). No fixed deadline and no retest rule.", "cite": "§ 38.1051(m); § 39.18(e)(10); § 49.24(n); § 37.1401(m)", "url": "https://www.ecfr.gov/current/title-17/section-38.1051", "quote": "When the designated contract market determines to remediate a vulnerability or deficiency, it must remediate in a timely manner given the nature and magnitude of the associated risk.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "Reports of all required tests must be given to the CFTC promptly on request. They are not filed routinely.", "cite": "§ 38.1051(g)(3); § 39.18(f); § 37.1401(g)(3)", "url": "https://www.ecfr.gov/current/title-17/section-38.1051", "quote": "All reports concerning system safeguards testing and assessment required by this chapter, whether performed by independent contractors or by employees of the designated contract market", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Vulnerability testing must include automated vulnerability scanning. No AI text.", "cite": "§ 38.1051(h)(2)(ii); § 39.18(e)(2)(ii)", "url": "https://www.ecfr.gov/current/title-17/section-38.1051", "quote": "Such vulnerability testing shall include automated vulnerability scanning, which shall follow generally accepted best practices.", "confidence": "verified" } } }, { "id": "us-interagency-infosec-guidelines", "jurisdiction": "United States", "region": "US", "sector": "financial", "name": "Interagency Guidelines Establishing Information Security Standards (12 CFR part 30 app. B; 12 CFR part 208 app. D-2; 12 CFR part 364 app. B) and NCUA Guidelines for Safeguarding Member Information (12 CFR part 748 app. A)", "short": "Interagency GLBA rules", "issuer": "OCC, Federal Reserve Board, FDIC; NCUA (parallel text)", "version": "eCFR text current to 2026-10-28; OCC and FDIC appendices last amended 91 FR 18293 (April 10, 2026; effective June 9, 2026)", "status": "In force as of 2026-09-28 (eCFR current text checked). No 2025 or 2026 amendment to the testing paragraph found. Implements GLBA section 501(b) and FDIA section 39.", "public": "full", "primary_url": "https://www.ecfr.gov/current/title-12/part-30/appendix-Appendix%20B%20to%20Part%2030", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No code changes. All four texts at 2026-10-28 are identical to the 2026-09-24 copies. The OCC and FDIC reputation risk rule (91 FR 18279, published April 10, 2026, effective June 9, 2026) amended Supplement A of the OCC and FDIC appendices to drop a sentence on reputation risk in customer notice. A diff of the OCC appendix before and after that date shows no other change; the testing paragraph III.C.3 is untouched. The September snapshot already reflected the amended text." }, "notes": "This is the binding federal testing duty for most US banks and credit unions. It requires 'regular' testing of key controls without naming penetration testing, a frequency or a method. The FFIEC Information Security booklet (footnote 62) is the examiner guidance that interprets it. GLBA itself (15 U.S.C. 6801) contains no testing provision; it is implemented through these Guidelines and the FTC Safeguards Rule.", "cells": { "legal_force": { "code": "mandatory", "detail": "Guidelines codified in agency rules under FDIA section 39 and GLBA section 501(b). Institutions 'shall' test key controls; frequency and tester independence use 'should'. Agencies can act under section 39.", "cite": "App. B, I.B; III.C.3", "url": "https://www.ecfr.gov/current/title-12/part-30/appendix-Appendix%20B%20to%20Part%2030", "quote": "The OCC may take action under section 39 and these Guidelines independently of, in conjunction with, or in addition to, any other enforcement action available to the OCC.", "confidence": "verified" }, "scope": { "code": "insured banks, savings associations, credit unions", "detail": "OCC: national banks, federal savings associations, federal branches and agencies of foreign banks. Fed: state member banks. FDIC: state nonmember banks. NCUA: federally insured credit unions. The same testing sentence appears in each text.", "cite": "12 CFR 30 app. B, I.A; 208 app. D-2 and 364 app. B, III.C.3; 748 app. A, III.C.3", "url": "https://www.ecfr.gov/current/title-12/part-30/appendix-Appendix%20B%20to%20Part%2030", "quote": "national banks, Federal savings associations, Federal branches and Federal agencies of foreign banks, and any subsidiaries of such entities", "confidence": "verified" }, "frequency": { "code": "risk-based", "detail": "Regular testing of key controls; frequency and nature set by the risk assessment. No penetration test is named.", "cite": "App. B, III.C.3", "url": "https://www.ecfr.gov/current/title-12/part-30/appendix-Appendix%20B%20to%20Part%2030", "quote": "Regularly test the key controls, systems and procedures of the information security program. The frequency and nature of such tests should be determined by the national bank's or Federal savings association's risk assessment.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Institutions must identify reasonably foreseeable internal and external threats in the risk assessment (III.B.1). No rule on threat intelligence driving tests.", "cite": "No provision; full text reviewed (searched: threat intelligence, scenario, penetration)", "url": "https://www.ecfr.gov/current/title-12/part-30/appendix-Appendix%20B%20to%20Part%2030", "confidence": "verified" }, "provider_requirements": { "code": "recommended", "detail": "Tests should be run or reviewed by independent third parties or independent staff. No qualification or certification named.", "cite": "App. B, III.C.3", "url": "https://www.ecfr.gov/current/title-12/part-30/appendix-Appendix%20B%20to%20Part%2030", "quote": "Tests should be conducted or reviewed by independent third parties or staff independent of those that develop or maintain the security programs.", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "In-house staff may test if independent of those who develop or maintain the program.", "cite": "App. B, III.C.3", "url": "https://www.ecfr.gov/current/title-12/part-30/appendix-Appendix%20B%20to%20Part%2030", "quote": "staff independent of those that develop or maintain the security programs", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "Access controls must stop employees giving customer data to people using fraudulent means (III.C.1.a), but no testing provision.", "cite": "No provision; full text reviewed (searched: social engineering, phishing, pretext)", "url": "https://www.ecfr.gov/current/title-12/part-30/appendix-Appendix%20B%20to%20Part%2030", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Physical access restrictions are a control to consider (III.C.1.b). No specific physical testing text.", "cite": "No provision; full text reviewed (searched: physical, penetration, test)", "url": "https://www.ecfr.gov/current/title-12/part-30/appendix-Appendix%20B%20to%20Part%2030", "confidence": "verified" }, "third_party": { "code": "assurance_only", "detail": "Where the risk assessment indicates, institutions monitor service providers, and should review audits, summaries of test results or equivalent evaluations. No duty to test provider systems directly.", "cite": "App. B, III.D.3", "url": "https://www.ecfr.gov/current/title-12/part-30/appendix-Appendix%20B%20to%20Part%2030", "quote": "As part of this monitoring, a national bank or Federal savings association should review audits, summaries of test results, or other equivalent evaluations of its service providers.", "confidence": "verified", "harmonized_from": "permitted", "harmonize_reason": "App. B III.D.3: review audits, summaries of test results or equivalent evaluations of providers." }, "ot": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: industrial control, operational technology)", "url": "https://www.ecfr.gov/current/title-12/part-30/appendix-Appendix%20B%20to%20Part%2030", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No testing provision.", "cite": "No provision; full text reviewed (searched: payment, wire, card, SWIFT)", "url": "https://www.ecfr.gov/current/title-12/part-30/appendix-Appendix%20B%20to%20Part%2030", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: cloud, SaaS)", "url": "https://www.ecfr.gov/current/title-12/part-30/appendix-Appendix%20B%20to%20Part%2030", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "Supplement A expects contracts with 'domestic and foreign service providers' to cover incident response, not testing.", "cite": "No provision; full text reviewed (searched: foreign, cross-border)", "url": "https://www.ecfr.gov/current/title-12/part-30/appendix-Appendix%20B%20to%20Part%2030", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: purple, replay, red team)", "url": "https://www.ecfr.gov/current/title-12/part-30/appendix-Appendix%20B%20to%20Part%2030", "confidence": "verified" }, "remediation_retest": { "code": "recommended", "detail": "Institutions shall adjust the program as threats and technology change (III.E). The annual board report should cover results of testing and management's responses. No deadline or retest rule.", "cite": "App. B, III.E; III.F", "url": "https://www.ecfr.gov/current/title-12/part-30/appendix-Appendix%20B%20to%20Part%2030", "quote": "The reports should discuss material matters related to its program, addressing issues such as: risk assessment; risk management and control decisions; service provider arrangements; results of testing", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "Test results are not filed. Agencies assess compliance in supervision, using the FFIEC Information Security booklet, and may act under section 39.", "cite": "App. B, I.B", "url": "https://www.ecfr.gov/current/title-12/part-30/appendix-Appendix%20B%20to%20Part%2030", "quote": "The OCC may take action under section 39 and these Guidelines", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: automated, continuous, artificial intelligence)", "url": "https://www.ecfr.gov/current/title-12/part-30/appendix-Appendix%20B%20to%20Part%2030", "confidence": "verified" } } }, { "id": "us-ftc-safeguards-rule", "jurisdiction": "United States", "region": "US", "sector": "financial", "name": "Standards for Safeguarding Customer Information (FTC Safeguards Rule), 16 CFR part 314", "short": "FTC Safeguards Rule", "issuer": "U.S. Federal Trade Commission", "version": "eCFR text current to 2026-10-28; last amended 88 FR 77508 (November 13, 2023), effective May 13, 2024", "status": "In force as of 2026-09-28. The 2023 amendment added FTC breach notification (§ 314.4(j)), effective May 13, 2024 (§ 314.5). No later amendment in the eCFR text.", "public": "full", "primary_url": "https://www.ecfr.gov/current/title-16/section-314.4", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No code changes. eCFR text of part 314 at 2026-10-28 is identical to the 2026-09-24 copy, and the eCFR version history shows no amendment after 2024-05-13. The Federal Register shows no FTC rule or proposal on part 314 since 2026-01-01; the only Safeguards Rule item is a paperwork renewal notice (91 FR 54872, August 25, 2026)." }, "notes": "The only US federal rule in this slice that lets continuous monitoring substitute for annual penetration testing. The information system definition mirrors 23 NYCRR 500.1(i).", "cells": { "legal_force": { "code": "mandatory", "detail": "A trade regulation rule implementing GLBA section 501(b) for financial institutions under FTC jurisdiction.", "cite": "§ 314.4 (introductory text); § 314.4(d)(2)", "url": "https://www.ecfr.gov/current/title-16/section-314.4", "quote": "In order to develop, implement, and maintain your information security program, you shall:", "confidence": "verified" }, "scope": { "code": "non-bank financial institutions under FTC jurisdiction", "detail": "Mortgage brokers, lenders, finance companies, tax preparers and other non-bank firms engaged in financial activities. Firms with customer information on fewer than 5,000 consumers are exempt from the penetration testing paragraph (§ 314.6).", "cite": "§ 314.1(b); § 314.6", "url": "https://www.ecfr.gov/current/title-16/section-314.6", "quote": "Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers.", "confidence": "verified" }, "frequency": { "code": "annual (unless continuous monitoring)", "detail": "Annual penetration testing and vulnerability assessments every six months, unless the firm runs effective continuous monitoring.", "cite": "§ 314.4(d)(2)(i)-(ii)", "url": "https://www.ecfr.gov/current/title-16/section-314.4", "quote": "Annual penetration testing of your information systems determined each given year based on relevant identified risks in accordance with the risk assessment", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Each year's test is set by 'relevant identified risks in accordance with the risk assessment' (§ 314.4(d)(2)(i)). No threat intelligence requirement.", "cite": "No provision; full text reviewed (searched: threat intelligence, scenario)", "url": "https://www.ecfr.gov/current/title-16/section-314.4", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "The rule sets no tester qualification or independence rule. It requires qualified security personnel generally (§ 314.4(e)(2)); the penetration testing definition refers only to 'assessors' (§ 314.2(n)).", "cite": "No provision; full text reviewed (searched: qualified, independent, assessor, certification)", "url": "https://www.ecfr.gov/current/title-16/section-314.4", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Silent on who may test.", "cite": "No provision; full text reviewed (searched: internal, employee, independent)", "url": "https://www.ecfr.gov/current/title-16/section-314.4", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "Security awareness training is required (§ 314.4(e)(1)); no social engineering testing.", "cite": "No provision; full text reviewed (searched: social engineering, phishing)", "url": "https://www.ecfr.gov/current/title-16/section-314.4", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Penetration testing covers information systems only.", "cite": "No provision; full text reviewed (searched: physical, penetration)", "url": "https://www.ecfr.gov/current/title-16/section-314.4", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "Firms must periodically assess service providers based on risk (§ 314.4(f)(3)); no testing of provider systems.", "cite": "No provision; full text reviewed (searched: service provider, testing, penetration)", "url": "https://www.ecfr.gov/current/title-16/section-314.4", "confidence": "verified" }, "ot": { "code": "required", "detail": "The annual test covers the firm's information systems, and the definition includes industrial and process control systems that contain or connect to customer information.", "cite": "§ 314.2(j); § 314.4(d)(2)(i)", "url": "https://www.ecfr.gov/current/title-16/section-314.2", "quote": "as well as any specialized system such as industrial/process controls systems, telephone switching and private branch exchange systems, and environmental controls systems that contains customer information or that is connected to a system that contains customer information.", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No testing provision.", "cite": "No provision; full text reviewed (searched: payment, card, wire, SWIFT)", "url": "https://www.ecfr.gov/current/title-16/section-314.4", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: cloud, SaaS)", "url": "https://www.ecfr.gov/current/title-16/section-314.4", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: foreign, cross-border)", "url": "https://www.ecfr.gov/current/title-16/section-314.4", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: purple, replay, red team)", "url": "https://www.ecfr.gov/current/title-16/section-314.4", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Firms must evaluate and adjust the program in light of test results. The annual board report covers results of testing (§ 314.4(i)(2)). No deadline or retest rule.", "cite": "§ 314.4(g)", "url": "https://www.ecfr.gov/current/title-16/section-314.4", "quote": "Evaluate and adjust your information security program in light of the results of the testing and monitoring required by paragraph (d) of this section", "confidence": "verified" }, "regulator_role": { "code": "not_addressed", "detail": "Test results go to the board, not the FTC (§ 314.4(i)). The FTC receives only notification events (§ 314.4(j)) and enforces through investigations.", "cite": "No provision; full text reviewed (searched: Commission, report, submit, examination)", "url": "https://www.ecfr.gov/current/title-16/section-314.4", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Continuous monitoring can replace the annual penetration test and semiannual vulnerability assessments. No AI text.", "cite": "§ 314.4(d)(2)", "url": "https://www.ecfr.gov/current/title-16/section-314.4", "quote": "the monitoring and testing shall include continuous monitoring or periodic penetration testing and vulnerability assessments.", "confidence": "verified" } } }, { "id": "us-fisma-nist", "jurisdiction": "United States", "region": "US", "sector": "government", "name": "Federal Information Security Modernization Act of 2014 (44 U.S.C. 3551-3558) with NIST SP 800-53 Rev. 5 controls CA-8, RA-5, SA-11 and SP 800-53B baselines", "short": "FISMA + NIST 800-53", "issuer": "U.S. Congress (statute); NIST (SP 800-53, SP 800-53B); OMB and CISA (FISMA metrics)", "version": "44 U.S.C. 3554 as amended through Pub. L. 115-390 (Dec. 21, 2018); SP 800-53 Rev. 5 Release 5.2.0 (Aug. 27, 2025); SP 800-53B (Dec. 10, 2020)", "status": "In force as of 2026-09-28. Checked the CSRC SP 800-53 page (planning note of Aug. 27, 2025 announcing Release 5.2.0) and the Release 5.2.0 summary of changes: CA-8, RA-5 and SA-11 text did not change and SP 800-53B has no changes. No later release found on CSRC. The Cornell text of 44 U.S.C. 3554 shows no amendment after 2018.", "public": "full", "primary_url": "https://www.law.cornell.edu/uscode/text/44/3554", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No change to any cell. The CSRC SP 800-53 page still shows Release 5.2.0 (planning note Aug. 27, 2025) as the latest; CSRC news through Oct. 27, 2026 lists no SP 800-53, 800-53A, 800-53B or 800-115 release. NIST OSCAL content v1.6.0 (Oct. 22, 2026) only fixes labels in SA-15(13), SA-24 and SI-02(07). The Cornell text of 44 U.S.C. 3553 to 3555 is unchanged from September (still through Pub. L. 115-390). The FY2026-27 CIO FISMA metrics v1.1 file has the same SHA-256 as in September. CISA has published no FY2026 IG FISMA metrics. On Oct. 20, 2026 NIST renamed the COSAiS project (SP 800-53 overlays for AI systems) to COSIS, Control Overlays for Super Intelligence Systems, citing EO 14434; it still has only a concept paper and an annotated outline. The SP 800-82r4 initial public draft (Sept. 21, 2026, comments due Nov. 30, 2026) proposes an OT overlay that keeps CA-8 at High and removes CA-8(1); see watch list." }, "notes": "Baselines (SP 800-53B Table 3-4): CA-8 and CA-8(1) are in the High baseline only; CA-8(2) red team and CA-8(3) facility penetration testing are in no baseline; CA-2(1) independent assessors is in Moderate and High. RA-5 is in Low, Moderate and High; RA-5(4), RA-5(5) and RA-5(11) (public disclosure program) are selected; RA-5(10), which asks agencies to correlate scan output to find multi-hop attack paths, is in no baseline. SA-11 is in Moderate and High; SA-11(5) developer penetration testing is in no baseline. SR-6 is in Moderate and High; SR-6(1) supply chain testing is in no baseline. PE-3(6) and RA-5(9) were withdrawn into CA-8. 2025 and 2026 changes: NIST Release 5.2.0 (Aug. 27, 2025) implemented EO 14306 sec. 2(b)(ii) on patch deployment and added SA-15(13), SA-24 and SI-02(07); none touches CA-8. NIST's COSAiS project (SP 800-53 overlays for AI systems) had only a concept paper (Aug. 14, 2025) and an annotated outline (Jan. 8, 2026) as of the CSRC page. OMB M-25-04 (Jan. 15, 2025) is the last FISMA guidance memo found; the OMB memoranda index lists M-26-01 to M-26-19 and none is FY2026 FISMA guidance. The FY2026-27 CIO FISMA metrics v1.1 (Sept. 1, 2026) add a 'Ground Truth Testing' section that asks whether the agency has a red team (CIO-FY26-0111), whether red team and penetration tests use threat intelligence TTPs (CIO-FY26-0113), and an HVA question on the share of HVA components tested annually (CIO-FY26-0057). EO 14306 (June 6, 2025) struck parts of EO 14144 but added no testing requirement for agencies; EO 14144 sec. 3(e) (renumbered 3(c)) still calls for continuous assessments, testing, exercises and modeling of federal space systems. EO 14409 (June 2, 2026) directs CISA to issue directives that expand AI-enabled defensive tools and creates an AI cybersecurity clearinghouse for vulnerability scanning; it sets no penetration test requirement.", "cells": { "legal_force": { "code": "mandatory", "detail": "FISMA is a statute that obliges every agency to test controls at least annually. NIST states the SP 800-53 controls are mandatory for federal information systems under OMB Circular A-130 and FISMA; SP 800-53B baselines set which controls apply.", "cite": "44 U.S.C. 3554(b)(5); SP 800-53 Rev. 5 Sec. 1.1", "url": "https://www.law.cornell.edu/uscode/text/44/3554", "quote": "The use of these controls is mandatory for federal information systems in accordance with Office of Management and Budget (OMB) Circular A-130 [OMB A-130] and the provisions of the Federal Information Security Modernization Act", "confidence": "verified" }, "scope": { "code": "all federal agencies; CA-8 at high impact", "detail": "Every agency must test management, operational and technical controls of every system in its inventory. Penetration testing (CA-8) and an independent tester (CA-8(1)) are selected only in the High baseline of SP 800-53B; CA-8(2) red team and CA-8(3) facility testing sit in no baseline. National security systems are outside FISMA's NIST mandate (SP 800-53 Sec. 1.1, fn. 11).", "cite": "44 U.S.C. 3554(b)(5)(A); SP 800-53B Table 3-4 (CA-8, CA-8(1), CA-8(2), CA-8(3))", "url": "https://www.law.cornell.edu/uscode/text/44/3554", "quote": "shall include testing of management, operational, and technical controls of every information system identified in the inventory required under section 3505(c)", "confidence": "verified" }, "frequency": { "code": "annual (statute); CA-8 org-defined", "detail": "FISMA sets a floor of at least annual testing and evaluation. CA-8 leaves penetration test frequency to the organization.", "cite": "44 U.S.C. 3554(b)(5); SP 800-53 Rev. 5 CA-8", "url": "https://www.law.cornell.edu/uscode/text/44/3554", "quote": "to be performed with a frequency depending on risk, but no less than annually", "confidence": "verified" }, "threat_intel": { "code": "recommended", "detail": "CA-8 discussion asks organizations to match rules of engagement to expected adversary tactics, and says red teams work best with knowledge of current adversary TTPs. No text requires threat intelligence to drive scenarios. The FY2026-27 CIO FISMA metrics ask agencies whether red team and penetration tests use TTPs from threat intelligence (CIO-FY26-0113), a reporting question only.", "cite": "SP 800-53 Rev. 5 CA-8 Discussion; CA-8(2) Discussion; FY26-27 CIO FISMA Metrics v1.1, CIO-FY26-0113", "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf", "quote": "Organizations correlate the rules of engagement for the penetration tests with the tools, techniques, and procedures that are anticipated to be employed by adversaries.", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "CA-8(1) requires an independent penetration testing agent or team and is selected in the High baseline. Independence means freedom from conflicts with the development, operation or management of the target. No accreditation or certification scheme is named; the discussion only asks for demonstrable skills and experience.", "cite": "SP 800-53 Rev. 5 CA-8(1) and Discussion; CA-8 Discussion; SP 800-53B Table 3-4", "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf", "quote": "Employ an independent penetration testing agent or team to perform penetration testing on the system or system components.", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "Agency staff may test if they are free of conflicts of interest with the target system, as CA-8(1) defines independence by impartiality, not by employer. Risk assessments set the level of independence.", "cite": "SP 800-53 Rev. 5 CA-8(1) Discussion; CA-8 Discussion", "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf", "quote": "Impartiality implies that penetration testing agents or teams are free from perceived or actual conflicts of interest with respect to the development, operation, or management of the systems that are the targets of the penetration testing.", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "CA-8(2) red team exercises may include social engineering by email, phone, shoulder surfing or conversation. CA-8(2) is optional: SP 800-53B puts it in no baseline.", "cite": "SP 800-53 Rev. 5 CA-8(2) Discussion; SP 800-53B Table 3-4", "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf", "quote": "Such attempts may include technology-based attacks and social engineering-based attacks. Technology-based attacks include interactions with hardware, software, or firmware components and/or mission and business processes. Social engineering-based attacks include interactions via email, telephone, shoulder surfing, or personal conversations.", "confidence": "verified" }, "physical": { "code": "permitted", "detail": "CA-8(3) covers announced or unannounced attempts to bypass physical access points, and CA-8 says penetration tests can exercise physical controls. CA-8(3) is in no SP 800-53B baseline, so it is optional.", "cite": "SP 800-53 Rev. 5 CA-8(3); CA-8 Discussion; SP 800-53B Table 3-4", "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf", "quote": "Employ a penetration testing process that includes [Assignment: organization-defined frequency] [Selection: announced; unannounced] attempts to bypass or circumvent controls associated with physical access points to the facility.", "confidence": "verified" }, "third_party": { "code": "required", "detail": "The controls, including CA-8 at High, apply to federal information systems, which NIST defines to include systems operated by contractors. FISMA's agency program also covers systems provided or managed by contractors. Testing of supply chain elements and actors (SR-6(1)) is optional and in no baseline.", "cite": "SP 800-53 Rev. 5 Sec. 1.1 fn. 10; 44 U.S.C. 3554(b); SR-6(1); SP 800-53B Table 3-20 (SR-6(1))", "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf", "quote": "A federal information system is an information system used or operated by an agency, a contractor of an agency, or another organization on behalf of an agency.", "confidence": "verified" }, "ot": { "code": "permitted", "detail": "NIST states the catalog covers industrial control and cyber-physical systems, and CA-8 applies to organization-defined systems or components. No control sets OT-specific testing rules.", "cite": "SP 800-53 Rev. 5 Executive Summary; Chapter One; CA-8", "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf", "quote": "safeguarding measures for all types of computing platforms, including general purpose computing systems, cyber-physical systems, cloud-based systems, ... environmental control systems, super computers, and industrial control systems.", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "FISMA and the NIST testing controls do not mention payment systems, SWIFT, card data or market infrastructure.", "cite": "No provision; full text reviewed (SP 800-53 Rev. 5 CA-8, RA-5, SA-11, SR-6; 44 U.S.C. 3553-3555; searched: payment, SWIFT, card, financial market)", "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf", "confidence": "verified" }, "cloud_saas": { "code": "permitted", "detail": "The catalog covers cloud-based systems, and systems run by other organizations on an agency's behalf are federal information systems. No testing control mentions cloud. Cloud services used by agencies are tested under FedRAMP (see us-fedramp-rev5 and us-fedramp-cr26).", "cite": "SP 800-53 Rev. 5 Executive Summary; Sec. 1.1 fn. 10", "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf", "quote": "safeguarding measures for all types of computing platforms, including general purpose computing systems, cyber-physical systems, cloud-based systems", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "No provision on multi-country tests, foreign group entities or data location during testing.", "cite": "No provision; full text reviewed (SP 800-53 Rev. 5 CA-8, RA-5, SA-11, SR-6; 44 U.S.C. 3554; searched: foreign, international, cross-border, jurisdiction, residency)", "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "Red team results feed awareness training and control assessment, but no text calls for purple teaming or joint replay with defenders.", "cite": "No provision; full text reviewed (SP 800-53 Rev. 5 CA-8 and enhancements; searched: purple, replay, workshop, blue team)", "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "FISMA requires a remedial action process. CA-5 plans of action and milestones are in every baseline, and RA-5(d) requires remediation within organization-defined response times. No fixed deadline or mandated retest.", "cite": "44 U.S.C. 3554(b)(6); SP 800-53 Rev. 5 CA-5, RA-5(d); SP 800-53B Table 3-4 (CA-5)", "url": "https://www.law.cornell.edu/uscode/text/44/3554", "quote": "a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "Each Inspector General or independent auditor must evaluate the agency every year, including testing a representative subset of systems. OMB's FY2025 IG metrics tell IGs to weigh penetration test results. CISA (DHS) may hunt for threats and run vulnerability assessments on agency systems under 44 U.S.C. 3553(b)(6)(D) and (b)(7).", "cite": "44 U.S.C. 3555(a)(2)(A); 44 U.S.C. 3553(b)(6)(D) and (b)(7); FY2025 IG FISMA Reporting Metrics v2.0, p. 9", "url": "https://www.law.cornell.edu/uscode/text/44/3555", "quote": "testing of the effectiveness of information security policies, procedures, and practices of a representative subset of the agency’s information systems", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "FISMA requires automated tools in annual testing. CA-8 says penetration testing goes beyond automated scanning. The FY2026-27 CIO FISMA metrics add pilot questions on AI systems, including whether assessments cover AI-specific risks (CIO-FY26-0170).", "cite": "44 U.S.C. 3554(b)(5)(C); SP 800-53 Rev. 5 CA-8 Discussion; FY26-27 CIO FISMA Metrics v1.1, CIO-FY26-0170", "url": "https://www.law.cornell.edu/uscode/text/44/3554", "quote": "shall include using automated tools, consistent with standards and guidelines promulgated under section 11331 of title 40", "confidence": "verified" } } }, { "id": "us-fedramp-rev5", "jurisdiction": "United States", "region": "US", "sector": "government", "name": "FedRAMP Rev5 security controls baselines (legacy) and FedRAMP Penetration Test Guidance", "short": "FedRAMP Rev5 (legacy)", "issuer": "General Services Administration, FedRAMP Program Management Office", "version": "Rev5 Security Controls Baseline workbook (legacy notice June 23, 2026; docs-legacy commit 3227be5, build changes only since September); Penetration Test Guidance Version 3, 06/30/2022", "status": "Legacy but still used as of 2026-09-28. FedRAMP marked the Rev5 baseline workbook and playbook as legacy on June 23-24, 2026 and is replacing them with the Consolidated Rules for 2026 (optional from July 4, 2026, mandatory from Jan. 1, 2027; no new Rev5 certifications after June 11, 2027). Agency-sponsored Rev5 assessments still follow the legacy process alongside the new rules.", "public": "full", "primary_url": "https://raw.githubusercontent.com/FedRAMP/docs-legacy/ed5e17f7c69a99a2511a93655353224b23bcf72e/overrides/assets/LEGACY%20FedRAMP_Security_Controls_Baseline.xlsx", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "The regulator's text did not change. What changed is our evidence: the controlling Penetration Test Guidance v3.0 (06/30/2022), which could not be downloaded in September, was retrieved on 2026-10-30 from www.fedramp.gov through a web fetch tool (SHA-256 ad0daa9c839bfae9...). Direct curl to www.fedramp.gov still failed. All four cells marked unverified in September (threat_intel, social_engineering, physical, cross_border) keep their codes and are now verified against v3.0. Two details from draft v4.0 do not appear in v3.0 and should be dropped: the one-week minimum phishing campaign and the provider-run red team option (Appendix D of the draft). v3.0 has no red team appendix at all. The FedRAMP docs-legacy repository shows only build and RSS changes since commit ed5e17f (Sept. 23, 2026). The Consolidated Rules timeline still ends new Rev5 certifications on June 11, 2027." }, "notes": "FedRAMP selects more penetration testing than NIST does for agencies: CA-8(1) independent tester and CA-8(2) red team exercises are in the FedRAMP Moderate and High baselines, while SP 800-53B puts CA-8(2) in no baseline and CA-8 in High only. FedRAMP assigns no parameter for CA-8(2). CA-8(3) facility testing is not in any FedRAMP baseline. Draft PTG v4.0 (Mar. 2024) proposed six mandatory attack vectors (External to Corporate with phishing, External to CSP Target System, Tenant to CSP Management System, Tenant-to-Tenant, Mobile Application, Client-side Application and Agents) and added red team requirements in Appendix D. The controlling Penetration Test Guidance v3.0 (June 30, 2022) could not be downloaded: www.fedramp.gov connections were reset by the local network for the whole session. This code rests on draft v4.0 (Mar. 4, 2024, public comment), which FedRAMP never finalized as far as found. Under the FedRAMP Authorization Act (44 U.S.C. 3613(e)), assessments in a FedRAMP package are presumed adequate for agency use.", "cells": { "legal_force": { "code": "mandatory", "detail": "Agencies must obtain and maintain a FedRAMP authorization for in-scope cloud services (OMB M-24-15 Sec. III under the FedRAMP Authorization Act). The Rev5 baselines set CA-8 with a FedRAMP parameter of at least annually.", "cite": "OMB M-24-15 Sec. III (as published in FedRAMP Consolidated Rules 2026, authority/m-24-15/scope)", "url": "https://raw.githubusercontent.com/FedRAMP/2026-markdown/2f81e380a6615d48927a72c5007df785c038f891/authority/m-24-15/scope.md", "quote": "Agencies must obtain and maintain a FedRAMP authorization when the cloud product or service falls within the scope of this section.", "confidence": "verified" }, "scope": { "code": "cloud services used by agencies", "detail": "Cloud IaaS, PaaS and SaaS that create, collect, process, store or maintain federal information for an agency. CA-8 is in the FedRAMP Low, Moderate and High baselines and LI-SaaS ('Document and Assess').", "cite": "OMB M-24-15 Sec. III; FedRAMP Rev5 baseline workbook, sheets Low/Moderate/High (CA-08) and LI-SaaS row 35", "url": "https://raw.githubusercontent.com/FedRAMP/2026-markdown/2f81e380a6615d48927a72c5007df785c038f891/authority/m-24-15/scope.md", "quote": "The scope of FedRAMP is cloud computing products and services (such as IaaS, Platform-as-a-Service (PaaS), and SaaS) that create, collect, process, store, or maintain Federal information on behalf of a Federal agency", "confidence": "verified" }, "frequency": { "code": "annual", "detail": "Code confirmed by v3.0 Sec. 7.0: initial test no more than 6 months before the assessment report, then at least every 12 months unless an authorizing body approves otherwise.", "cite": "FedRAMP Penetration Test Guidance v3.0, Sec. 7.0; Rev5 baseline workbook CA-08", "url": "https://www.fedramp.gov/resources/documents/CSP_Penetration_Test_Guidance.pdf", "quote": "Once within the continuous monitoring phase of the FedRAMP process, additional penetration testing activities must be performed at least every 12 months, unless otherwise approved by an authorizing body with documented rationale.", "confidence": "verified" }, "threat_intel": { "code": "recommended", "detail": "Code confirmed against the controlling v3.0 text. Section 2.1 sets minimum threat models aligned with current adversary tactics in \"should\" language, and Section 2.2 points to MITRE ATT&CK. Cite moves from draft v4.0 to v3.0. Confidence moves from unverified to verified.", "cite": "FedRAMP Penetration Test Guidance v3.0 (06/30/2022), Sec. 2.1 and 2.2", "url": "https://www.fedramp.gov/resources/documents/CSP_Penetration_Test_Guidance.pdf", "quote": "FedRAMP penetration testing follows multiple threat models developed to align with current adversarial tactics and techniques.", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Code unchanged. v3.0 Sec. 8.0 requires the assessor to show penetration testing proficiency and keep a defined methodology, and the test team lead to hold an industry-recognized penetration testing credential. A FedRAMP recognized 3PAO is mandatory for JAB P-ATO systems; for agency ATOs, v3.0 lets '3PAO' mean any assessment organization the agency AO designates (About This Document). The September cell cited draft v4.0 Sec. 8 for this point.", "cite": "FedRAMP Penetration Test Guidance v3.0, Sec. 8.0", "url": "https://www.fedramp.gov/resources/documents/CSP_Penetration_Test_Guidance.pdf", "quote": "All penetration test activities must be performed by a 3PAO that has demonstrated penetration testing proficiency and maintains a defined penetration test methodology.", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "Code unchanged, detail corrected. v3.0 has no provider-run red team option; that was a draft v4.0 proposal. In v3.0 the 3PAO runs the test (Sec. 7.0), and for agency ATOs the agency AO may designate the assessment organization. The 3PAO may use the provider's established phishing program if it provides or approves the templates and landing pages, and it must either run the campaign itself or independently evaluate a third party campaign (Sec. 3.1.1).", "cite": "FedRAMP Penetration Test Guidance v3.0, Sec. 3.1.1 and 8.0; Rev5 baseline workbook CA-08 (01)", "url": "https://www.fedramp.gov/resources/documents/CSP_Penetration_Test_Guidance.pdf", "quote": "3PAOs must either perform this attack vector themselves, or independently evaluate the effectiveness of a third party phishing campaign.", "confidence": "verified" }, "social_engineering": { "code": "required", "detail": "Code confirmed against v3.0. External to Corporate is one of six mandatory attack vectors, and it requires a phishing attack on the provider's system administrators and the managers who can influence them. Deviations need authorizing official approval. v3.0 sets no minimum campaign length; the one-week minimum was in draft v4.0 only. Confidence moves from unverified to verified.", "cite": "FedRAMP Penetration Test Guidance v3.0, Sec. 3.1 and 3.1.1", "url": "https://www.fedramp.gov/resources/documents/CSP_Penetration_Test_Guidance.pdf", "quote": "The External to Corporate attack vector requires the execution of a social engineering (phishing) attack against a CSP’s system administrators", "confidence": "verified" }, "physical": { "code": "permitted", "detail": "Code confirmed against v3.0. Physical based attack and unauthorized physical access are listed threat models in \"should\" language (Sec. 2.1). The rules of engagement should include physical penetration constraints (Sec. 5.0), and test planning must \"include or account for\" physical penetration (App. D). No physical test is mandatory. CA-8(3) is in no FedRAMP Rev5 baseline. Confidence moves from unverified to verified.", "cite": "FedRAMP Penetration Test Guidance v3.0, Sec. 2.1, Sec. 5.0 and Appendix D", "url": "https://www.fedramp.gov/resources/documents/CSP_Penetration_Test_Guidance.pdf", "quote": "Penetration test planning must include or account for the following considerations: Penetration Network penetration Wireless network penetration Physical penetration Social engineering penetration", "confidence": "verified" }, "third_party": { "code": "required", "detail": "Code unchanged. The supplier seam here is the agency's cloud supplier: every FedRAMP authorized offering must be penetration tested at least annually (Rev5 baseline workbook CA-08 parameter; PTG v3.0 Sec. 3.1 and 7.0). v3.0 adds, in 'should' language, that for IaaS the provider's corporate shared services and their interconnections be assessed (Sec. 3.1.2). The provider must obtain permission for any third-party assets in scope (Sec. 4.0).", "cite": "FedRAMP Rev5 baseline workbook CA-08; Penetration Test Guidance v3.0, Sec. 3.1.2 and 4.0", "url": "https://raw.githubusercontent.com/FedRAMP/docs-legacy/ed5e17f7c69a99a2511a93655353224b23bcf72e/overrides/assets/LEGACY%20FedRAMP_Security_Controls_Baseline.xlsx", "quote": "CA-8-1 [at least annually]", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "Code confirmed against v3.0. No OT or industrial control content.", "cite": "No provision; full text of PTG v3.0 reviewed (searched: operational technology, OT, ICS, SCADA, industrial)", "url": "https://www.fedramp.gov/resources/documents/CSP_Penetration_Test_Guidance.pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "Code confirmed against v3.0. No payment, card or market infrastructure content.", "cite": "No provision; full text of PTG v3.0 reviewed (searched: payment, SWIFT, card, financial)", "url": "https://www.fedramp.gov/resources/documents/CSP_Penetration_Test_Guidance.pdf", "confidence": "verified" }, "cloud_saas": { "code": "required", "detail": "Code unchanged; cite moves to v3.0. Tenant to CSP Management System and Tenant-to-Tenant are mandatory vectors for IaaS, PaaS and SaaS, run in production with two customer tenants.", "cite": "FedRAMP Penetration Test Guidance v3.0, Sec. 3.1, 3.1.3 and 3.1.4", "url": "https://www.fedramp.gov/resources/documents/CSP_Penetration_Test_Guidance.pdf", "quote": "Environments are required to be set up to test all aspects of the service provided, to include authentication, data access, user permissions, and sessions.", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "The penetration test guidance lists foreign adversaries pivoting from interconnected international networks into the US offering enclave as a minimum threat model for the CSP corporate attack vector. That is a test scenario, not a rule on the reach of the testing duty abroad, on tests run elsewhere or on where testers sit.", "cite": "No cross-border testing provision under R1; FedRAMP Penetration Test Guidance v3.0, Sec. 2.1 (CSP Corporate threat models) considered", "url": "https://www.fedramp.gov/resources/documents/CSP_Penetration_Test_Guidance.pdf", "confidence": "verified", "history": [ { "date": "2026-10-30", "from": "addressed", "to": "not_addressed", "why": "A threat model naming foreign adversaries is a test scenario, not a rule on reach, recognition or tester location." } ], "harmonized_from": "addressed", "harmonize_reason": "R1: A threat model naming foreign adversaries is a test scenario, not a rule on reach, recognition or tester location." }, "purple_replay": { "code": "not_addressed", "detail": "Code confirmed against v3.0. No purple team, replay or red team provision; v3.0 has no red team appendix.", "cite": "No provision; full text of PTG v3.0 reviewed (searched: purple, replay, workshop, blue team, red team)", "url": "https://www.fedramp.gov/resources/documents/CSP_Penetration_Test_Guidance.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "The provider records residual risks from the assessment report in a plan of action and milestones, and the schedule includes assessor remediation testing before the final report.", "cite": "FedRAMP legacy playbook, Annual Assessments, 'Conduct the Security Assessment and Develop SAR' and 'Complete Plan of Action and Milestones (POA&M)'", "url": "https://raw.githubusercontent.com/FedRAMP/docs-legacy/ed5e17f7c69a99a2511a93655353224b23bcf72e/content/playbook/csp/continuous-monitoring/annual-assessment.md", "quote": "be sure to build in time for developing the draft SAR, CSP remediation activities, assessor remediation testing, and final SAR development.", "confidence": "verified" }, "regulator_role": { "code": "receives_results", "detail": "Code kept. The report goes into the security assessment report for FedRAMP and agency customers, and the rules of engagement go to FedRAMP in the assessment plan. v3.0 also requires the authorizing official (the customer agency) to approve the rules of engagement and any deviation, which could support leads_or_oversees_test if the agency official is treated as the regulator.", "cite": "FedRAMP Rev5 baseline workbook CA-02 parameter; Penetration Test Guidance v3.0, Sec. 1.0, 5.0, 6.0 and Appendix D", "url": "https://www.fedramp.gov/resources/documents/CSP_Penetration_Test_Guidance.pdf", "quote": "Penetration test assessment activities and results must be organized and compiled into a comprehensive penetration test report to be included in the SAR.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Code unchanged; cite moves to v3.0. The test must not be limited to automated scanning. No AI provision.", "cite": "FedRAMP Penetration Test Guidance v3.0, Sec. 2.2 and Appendix B", "url": "https://www.fedramp.gov/resources/documents/CSP_Penetration_Test_Guidance.pdf", "quote": "The penetration test should not be strictly limited to automated scanning techniques, but manual techniques as well.", "confidence": "verified" } } }, { "id": "us-fedramp-cr26", "jurisdiction": "United States", "region": "US", "sector": "government", "name": "FedRAMP Consolidated Rules for 2026 (Rev5 and 20x rulesets)", "short": "FedRAMP CR26 / 20x", "issuer": "General Services Administration, FedRAMP", "version": "Release 2026.10.14.01 (FedRAMP/2026-markdown commit 822b083, Oct. 14, 2026)", "status": "Published and in transition as of 2026-09-28: optional adoption since July 4, 2026; mandatory for all stakeholders from Jan. 1, 2027; FedRAMP 20x Class A pipeline opened Aug. 3, 2026 and Class B and C on Aug. 31, 2026. Vulnerability Detection and Response rules take effect for certification on Dec. 7, 2026 (grace to Mar. 7, 2027); Independent Verification and Validation rules on Jan. 1, 2027.", "public": "full", "primary_url": "https://raw.githubusercontent.com/FedRAMP/2026-markdown/2f81e380a6615d48927a72c5007df785c038f891/index.md", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "Five rebuilds since the September commit 2f81e38 (Oct. 5, 5, 8, 13 and 14, 2026). After removing changelog lines, control-mapping lines and search flags, the text of every file the September coding cited is identical (VDR, IVV and REC rulesets, timeline, definitions used, CA-08 reference, classes, changes, M-24-15 scope). The changelog for 2026.10.14.01 says \"No rules were harmed in the marking of this update.\" One change touches testing without changing a code: on 2026-10-13 FedRAMP mapped VDR-CSO-DET to SP 800-53 CA-08, CA-08(01) and CA-08(02), which ties the penetration testing technique named in that rule to the CA-8 controls. Other October changes (PAIN0 rating in VER-EVA-EPA, Class B metrics MUST to SHOULD, JSON and logo rules) do not touch testing. Open RFCs 0035 (cryptographic modules) and 0036 (20x Class D cloud-hosted pilot) do not mention penetration testing, red teaming or independent assessment." }, "notes": "The 2026 rules replace the legacy prescriptive penetration test guidance with outcome rules: CA-08 guidance now reads 'Penetration testing is part of vulnerability detection and is subject to the Vulnerability Detection and Response rules', and FedRAMP tells assessors not to enforce 'ghost rules' that are not written on fedramp.gov. FedRAMP says Rev5 is a legacy process it is replacing and that 20x is available only through Program Certification. The Rev5 Vulnerability Detection and Response ruleset is marked 'Required (Mandated by CISA BOD 26-04)'. 20x uses Key Security Indicators instead of control-by-control assessment; no 20x rule found that names penetration testing outside VDR-CSO-DET. EO 14144 sec. 3(d) (renumbered 3(b) by EO 14306) directed FedRAMP to require or incentivize secure configuration baselines, a separate topic.", "cells": { "legal_force": { "code": "mandatory", "detail": "Rules use MUST and SHOULD. Providers must follow them to keep FedRAMP certification once mandatory adoption starts on Jan. 1, 2027; until then adoption is optional.", "cite": "FedRAMP Consolidated Rules 2026, Important Dates (timeline)", "url": "https://raw.githubusercontent.com/FedRAMP/2026-markdown/2f81e380a6615d48927a72c5007df785c038f891/timeline.md", "quote": "The Consolidated Rules for 2026 take mandatory effect for all stakeholders, subject to specific overall applicability and effective dates within certain areas.", "confidence": "verified" }, "scope": { "code": "FedRAMP cloud offerings, Classes A-D", "detail": "Cloud service offerings seeking or holding FedRAMP certification, graded by assurance class (A to D) rather than by impact level. Rev5 rulesets apply to Classes B, C and D; 20x to Classes A to D.", "cite": "FedRAMP Consolidated Rules 2026, Certification Classes (agencies/use/classes); IVV-CSO-FIA", "url": "https://raw.githubusercontent.com/FedRAMP/2026-markdown/2f81e380a6615d48927a72c5007df785c038f891/agencies/use/classes.md", "quote": "A Certification Class describes the level of assurance information a cloud service provider supplies through FedRAMP for a cloud service offering.", "confidence": "verified" }, "frequency": { "code": "annual independent assessment", "detail": "Class B to D providers must complete an independent assessment at least once per year (optional for Class A). For Rev5, the annual assessment must include CA-08 for Class B and CA-08(01) and CA-08(02) for Classes C and D; all applicable controls must be covered every 3 years. CA-08 itself no longer carries a FedRAMP frequency parameter and is folded into vulnerability detection.", "cite": "IVV-CSO-FIA; IVV-CSF-AIA; IVV-CSF-MCA; reference/controls CA-08", "url": "https://raw.githubusercontent.com/FedRAMP/2026-markdown/2f81e380a6615d48927a72c5007df785c038f891/providers/rev5/rules/independent-verification-and-validation.md", "quote": "Providers with Class B Certifications MUST persistently complete an independent verification and validation assessment of all applicable FedRAMP rules with a FedRAMP Recognized independent assessment service OR FedRAMP at least once per year", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Providers must discover vulnerabilities using techniques such as assessment, scanning, threat intelligence, bug bounties and penetration testing (VDR-CSO-DET). Threat intelligence is a parallel discovery technique, not an input to test design, scope or timing. Coded not_addressed under R5, like threat intelligence used only for prioritization or risk mitigation (NCSA vulnerability guidelines, QCB § 5.3.4).", "cite": "No provision tying tests to threat intelligence; VDR-CSO-DET (Rev5 and 20x) considered", "url": "https://raw.githubusercontent.com/FedRAMP/2026-markdown/2f81e380a6615d48927a72c5007df785c038f891/providers/rev5/rules/vulnerability-detection-and-response.md", "confidence": "verified", "history": [ { "date": "2026-10-30", "from": "recommended", "to": "not_addressed", "why": "VDR-CSO-DET lists threat intelligence as one technique for discovering vulnerabilities, next to penetration testing, and does not tie test scenarios, scope or timing to it; coded as NCSA's vulnerability guidelines and QCB § 5.3.4." } ], "harmonized_from": "recommended", "harmonize_reason": "R5: VDR-CSO-DET lists threat intelligence as one technique for discovering vulnerabilities, next to penetration testing, and does not tie test scenarios, scope or timing to it; coded as NCSA's vulnerability guidelines and QCB § 5.3.4." }, "provider_requirements": { "code": "required", "detail": "Independent assessments must be done by a FedRAMP Recognized assessment service or FedRAMP itself. Recognition requires A2LA accreditation under R311, an annual A2LA surveillance, full reassessment every 2 years, staffing to R311 roles, and annual foreign ownership reports.", "cite": "REC-IAS-ACC; REC-IAS-ANR; REC-IAS-RAS; REC-IAS-RQU; REC-IAS-AFI", "url": "https://raw.githubusercontent.com/FedRAMP/2026-markdown/2f81e380a6615d48927a72c5007df785c038f891/assessors/rules/fedramp-recognition.md", "quote": "Assessors MUST obtain and maintain accreditation through the American Association for Laboratory Accreditation (A2LA) Cybersecurity Inspection Body Program to qualify for FedRAMP Recognition.", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "Providers run their own vulnerability detection, which includes penetration testing. The annual independent assessment must be done by a recognized assessor or FedRAMP, and for Rev5 Classes C and D it must cover CA-08(01), the independent tester control.", "cite": "VDR-CSO-DET; IVV-CSF-AIA (Class C and D control lists)", "url": "https://raw.githubusercontent.com/FedRAMP/2026-markdown/2f81e380a6615d48927a72c5007df785c038f891/providers/rev5/rules/independent-verification-and-validation.md", "quote": "Providers with Rev5 Class C Certifications MUST include the following Rev5 Controls in a FedRAMP independent assessment at least once per year", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "The consolidated rules do not mention social engineering or phishing tests. Phishing appears only in phishing-resistant MFA requirements. The prescriptive attack vectors of the legacy guidance are gone.", "cite": "No provision; full text reviewed (CR26 VDR, VER, IVV and REC rulesets, definitions, CA-08 reference; searched: social engineering, phishing, pretext, red team)", "url": "https://raw.githubusercontent.com/FedRAMP/2026-markdown/2f81e380a6615d48927a72c5007df785c038f891/providers/rev5/rules/vulnerability-detection-and-response.md", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "No physical penetration testing rule. PE-03 physical access control is in the annual assessment list, and CA-08(03) facility testing appears in the control reference with no class baseline.", "cite": "No provision; full text reviewed (CR26 VDR, IVV rulesets and CA-08 reference; searched: physical penetration, facility, CA-08 (03), badge)", "url": "https://raw.githubusercontent.com/FedRAMP/2026-markdown/2f81e380a6615d48927a72c5007df785c038f891/reference/controls/assessment-authorization-and-monitoring.md", "confidence": "verified" }, "third_party": { "code": "required", "detail": "The whole regime tests agencies' cloud suppliers. Providers must also detect vulnerabilities through supply chain monitoring.", "cite": "VDR-CSO-DET; OMB M-24-15 Sec. III", "url": "https://raw.githubusercontent.com/FedRAMP/2026-markdown/2f81e380a6615d48927a72c5007df785c038f891/providers/rev5/rules/vulnerability-detection-and-response.md", "quote": "Providers MUST systematically, persistently, and promptly discover and identify vulnerabilities within their cloud service offering", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No OT or industrial control content.", "cite": "No provision; full text reviewed (CR26 VDR, IVV rulesets and definitions; searched: operational technology, OT, ICS, SCADA, industrial)", "url": "https://raw.githubusercontent.com/FedRAMP/2026-markdown/2f81e380a6615d48927a72c5007df785c038f891/definitions.md", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No payment, card or market infrastructure content.", "cite": "No provision; full text reviewed (CR26 VDR, IVV rulesets and definitions; searched: payment, SWIFT, card, financial)", "url": "https://raw.githubusercontent.com/FedRAMP/2026-markdown/2f81e380a6615d48927a72c5007df785c038f891/definitions.md", "confidence": "verified" }, "cloud_saas": { "code": "required", "detail": "Every certified cloud offering must run vulnerability detection that includes penetration testing among its techniques and undergo annual independent assessment.", "cite": "VDR-CSO-DET; IVV-CSO-FIA", "url": "https://raw.githubusercontent.com/FedRAMP/2026-markdown/2f81e380a6615d48927a72c5007df785c038f891/providers/rev5/rules/vulnerability-detection-and-response.md", "quote": "Providers MUST systematically, persistently, and promptly discover and identify vulnerabilities within their cloud service offering using appropriate techniques such as assessment, scanning, threat intelligence, vulnerability disclosure mechanisms, bug bounties, penetration testing", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "No rule on multi-country tests or data location during testing. Foreign ownership reporting applies to assessors, not to test scope.", "cite": "No provision; full text reviewed (CR26 VDR, IVV, REC rulesets; searched: foreign, international, cross-border, residency)", "url": "https://raw.githubusercontent.com/FedRAMP/2026-markdown/2f81e380a6615d48927a72c5007df785c038f891/assessors/rules/fedramp-recognition.md", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming or replay provision.", "cite": "No provision; full text reviewed (CR26 VDR, VER, IVV rulesets; searched: purple, replay, workshop, blue team)", "url": "https://raw.githubusercontent.com/FedRAMP/2026-markdown/2f81e380a6615d48927a72c5007df785c038f891/providers/rev5/rules/vulnerability-detection-and-response.md", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Providers must track, mitigate and remediate all detected vulnerabilities, with class-based target timeframes (SHOULD). Controls with negative findings must be reassessed in the next independent assessment.", "cite": "VDR-CSO-RES; VDR-TFR-PVR; IVV-CSF-ACF", "url": "https://raw.githubusercontent.com/FedRAMP/2026-markdown/2f81e380a6615d48927a72c5007df785c038f891/providers/rev5/rules/independent-verification-and-validation.md", "quote": "Providers MUST have Rev5 Controls with negative findings from the previous FedRAMP independent assessment included in the next FedRAMP independent assessment.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "Under Program Certification FedRAMP completes the official assessment, and the independent assessor must take part in FedRAMP's assessment. FedRAMP itself may perform the independent assessment.", "cite": "FedRAMP Consolidated Rules 2026, assessors/updating/changes ('The Program Certification Process'); IVV-CSO-FIA", "url": "https://raw.githubusercontent.com/FedRAMP/2026-markdown/2f81e380a6615d48927a72c5007df785c038f891/assessors/updating/changes.md", "quote": "FedRAMP will expect the independent assessment service to participate in FedRAMP's assessment alongside the cloud service provider and explain their process, findings, concerns, etc.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Detection must be persistent, and providers should automate it, with class-based cycles down to daily sampling for Class D. No provision on AI-driven testing or on testing AI systems.", "cite": "VDR-CSO-ADT; VDR-TFR-PSD", "url": "https://raw.githubusercontent.com/FedRAMP/2026-markdown/2f81e380a6615d48927a72c5007df785c038f891/providers/rev5/rules/vulnerability-detection-and-response.md", "quote": "Providers SHOULD use automated services to improve and streamline vulnerability detection and response.", "confidence": "verified" } } }, { "id": "us-cisa-hva", "jurisdiction": "United States", "region": "US", "sector": "government", "name": "Federal High Value Asset program: OMB M-19-03 and CISA Binding Operational Directive 18-02 (HVA assessments)", "short": "CISA HVA (BOD 18-02)", "issuer": "OMB (M-19-03); DHS CISA (BOD 18-02, HVA PMO)", "version": "M-19-03 (Dec. 10, 2018); BOD 18-02 (May 7, 2018); HVA PMO web page (undated)", "status": "In force as of 2026-09-28. BOD 18-02 appears on CISA's Active Directives list (page 3 of 3) without a 'Revoked' label, while BOD 19-02 and BOD 22-01 were revoked by BOD 26-04 on June 10, 2026. M-19-03 is cited as current in OMB M-25-04 (Jan. 15, 2025). The HVA Control Overlay v2.0 (Jan. 2021) page is marked archived.", "public": "partial", "primary_url": "https://www.cisa.gov/news-events/directives/bod-18-02-securing-high-value-assets", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "BOD 18-02 is still on CISA's directive list (page 3) without a revoked label, and the page text is identical to the September copy. The HVA PMO page text is identical. The M-19-03 PDF has the same SHA-256 as in September. No CISA directive was issued after BOD 26-04 (June 10, 2026). OMB M-26-14 (May 22, 2026), OMB M-26-15 (June 24, 2026) and EO 14412 (June 22, 2026) all define high value assets by reference to M-19-03, so it remains the current text. The CISA assessments, AES and HVA overlay pages changed only in their related-content sidebars." }, "notes": "HVA Program Supplemental Guidance 3.0 is cited in M-25-04 but was not found in public; the tier rules above come from the public HVA PMO page. CISA's RVA is a two-week engagement (one week external, one week internal testing) with a report within 10 days (RVA Fact Sheet, Feb. 2022). The HVA Control Overlay v2.0 (Jan. 2021, page archived) selects SA-11(5) developer penetration testing but does not select CA-8. BOD 26-04 (June 10, 2026) replaced BOD 19-02 and BOD 22-01 with risk-based patch deadlines, cites EO 14409, and applies to agency systems in FedRAMP environments through the FedRAMP PMO. The FY2026-27 CIO FISMA metrics ask what share of HVA components are tested annually for logging and monitoring effectiveness (CIO-FY26-0057).", "cells": { "legal_force": { "code": "mandatory", "detail": "BOD 18-02 is a compulsory directive under FISMA, and M-19-03 uses 'shall' for HVA assessment and remediation. Both do not apply to national security systems or certain DoD and IC systems.", "cite": "BOD 18-02 (preamble); M-19-03 p. 5-6", "url": "https://www.cisa.gov/news-events/directives/bod-18-02-securing-high-value-assets", "quote": "A binding operational directive is a compulsory direction to federal, executive branch, departments and agencies for purposes of safeguarding federal information and information systems.", "confidence": "verified" }, "scope": { "code": "FCEB agencies' designated HVAs", "detail": "Federal civilian executive branch agencies must report HVAs; CISA and OMB select HVAs for assessment. 'Related systems' include the network infrastructure that the HVA depends on, as DHS decides. Tier 1 HVAs are of critical impact to the agency and the nation; Non-Tier 1 of significant impact.", "cite": "BOD 18-02 Actions One to Three and fn. 6; HVA PMO Overview", "url": "https://www.cisa.gov/news-events/directives/bod-18-02-securing-high-value-assets", "quote": "Agencies shall impose no restrictions on the timing and/or frequency of the assessments, the services to be provided by DHS, or the scope of systems that are part of or related to the HVA being assessed.", "confidence": "verified" }, "frequency": { "code": "every 3 years", "detail": "Each HVA must be assessed at least once every 3 years: CISA leads Tier 1 assessments; an AES-qualified assessor may do Non-Tier 1. M-19-03 leaves frequency to DHS.", "cite": "HVA PMO Table 1 'HVA Assessment and Frequency Requirements'; M-19-03 p. 5 (Assessment item 1)", "url": "https://www.cisa.gov/resources-tools/programs/high-value-asset-program-management-office-hva-pmo", "quote": "HVA Assessment | Each HVA | CISA-Led once every 3 years | Assessment Evaluation and Standardization (AES) Qualified Assessor once every 3 years", "confidence": "verified" }, "threat_intel": { "code": "recommended", "detail": "CISA's Risk and Vulnerability Assessment blends national threat information with its own findings and tests with current real-world TTPs. No text requires agencies to run intelligence-led scenarios.", "cite": "CISA RVA Fact Sheet (Feb. 2022), Overview", "url": "https://www.cisa.gov/sites/default/files/publications/VM_Assessments_Fact_Sheet_RVA_508C.pdf", "quote": "RVAs combine open-source national threat and vulnerability information with data that the CISA RVA team collects through remote and onsite stakeholder assessment activities.", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Only DHS (CISA), a third-party assessor bound by a legally binding agreement that follows DHS requirements, or an independent agency assessment entity may assess. Non-Tier 1 assessors must be AES-qualified; only CISA staff may run official CISA assessments.", "cite": "M-19-03 p. 6 (Assessment item 1); HVA PMO Table 1; CISA AES Program page", "url": "https://www.whitehouse.gov/wp-content/uploads/2018/12/M-19-03.pdf", "quote": "DHS, third-party assessor, or an agency’s independent assessment entity shall conduct the assessments, incorporating them as part of existing agency cybersecurity programs.", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "An agency's own independent assessment entity may assess if it reports to the CIO and C-suite, and only for Non-Tier 1 HVAs; Tier 1 assessments are CISA-led.", "cite": "M-19-03 fn. 16; HVA PMO Table 1", "url": "https://www.whitehouse.gov/wp-content/uploads/2018/12/M-19-03.pdf", "quote": "Independent assessment entities within an agency may perform an HVA assessment provided the entity reports to the CIO and the remaining C-Suite.", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "CISA's RVA service includes an email phishing campaign as one option, and BOD 18-02 bars agencies from limiting the services DHS provides. No rule makes phishing mandatory in every HVA assessment.", "cite": "CISA RVA Fact Sheet (Feb. 2022), 'RVA service includes'; BOD 18-02 Action Three", "url": "https://www.cisa.gov/sites/default/files/publications/VM_Assessments_Fact_Sheet_RVA_508C.pdf", "quote": "Specific types of testing and assessments include network, web application, wireless, war dial, and social engineering in the form of an email phishing campaign.", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "None of the HVA texts mention physical intrusion or facility testing. The RVA includes onsite activity, but not physical penetration.", "cite": "No provision; full text reviewed (BOD 18-02; M-19-03; HVA PMO page; RVA Fact Sheet; searched: physical, facility, badge, onsite)", "url": "https://www.cisa.gov/news-events/directives/bod-18-02-securing-high-value-assets", "confidence": "verified" }, "third_party": { "code": "required", "detail": "Agencies must write HVA assessment rights into all contracts and service agreements, including contractor-owned, contractor-operated systems.", "cite": "M-19-03 p. 6 (Assessment item 3)", "url": "https://www.whitehouse.gov/wp-content/uploads/2018/12/M-19-03.pdf", "quote": "Incorporate requirements into all existing and future contracts and service-level agreements (SLAs) that enable the execution of HVA assessments for Federal information systems, including cloud-managed services and contractor-owned, contractor-operated systems.", "confidence": "verified" }, "ot": { "code": "permitted", "detail": "A Validated Architecture Design Review is an optional, CISA-led assessment for HVAs with OT components, including SCADA, available on agency request.", "cite": "HVA PMO Table 1 (VADR row)", "url": "https://www.cisa.gov/resources-tools/programs/high-value-asset-program-management-office-hva-pmo", "quote": "Validated Architecture Design Review (VADR) | Optional - Each HVA that includes operational technology components including SCADA systems | CISA-Led available by agency request", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No payment or market infrastructure provision.", "cite": "No provision; full text reviewed (BOD 18-02; M-19-03; HVA PMO page; RVA Fact Sheet; searched: payment, SWIFT, card, financial)", "url": "https://www.whitehouse.gov/wp-content/uploads/2018/12/M-19-03.pdf", "confidence": "verified" }, "cloud_saas": { "code": "required", "detail": "Contracts and service agreements for cloud-managed services must allow HVA assessments.", "cite": "M-19-03 p. 6 (Assessment item 3)", "url": "https://www.whitehouse.gov/wp-content/uploads/2018/12/M-19-03.pdf", "quote": "including cloud-managed services and contractor-owned, contractor-operated systems.", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "No cross-border provision.", "cite": "No provision; full text reviewed (BOD 18-02; M-19-03; HVA PMO page; RVA Fact Sheet; searched: foreign, international, cross-border, residency)", "url": "https://www.whitehouse.gov/wp-content/uploads/2018/12/M-19-03.pdf", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming or replay provision. CISA lists a Red Team Assessment only as a recommended supplemental assessment at agency or sub-component level.", "cite": "No provision; full text reviewed (BOD 18-02; M-19-03; HVA PMO page; RVA Fact Sheet; searched: purple, replay, workshop, blue team)", "url": "https://www.cisa.gov/resources-tools/programs/high-value-asset-program-management-office-hva-pmo", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Major or critical weaknesses must be fixed within 30 days of the RVA or SAR report. If not, the agency files a remediation plan signed by its senior risk official, capped at one year, and reports status every 30 days. Findings the agency will not fix need a risk acceptance letter signed by the agency head.", "cite": "BOD 18-02 Action Four; M-19-03 p. 7 (Remediation item 4)", "url": "https://www.cisa.gov/news-events/directives/bod-18-02-securing-high-value-assets", "quote": "Within 30 days of receipt of the RVA and/or SAR reports identifying major or critical weakness to an assessed HVA, remediate all major or critical weaknesses and provide notification to DHS that each identified weakness was addressed.", "confidence": "verified" }, "regulator_role": { "code": "leads_or_oversees_test", "detail": "CISA plans and conducts RVAs and Security Architecture Reviews on OMB-selected HVAs and leads all Tier 1 assessments. Results of third-party or agency assessments must go to DHS.", "cite": "BOD 18-02 'DHS Actions'; HVA PMO Table 1; M-19-03 p. 6 (Assessment item 2)", "url": "https://www.cisa.gov/news-events/directives/bod-18-02-securing-high-value-assets", "quote": "DHS plans and conducts RVAs and SARs for OMB-selected Agency HVAs, and provides formal reports containing assessment findings and recommendations to the designated Agency HVA POCs.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Only mention is continuous monitoring: annual testing does not mean every control each year, because agencies must continuously monitor controls. No AI provision.", "cite": "M-19-03 fn. 15", "url": "https://www.whitehouse.gov/wp-content/uploads/2018/12/M-19-03.pdf", "quote": "agencies must continuously monitor all implemented security and privacy controls (i.e., system-specific, hybrid, and common controls) with a frequency determined by the agency", "confidence": "verified" } } }, { "id": "us-omb-m22-09", "jurisdiction": "United States", "region": "US", "sector": "government", "name": "OMB M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles (application security testing actions)", "short": "OMB M-22-09 app testing", "issuer": "Office of Management and Budget", "version": "M-22-09 (Jan. 26, 2022)", "status": "In force as of 2026-09-28: the FY2026-27 CIO FISMA metrics v1.1 (Sept. 1, 2026) still measure agencies against M-22-09 requirements. No rescission found on the OMB memoranda index.", "public": "full", "primary_url": "https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "The PDF has the same SHA-256 as in September. The OMB memoranda index lists no rescission of M-22-09. Its newest entry is M-27-01 (Oct. 23, 2026), on reduction-in-force documents during a funding lapse, which has no cyber content. OMB M-26-18 (Aug. 31, 2026) tells agencies to follow M-22-09 as existing OMB policy: \"and OMB M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles.\" OMB rescinded other 2021-2023 cyber memos in 2026 (M-22-18 and M-23-16 by M-26-05; M-21-31 by M-26-14), but not M-22-09." }, "notes": "M-22-09 also requires a public vulnerability disclosure program for internet-accessible systems (Sec. III.D, Action 3) and one internal FISMA Moderate application made fully internet-accessible (Action 4). It does not mention red teaming.", "cells": { "legal_force": { "code": "mandatory", "detail": "OMB memorandum to agency heads; the application actions use 'must'.", "cite": "M-22-09 Sec. III.D, Actions 1-3", "url": "https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf", "quote": "Agencies must operate dedicated application security testing programs.", "confidence": "verified" }, "scope": { "code": "all agency applications", "detail": "Executive departments and agencies; every application is to be treated as internet-accessible and tested whether built in-house or by a vendor.", "cite": "M-22-09 Sec. III.D.1", "url": "https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf", "quote": "agencies must analyze their software and its deployed functionality with a comprehensive and rigorous approach, whether their software is built internally or by a contracted vendor.", "confidence": "verified" }, "frequency": { "code": "periodic, as systems change", "detail": "No fixed cycle. Agencies should move to continuous monitoring with periodic manual assessments as applications and their dependencies change.", "cite": "M-22-09 Sec. III.D.1", "url": "https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf", "quote": "Agencies are expected to continue moving toward continuous monitoring and ongoing authorizations while employing periodic manual security assessments as applications, dependencies, components, and infrastructure evolve.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "The memo asks agencies to scrutinize applications as adversaries do, but says nothing on threat intelligence driving tests.", "cite": "No provision; full text reviewed (M-22-09 full text; searched: threat intelligence, intelligence, TTP)", "url": "https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Agencies must use specialized application security firms for independent evaluation. No accreditation is named; CISA and GSA were to set up rapid procurement.", "cite": "M-22-09 Sec. III.D, Action 2; Sec. III.D.2", "url": "https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf", "quote": "Agencies must utilize high-quality firms specializing in application security for independent third-party evaluation.", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "Agencies must run their own testing programs, but must add external testers to find what internal staff miss.", "cite": "M-22-09 Sec. III.D.2", "url": "https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf", "quote": "In addition to their own testing programs, agencies must increase their reliance on external perspectives to identify vulnerabilities that internal staff may not identify.", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "Phishing appears only as the threat that phishing-resistant MFA addresses; no social engineering test.", "cite": "No provision; full text reviewed (M-22-09 full text; searched: social engineering, phishing test, pretext)", "url": "https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "No physical testing provision.", "cite": "No provision; full text reviewed (M-22-09 full text; searched: physical, facility)", "url": "https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf", "confidence": "verified" }, "third_party": { "code": "required", "detail": "Vendor-built agency software is in scope for the same rigorous analysis.", "cite": "M-22-09 Sec. III.D.1", "url": "https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf", "quote": "whether their software is built internally or by a contracted vendor.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No OT provision.", "cite": "No provision; full text reviewed (M-22-09 full text; searched: operational technology, industrial, SCADA)", "url": "https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No payment provision.", "cite": "No provision; full text reviewed (M-22-09 full text; searched: payment, SWIFT, card)", "url": "https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf", "confidence": "verified" }, "cloud_saas": { "code": "permitted", "detail": "FedRAMP was tasked to confirm with cloud platforms that agencies may authorize testing of agency applications hosted on those platforms.", "cite": "M-22-09 Sec. III.D.3", "url": "https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf", "quote": "FedRAMP will assist agencies by working with cloud platform providers to clarify that Federal agency customers are permitted to authorize vulnerability testing on customer-operated applications and infrastructure hosted on provider platforms.", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "No cross-border provision.", "cite": "No provision; full text reviewed (M-22-09 full text; searched: foreign, international, cross-border)", "url": "https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming or replay provision.", "cite": "No provision; full text reviewed (M-22-09 full text; searched: purple, replay, red team)", "url": "https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Agencies must prioritize and fix vulnerabilities found through these methods; no deadline or retest rule.", "cite": "M-22-09 Sec. III.D.1", "url": "https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf", "quote": "Agencies must prioritize and address vulnerabilities identified in their SAR through these methods.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "OMB may ask any agency at any time for an application's latest security assessment.", "cite": "M-22-09 Sec. III.D.1", "url": "https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf", "quote": "OMB may at any time ask an agency to produce an application’s most recent security assessment.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Authorization must combine automated tools and manual expert analysis; scanners alone do not give confidence.", "cite": "M-22-09 Sec. III.D.1", "url": "https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf", "quote": "Agency system authorization processes must employ both automated analysis tools and manual expert analysis.", "confidence": "verified" } } }, { "id": "us-occ-genius-part15", "jurisdiction": "United States", "region": "US", "sector": "financial", "name": "Implementing the Guiding and Establishing National Innovation for U.S. Stablecoins Act for the Issuance of Stablecoins by Entities Subject to the Jurisdiction of the Office of the Comptroller of the Currency, final rule, 12 CFR part 15 (91 FR 67000, Oct. 23, 2026)", "short": "OCC GENIUS Act rule (12 CFR 15)", "issuer": "Office of the Comptroller of the Currency (OCC)", "version": "2026-10-23 (effective 2027-01-18)", "status": "Not yet in force: effective 2027-01-18; added to the set on 2026-10-30", "public": "full", "primary_url": "https://www.federalregister.gov/documents/2026/10/23/2026-21706/implementing-the-guiding-and-establishing-national-innovation-for-us-stablecoins-act-for-the", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Final rule issued 2026-10-23 that requires periodic independent testing, vulnerability testing and testing with critical service providers at permitted payment stablecoin issuers, a new class of US payment firm.", "cells": { "legal_force": { "code": "mandatory", "detail": "A final OCC rule. Its testing duties use \"must\". It takes effect on January 18, 2027, the same day as the GENIUS Act, so no issuer is bound by it yet.", "cite": "§ 15.13(b)(1); preamble, III. Effective Date", "url": "https://www.federalregister.gov/documents/2026/10/23/2026-21706/implementing-the-guiding-and-establishing-national-innovation-for-us-stablecoins-act-for-the", "quote": "A permitted payment stablecoin issuer must implement a comprehensive written information security risk and control framework, including a program that assesses and manages information technology and information security risks.", "confidence": "verified" }, "scope": { "code": "permitted payment stablecoin issuers under OCC jurisdiction", "detail": "Stablecoin subsidiaries of national banks and federal savings associations, federal qualified issuers, and state qualified issuers that fall under OCC authority. Foreign issuers register with the OCC but are not bound by § 15.13.", "cite": "§ 15.1(b); § 15.2 (Permitted payment stablecoin issuer)", "url": "https://www.federalregister.gov/documents/2026/10/23/2026-21706/implementing-the-guiding-and-establishing-national-innovation-for-us-stablecoins-act-for-the", "quote": "Subsidiary of an insured national bank or Federal savings association that has been approved to issue payment stablecoins under Sec. 15.30; (2) Federal qualified payment stablecoin issuer; or (3) State qualified payment stablecoin issuer subject to the OCC's regulatory or enforcement authority under section 4 of the GENIUS Act", "confidence": "verified" }, "frequency": { "code": "periodic, no interval set", "detail": "The program must include periodic independent testing. The rule sets no interval and does not name penetration testing. Section 15.13(b)(8) adds testing for vulnerabilities as a resilience measure.", "cite": "§ 15.13(b)(3)(iv); § 15.13(b)(8)", "url": "https://www.federalregister.gov/documents/2026/10/23/2026-21706/implementing-the-guiding-and-establishing-national-innovation-for-us-stablecoins-act-for-the", "quote": "Periodic independent testing; and (v) A comprehensive and effective incident identification and assessment process and incident response program.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Issuers must monitor internal and external threats and adjust the program (§ 15.13(b)(6)). Nothing ties test scenarios or scope to threat intelligence.", "cite": "No provision; full text reviewed (searched: threat intelligence, scenario, threat-led, red team)", "url": "https://www.federalregister.gov/documents/2026/10/23/2026-21706/implementing-the-guiding-and-establishing-national-innovation-for-us-stablecoins-act-for-the", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Testing must be independent. The internal audit system must provide independence, objectivity and qualified persons (§ 15.13(a)(2)(ii)-(iii)). No certification or accreditation is named.", "cite": "§ 15.13(a)(2)(iv); § 15.13(b)(3)(iv)", "url": "https://www.federalregister.gov/documents/2026/10/23/2026-21706/implementing-the-guiding-and-establishing-national-innovation-for-us-stablecoins-act-for-the", "quote": "Adequate independent testing and review of internal controls and information systems, verification of published information available to customers, calculations for required reserves, and regulatory filings;", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "Independent testing and review of internal controls and information systems is an element of the internal audit system (§ 15.13(a)(2)(iv)), which must provide independence, objectivity and qualified persons. In-house auditors may test if they meet those conditions. Smaller issuers may use a system of independent reviews of key controls instead of a full internal audit function.", "cite": "§ 15.13(a)(2)(i)-(ii)", "url": "https://www.federalregister.gov/documents/2026/10/23/2026-21706/implementing-the-guiding-and-establishing-national-innovation-for-us-stablecoins-act-for-the", "quote": "Adequate monitoring of the system of internal controls through an internal audit function, or, if the size, complexity, or scope of operations of the permitted payment stablecoin issuer does not warrant a full-scale internal audit function, a system of independent reviews of key internal controls;", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "The rule text does not mention social engineering or staff training.", "cite": "No provision; full text reviewed (searched: social engineering, phishing, training, personnel)", "url": "https://www.federalregister.gov/documents/2026/10/23/2026-21706/implementing-the-guiding-and-establishing-national-innovation-for-us-stablecoins-act-for-the", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "The program must include physical safeguards for customer records (§ 15.13(b)(4)). No text on testing physical controls.", "cite": "No provision; full text reviewed (searched: physical, penetration, testing)", "url": "https://www.federalregister.gov/documents/2026/10/23/2026-21706/implementing-the-guiding-and-establishing-national-innovation-for-us-stablecoins-act-for-the", "confidence": "verified" }, "third_party": { "code": "assurance_only", "detail": "Issuers must review audits, summaries of test results or equivalent evaluations of service providers, and the resilience program must include testing with critical service providers. Provider systems are not placed inside the issuer's own security test.", "cite": "§ 15.13(a)(7)(iii); § 15.13(b)(8)", "url": "https://www.federalregister.gov/documents/2026/10/23/2026-21706/implementing-the-guiding-and-establishing-national-innovation-for-us-stablecoins-act-for-the", "quote": "As part of this monitoring, a permitted payment stablecoin issuer must review audits, summaries of test results, or other equivalent evaluations of its service providers.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: industrial control, operational technology, SCADA)", "url": "https://www.federalregister.gov/documents/2026/10/23/2026-21706/implementing-the-guiding-and-establishing-national-innovation-for-us-stablecoins-act-for-the", "confidence": "verified" }, "payment_systems": { "code": "required", "detail": "The regime covers payment stablecoin issuers, so the issuer's own payment systems are the subject. Key systems and controls, including smart contracts, must be evaluated and validated to confirm they work as intended.", "cite": "§ 15.13(b)(3)(iii)", "url": "https://www.federalregister.gov/documents/2026/10/23/2026-21706/implementing-the-guiding-and-establishing-national-innovation-for-us-stablecoins-act-for-the", "quote": "Evaluation, validation, and reporting processes to ensure that key information technology systems and controls, including smart contracts, are operating as intended;", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "\"Cloud\" appears only in a preamble summary of comments on licensing, not in the rule text.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, hosting)", "url": "https://www.federalregister.gov/documents/2026/10/23/2026-21706/implementing-the-guiding-and-establishing-national-innovation-for-us-stablecoins-act-for-the", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "A foreign payment stablecoin issuer is not subject to the GENIUS Act prohibitions if its home regulator runs a regime the Treasury finds comparable and it registers with the OCC (§ 15.31(a)). The § 15.13 testing duties do not bind it. Nothing on cross-border tests or where testers sit.", "cite": "12 CFR 15.31(a)(1) and (2)", "url": "https://www.federalregister.gov/documents/2026/10/23/2026-21706/implementing-the-guiding-and-establishing-national-innovation-for-us-stablecoins-act-for-the", "confidence": "verified", "quote": "The foreign payment stablecoin issuer is subject to regulation and supervision by a foreign payment stablecoin regulator that has a regulatory and supervisory regime comparable to the GENIUS Act with respect to payment stablecoins", "harmonized_from": "not_addressed", "harmonize_reason": "R1: § 15.31(a) lets a foreign issuer rely on a home regime the Treasury finds comparable, a rule on foreign entities of the kind R1(a) counts, as for APRA CPS 234 para. 3." }, "purple_replay": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: purple, replay, red team, lessons learned)", "url": "https://www.federalregister.gov/documents/2026/10/23/2026-21706/implementing-the-guiding-and-establishing-national-innovation-for-us-stablecoins-act-for-the", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Internal audit must document tests, findings and corrective actions, and verify management's fixes. The program must be adjusted after monitoring (§ 15.13(b)(6)(ii)). No deadline.", "cite": "§ 15.13(a)(2)(v)-(vi)", "url": "https://www.federalregister.gov/documents/2026/10/23/2026-21706/implementing-the-guiding-and-establishing-national-innovation-for-us-stablecoins-act-for-the", "quote": "Adequate documentation of tests and findings and any corrective actions; (vi) Verification and review of management actions to address deficiencies; and", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "The OCC runs a full-scope examination at least every 12 months (18 to 24 months for small issuers that qualify) and gets access to all records. Test results are not filed routinely.", "cite": "§ 15.14(a)-(d)", "url": "https://www.federalregister.gov/documents/2026/10/23/2026-21706/implementing-the-guiding-and-establishing-national-innovation-for-us-stablecoins-act-for-the", "quote": "The OCC will conduct a full-scope examination of every permitted payment stablecoin issuer subject to its supervision at least once during each 12-month period, unless otherwise specified in paragraph (d) of this section.", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "No provision in the rule text. Smart contracts are named as systems to validate, but nothing addresses automated testing or AI.", "cite": "No provision; full text reviewed (searched: automated, continuous, artificial intelligence, machine learning)", "url": "https://www.federalregister.gov/documents/2026/10/23/2026-21706/implementing-the-guiding-and-establishing-national-innovation-for-us-stablecoins-act-for-the", "confidence": "verified" } } }, { "id": "us-fhfa-ab-2017-02", "jurisdiction": "United States", "region": "US", "sector": "financial", "name": "FHFA Advisory Bulletin AB 2017-02, Information Security Management (Sept. 28, 2017), with AB 2023-02, Supplemental Guidance to AB 2017-02 (Jan. 13, 2023)", "short": "FHFA information security bulletins", "issuer": "Federal Housing Finance Agency (FHFA)", "version": "2017-09-28 (supplemented 2023-01-13)", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://www.fhfa.gov/advisory-bulletin/ab-2017-02", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Missed in September. FHFA supervises Fannie Mae, Freddie Mac and the Federal Home Loan Banks, and these bulletins set examiner-backed expectations for independent penetration testing and routine social engineering testing.", "cells": { "legal_force": { "code": "supervisory_expectation", "detail": "Advisory bulletins state FHFA supervisory expectations and are used in examinations. They are not regulations. A cell is coded required only where FHFA uses its own expectation words ('FHFA expects'); its 'should' is coded recommended, or permitted on the seam dimensions (R3).", "cite": "AB 2023-02, p. 13 (closing note)", "url": "https://www.fhfa.gov/advisory-bulletin/ab-2017-02", "quote": "Advisory bulletins describe FHFA supervisory expectations for safe and sound operations in particular areas and are used in FHFA examinations of the regulated entities.", "confidence": "verified" }, "scope": { "code": "Fannie Mae, Freddie Mac, Federal Home Loan Banks, Office of Finance", "detail": "Fannie Mae, Freddie Mac, the Federal Home Loan Banks and their Office of Finance. AB 2023-02 also applies to Common Securitization Solutions, LLC, an affiliate of both Enterprises (AB 2023-02, n. 2).", "cite": "AB 2017-02, Purpose", "url": "https://www.fhfa.gov/advisory-bulletin/ab-2017-02", "quote": "guidance on information security management for supporting a safe and sound operational environment and promoting the resilience of Fannie Mae, Freddie Mac, the Federal Home Loan Banks, and the Office of Finance (OF)", "confidence": "verified" }, "frequency": { "code": "risk-based", "detail": "Management sets the scope and frequency of tests in risk-based policies, with triggers such as major technology changes or a security incident. AB 2023-02 adds that penetration tests should run periodically after deployment.", "cite": "AB 2017-02, III.B; AB 2023-02, Q11", "url": "https://www.fhfa.gov/advisory-bulletin/ab-2017-02", "quote": "Management should develop and maintain risk-based policies that define the scope and frequency of regular tests.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Threat intelligence sharing is a program area (AB 2017-02, III.J) and threat modeling is an option in development (AB 2023-02, Q11). Neither ties test scenarios to threat intelligence.", "cite": "No provision; full text reviewed (searched: threat intelligence, threat-led, scenario, red team)", "url": "https://www.fhfa.gov/advisory-bulletin/ab-2017-02", "confidence": "verified" }, "provider_requirements": { "code": "recommended", "detail": "FHFA says the regulated entities should engage third parties to perform independent penetration testing (AB 2023-02, Q11). Coded recommended under R3, as the FFIEC booklet's 'should review qualifications' text. No certification or accreditation is named.", "cite": "AB 2023-02, Q11 (Penetration Testing)", "url": "https://www.fhfa.gov/advisory-bulletin/ab-2017-02", "quote": "The regulated entities should engage third parties to perform independent penetration testing", "confidence": "verified", "harmonized_from": "required", "harmonize_reason": "R3: AB 2023-02 Q11 says entities 'should' engage third parties for independent penetration testing; supervisory 'should' is recommended, as for the FFIEC booklet." }, "internal_testers": { "code": "allowed_with_conditions", "detail": "Internal penetration testing is expected \"as necessary\" in addition to, not instead of, independent third-party testing. AB 2017-02 says independent parties \"may\" conduct and review tests.", "cite": "AB 2023-02, Q11; AB 2017-02, III.B", "url": "https://www.fhfa.gov/advisory-bulletin/ab-2017-02", "quote": "as well as perform internal penetration testing as necessary.", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "AB 2023-02 says the regulated entities should, as a matter of routine, conduct social engineering testing, with phishing simulations as the example. Coded permitted under R3: a supervisory bulletin's 'should' on a seam dimension, with legal_force recording that the bulletin is guidance.", "cite": "AB 2023-02, Q2 (Social Engineering)", "url": "https://www.fhfa.gov/advisory-bulletin/ab-2017-02", "quote": "the regulated entities should, as a matter of routine, ensure they update security awareness trainings regularly, conduct social engineering testing (e.g., phishing simulations), and review network device configurations to ensure only legitimate traffic is allowed.", "confidence": "verified", "harmonized_from": "required", "harmonize_reason": "R3: AB 2023-02 Q2 says entities 'should, as a matter of routine' conduct social engineering testing; supervisory 'should' is permitted on the seam dimensions." }, "physical": { "code": "not_addressed", "detail": "Physical facilities are monitored (AB 2017-02, III) and incident plans cover physical events (III.F). No text on testing physical controls or physical intrusion.", "cite": "No provision; full text reviewed (searched: physical, penetration, test)", "url": "https://www.fhfa.gov/advisory-bulletin/ab-2017-02", "confidence": "verified" }, "third_party": { "code": "assurance_only", "detail": "Entities monitor providers, conduct on-site reviews where necessary, obtain attestations and review independent reports such as ISO 27001, PCI and SOC reports. Provider systems stay outside the entity's own test.", "cite": "AB 2023-02, Q4 (information security at third-party providers); AB 2017-02, III.I", "url": "https://www.fhfa.gov/advisory-bulletin/ab-2017-02", "quote": "The regulated entities should also review independent reports on a third-party provider's security program, such as ISO 27001 certification, and PCI compliance and control reports (e.g., Service Organization Control).", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: industrial control, operational technology, SCADA)", "url": "https://www.fhfa.gov/advisory-bulletin/ab-2017-02", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: payment, wire, settlement, SWIFT, card)", "url": "https://www.fhfa.gov/advisory-bulletin/ab-2017-02", "confidence": "verified" }, "cloud_saas": { "code": "permitted", "detail": "AB 2023-02 applies AB 2017-02 vulnerability management to the cloud, and in IaaS and PaaS models the entity is responsible for it. That vulnerability management includes regular penetration testing in 'should' language (AB 2017-02, III.B). AB 2018-04, III.B says the entity 'should assess compliance with its security policies through regular tests of key controls, systems, and procedures it uses for its cloud environment(s).' Coded permitted under R3. SaaS and provider infrastructure stay with the provider.", "cite": "AB 2023-02, Q9 (Vulnerability Management)", "url": "https://www.fhfa.gov/advisory-bulletin/ab-2017-02", "quote": "The vulnerability management concepts outlined in AB 2017-02: Information Security Management apply to the cloud environment. Vulnerability management of cloud infrastructure is typically managed by the CSP; however, in a platform-as-a-service and infrastructure-as-a-service model, the customer is responsible for vulnerability management in the cloud.", "confidence": "verified", "harmonized_from": "required", "harmonize_reason": "R3: The cloud testing rests on AB 2017-02 III.B and AB 2018-04 III.B, both 'should' text; supervisory 'should' is permitted on the seam dimensions." }, "cross_border": { "code": "not_addressed", "detail": "No testing provision. FHFA AB 2018-04 (cloud) asks entities to weigh legal and security risk before hosting data outside the United States; it says nothing on testing.", "cite": "No provision; full text reviewed (searched: foreign, offshore, jurisdiction, cross-border)", "url": "https://www.fhfa.gov/advisory-bulletin/ab-2017-02", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "Incident analyses should identify improvements (AB 2017-02, III.F). No joint attacker and defender review of test results.", "cite": "No provision; full text reviewed (searched: purple, replay, red team, lessons learned)", "url": "https://www.fhfa.gov/advisory-bulletin/ab-2017-02", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "FHFA expects a continual practice of cyber hygiene that includes scanning for and timely patching of vulnerabilities and conducting penetration tests (AB 2023-02, p. 2). Procedures should also be in place to track and independently validate remediation, and accepted vulnerabilities need management approval and justification (AB 2017-02, III.B); that retest is a 'should'. No deadline. A supervisory bulletin, not a binding rule (see legal_force).", "cite": "AB 2023-02, p. 2; AB 2017-02, III.B", "url": "https://www.fhfa.gov/advisory-bulletin/ab-2023-02", "quote": "FHFA expects a continual practice of cyber hygiene such as scanning for and timely patching of vulnerabilities and conducting penetration tests.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "FHFA examiners use the bulletins. Test results are not filed with FHFA.", "cite": "AB 2017-02, p. 12 (closing note); AB 2023-02, p. 13", "url": "https://www.fhfa.gov/advisory-bulletin/ab-2017-02", "quote": "Advisory bulletins communicate guidance to FHFA supervision staff and the regulated entities on specific supervisory matters pertaining to the Federal Home Loan Banks, the Office of Finance, Fannie Mae, and Freddie Mac.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Testing includes vulnerability scanning, and the program includes continuous monitoring (AB 2017-02, III.A). FHFA AB 2022-02 (revised May 2025) lists, among controls Fannie Mae and Freddie Mac 'should also consider', whether an independent assessment of third-party AI/ML models covers their security (III.A), and testing of in-house and third-party AI/ML tools to assess integrity, security and business resiliency (III.C). No text covers AI-driven testing or red teaming of AI.", "cite": "AB 2017-02, III.B; AB 2022-02, III.A", "url": "https://www.fhfa.gov/advisory-bulletin/ab-2017-02", "quote": "The regulated entity should regularly test the effectiveness of key controls, systems, and procedures used to protect against information security risks through vulnerability scanning, internal and external audits, and penetration testing.", "confidence": "verified" } } }, { "id": "us-fca-609-930", "jurisdiction": "United States", "region": "US", "sector": "financial", "name": "Farm Credit Administration, Cyber Risk Management, 12 CFR 609.930 (final rule 88 FR 85825, Dec. 11, 2023; effective Jan. 1, 2025)", "short": "FCA cyber risk management rule", "issuer": "Farm Credit Administration (FCA)", "version": "2023-12-11 (effective 2025-01-01)", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://www.ecfr.gov/current/title-12/section-609.930", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Missed in September. A binding federal rule for Farm Credit System banks and associations that requires regular, independent testing of cyber controls.", "cells": { "legal_force": { "code": "mandatory", "detail": "A binding FCA regulation. Its testing duties use \"must\".", "cite": "§ 609.930(a)", "url": "https://www.ecfr.gov/current/title-12/section-609.930", "quote": "Each System institution must implement a comprehensive, written cyber risk management program consistent with the size, risk profile, and complexity of the institution's operations.", "confidence": "verified" }, "scope": { "code": "Farm Credit System institutions", "detail": "Farm Credit System institutions. Each must run a written cyber risk management program.", "cite": "88 FR 85825 (Summary); § 609.930(a)", "url": "https://www.ecfr.gov/current/title-12/section-609.930", "quote": "The final rule requires each Farm Credit System (System or FCS) institution to implement a comprehensive, written cyber risk management program", "confidence": "verified" }, "frequency": { "code": "risk-based", "detail": "Regular testing of key controls, systems and procedures. The risk assessment sets the frequency and nature. No penetration test is named.", "cite": "§ 609.930(c)(6)(i)", "url": "https://www.ecfr.gov/current/title-12/section-609.930", "quote": "The frequency and nature of such tests are to be determined by the institution's risk assessment.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "An annual risk assessment covers internal and external factors (§ 609.930(c)(1)). Nothing ties tests to threat intelligence.", "cite": "No provision; full text reviewed (searched: threat intelligence, scenario, threat-led, red team)", "url": "https://www.ecfr.gov/current/title-12/section-609.930", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Tests must be run or reviewed by independent third parties or by staff independent of those who build or maintain the program. No certification is named.", "cite": "§ 609.930(c)(6)(ii)", "url": "https://www.ecfr.gov/current/title-12/section-609.930", "quote": "Tests must be conducted or reviewed by independent third parties or staff independent of those who develop or maintain the cyber risk management program.", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "In-house staff may test if they are independent of those who develop or maintain the program.", "cite": "§ 609.930(c)(6)(ii)", "url": "https://www.ecfr.gov/current/title-12/section-609.930", "quote": "Tests must be conducted or reviewed by independent third parties or staff independent of those who develop or maintain the cyber risk management program.", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "The program must describe a training plan for employees, vendors, contractors and the board (§ 609.930(c)(4)). No testing of people.", "cite": "No provision; full text reviewed (searched: social engineering, phishing, training)", "url": "https://www.ecfr.gov/current/title-12/section-609.930", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: physical, penetration, test)", "url": "https://www.ecfr.gov/current/title-12/section-609.930", "confidence": "verified" }, "third_party": { "code": "assurance_only", "detail": "Institutions assess and monitor vendors and may review their audits and test summaries. Vendor systems are not placed inside the institution's test.", "cite": "§ 609.930(c)(5)(iv)", "url": "https://www.ecfr.gov/current/title-12/section-609.930", "quote": "Monitor its IT and cyber risk management related vendors to ensure they have satisfied agreed upon expectations and deliverables. Monitoring may include reviewing audits, summaries of test results, or other equivalent evaluations of its vendors.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: industrial control, operational technology, SCADA)", "url": "https://www.ecfr.gov/current/title-12/section-609.930", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: payment, wire, card, SWIFT)", "url": "https://www.ecfr.gov/current/title-12/section-609.930", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, hosting)", "url": "https://www.ecfr.gov/current/title-12/section-609.930", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: foreign, cross-border, jurisdiction)", "url": "https://www.ecfr.gov/current/title-12/section-609.930", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: purple, replay, red team, lessons learned)", "url": "https://www.ecfr.gov/current/title-12/section-609.930", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Institutions must remediate vulnerabilities in a timely way (§ 609.930(c)(2)) and their controls must give reasonable assurance that material deficiencies are fixed on time. No deadline or retest rule.", "cite": "§ 609.930(c)(2); § 609.930(c)(6)(iii)", "url": "https://www.ecfr.gov/current/title-12/section-609.930", "quote": "Internal systems and controls must provide reasonable assurances that System institutions will prevent, detect, and remediate material deficiencies on a timely basis.", "confidence": "verified" }, "regulator_role": { "code": "not_addressed", "detail": "The board receives quarterly reports on the program (§ 609.930(e)) and FCA receives incident notices within 36 hours (§ 609.930(c)(3)(v)). The section does not provide for FCA to receive or review test results.", "cite": "No provision; full text reviewed (searched: FCA, examination, report, submit)", "url": "https://www.ecfr.gov/current/title-12/section-609.930", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: automated, continuous, artificial intelligence)", "url": "https://www.ecfr.gov/current/title-12/section-609.930", "confidence": "verified" } } }, { "id": "us-frb-reg-hh", "jurisdiction": "United States", "region": "US", "sector": "financial", "name": "Regulation HH, Designated Financial Market Utilities, 12 CFR 234.3(a)(17) operational risk standard, as amended 89 FR 18749 (Mar. 15, 2024)", "short": "Fed Regulation HH (designated FMUs)", "issuer": "Board of Governors of the Federal Reserve System", "version": "2024-03-15 (amendments effective 2024-04-15; compliance 2024-09-11)", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://www.ecfr.gov/current/title-12/section-234.3", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Missed in September. A binding Federal Reserve rule that requires designated payment, clearing and settlement utilities to test controls under a documented framework. Its adopting release names penetration tests and red team tests as examples.", "cells": { "legal_force": { "code": "mandatory", "detail": "A Federal Reserve regulation under Title VIII of the Dodd-Frank Act. The 2024 amendments require a documented testing framework.", "cite": "§ 234.3(a)", "url": "https://www.ecfr.gov/current/title-12/section-234.3", "quote": "A designated financial market utility must implement rules, procedures, or operations designed to ensure that it meets or exceeds the following risk-management standards with respect to its payment, clearing, and settlement activities.", "confidence": "verified" }, "scope": { "code": "designated FMUs supervised by the Federal Reserve", "detail": "Payment, clearing and settlement utilities designated as systemically important for which the Board is the Supervisory Agency. Designated clearing agencies and DCOs follow SEC or CFTC standards instead.", "cite": "§ 234.1(b)", "url": "https://www.ecfr.gov/current/title-12/section-234.3", "quote": "The risk management standards do not apply, however, to a designated financial market utility that is a derivatives clearing organization registered under section 5b of the Commodity Exchange Act (7 U.S.C. 7a-1) or a clearing agency registered with the Securities and Exchange Commission", "confidence": "verified" }, "frequency": { "code": "annual (business continuity); periodic and after major changes (other tests)", "detail": "Controls are tested periodically and after major changes under a documented framework that sets scope and frequency. Business continuity arrangements, including live production at the second site, are tested at least once a year.", "cite": "§ 234.3(a)(17)(i)(A); § 234.3(a)(17)(viii)(E)", "url": "https://www.ecfr.gov/current/title-12/section-234.3", "quote": "Provides for testing, pursuant to the requirements under paragraphs (a)(17)(i)(A) and (C) of this section, at least annually, of the designated financial market utility's business continuity arrangements, including the people, processes, and technologies of the sites", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "The rule text requires a documented testing framework but not threat intelligence. The adopting release says tests \"could include\" cyber scenario-based testing, penetration tests and red team tests (89 FR 18752, n. 23). That is an example list, not a requirement.", "cite": "No provision; full text reviewed (searched: threat intelligence, threat-led, scenario, red team)", "url": "https://www.ecfr.gov/current/title-12/section-234.3", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "Independence rules cover the risk-management and internal audit functions (§ 234.3(a)(2)(iv)(H)-(I)) and model validation, not security tests.", "cite": "No provision; full text reviewed (searched: independent, qualified, tester, third party)", "url": "https://www.ecfr.gov/current/title-12/section-234.3", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "The rule does not say who may run tests.", "cite": "No provision; full text reviewed (searched: internal, independent, employees)", "url": "https://www.ecfr.gov/current/title-12/section-234.3", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: social engineering, phishing, training)", "url": "https://www.ecfr.gov/current/title-12/section-234.3", "confidence": "verified" }, "physical": { "code": "controls_test", "detail": "Tests cover the systems, policies, procedures and controls required under paragraph (a)(17), which include physical security controls. No physical intrusion method is required.", "cite": "§ 234.3(a)(17)(i), (v)", "url": "https://www.ecfr.gov/current/title-12/section-234.3", "quote": "Has comprehensive physical, information, and cyber security policies, procedures, and controls that enable the designated financial market utility to identify, monitor, and manage potential and evolving vulnerabilities and threats;", "confidence": "verified" }, "third_party": { "code": "assurance_only", "detail": "Third parties that provide material services must be addressed in business continuity management and testing, and outsourced services must be risk-managed as if the FMU performed them. The text does not place provider systems inside security tests.", "cite": "§ 234.3(a)(17)(ix)", "url": "https://www.ecfr.gov/current/title-12/section-234.3", "quote": "Addresses in its business continuity management and testing, as appropriate, third parties that provide services material to any of the designated financial market utility's critical operations or services.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: industrial control, operational technology, SCADA)", "url": "https://www.ecfr.gov/current/title-12/section-234.3", "confidence": "verified" }, "payment_systems": { "code": "required", "detail": "The rule governs payment, clearing and settlement utilities themselves, so their core systems are the subject of the testing standard.", "cite": "§ 234.1(b)", "url": "https://www.ecfr.gov/current/title-12/section-234.3", "quote": "This part establishes risk-management standards governing the operations related to the payment, clearing, and settlement activities of designated financial market utilities.", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, hosting)", "url": "https://www.ecfr.gov/current/title-12/section-234.3", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "The legal basis standard covers \"all relevant jurisdictions\" (§ 234.3(a)(1)). No testing provision on foreign entities or tester location.", "cite": "No provision; full text reviewed (searched: foreign, cross-border, jurisdiction)", "url": "https://www.ecfr.gov/current/title-12/section-234.3", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "Lessons learned are folded in after incidents and in the annual business continuity review (§ 234.3(a)(17)(vi), (viii)(F)). No joint attacker and defender review of tests.", "cite": "No provision; full text reviewed (searched: purple, replay, red team, lessons learned)", "url": "https://www.ecfr.gov/current/title-12/section-234.3", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Deficiencies found in review or testing must be fixed as soon as possible through governance processes. Design and testing are reviewed again after material incidents.", "cite": "§ 234.3(a)(17)(i)(B)-(C)", "url": "https://www.ecfr.gov/current/title-12/section-234.3", "quote": "The designated financial market utility remediates as soon as possible, following established governance processes, deficiencies in systems, policies, procedures, or controls identified in the process of review or testing;", "confidence": "verified" }, "regulator_role": { "code": "not_addressed", "detail": "The FMU must notify the Board immediately of material incidents (§ 234.3(a)(17)(vi)(A)). Section 234.3 does not provide for the Board to receive or review test results.", "cite": "No provision; full text reviewed (searched: Board, examination, report, submit)", "url": "https://www.ecfr.gov/current/title-12/section-234.3", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "\"Automated\" appears only in a list of systems in the incident rule. No provision on automated testing.", "cite": "No provision; full text reviewed (searched: automated, continuous, artificial intelligence)", "url": "https://www.ecfr.gov/current/title-12/section-234.3", "confidence": "verified" } } }, { "id": "us-sec-reg-se-sbsef", "jurisdiction": "United States", "region": "US", "sector": "financial", "name": "Regulation SE, Core Principle 13, System safeguards for security-based swap execution facilities, 17 CFR 242.830 (adopted 88 FR 87156, Dec. 15, 2023; effective Feb. 13, 2024)", "short": "SEC Regulation SE system safeguards", "issuer": "U.S. Securities and Exchange Commission (SEC)", "version": "2023-12-15 (effective 2024-02-13)", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://www.ecfr.gov/current/title-17/section-242.830", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Missed in September. A binding SEC rule that requires external and internal penetration testing at security-based swap execution facilities, part of US market infrastructure.", "cells": { "legal_force": { "code": "mandatory", "detail": "An SEC rule. Testing duties use \"shall\".", "cite": "§ 242.830(b)(8)", "url": "https://www.ecfr.gov/current/title-17/section-242.830", "quote": "A security-based swap execution facility shall conduct regular, periodic, objective testing and review of its automated systems to ensure that they are reliable, secure, and have adequate scalable capacity.", "confidence": "verified" }, "scope": { "code": "security-based swap execution facilities", "detail": "SEC-registered SBSEFs. The text mirrors the CFTC rule for swap execution facilities (17 CFR 37.1401).", "cite": "§ 242.830(a)", "url": "https://www.ecfr.gov/current/title-17/section-242.830", "quote": "Establish and maintain a program of risk analysis and oversight to identify and minimize sources of operational risk, through the development of appropriate controls and procedures, and automated systems", "confidence": "verified" }, "frequency": { "code": "risk-based", "detail": "Vulnerability, external and internal penetration, controls and incident response plan tests each run at a frequency set by risk analysis. No fixed minimum.", "cite": "§ 242.830(b)(8)(ii)-(vi)", "url": "https://www.ecfr.gov/current/title-17/section-242.830", "quote": "A security-based swap execution facility shall conduct such external penetration testing at a frequency determined by an appropriate risk analysis.", "confidence": "verified" }, "threat_intel": { "code": "required", "detail": "Test scope must cover what the facility's current cybersecurity threat analysis shows is needed. Same wording and same code as the CFTC row.", "cite": "§ 242.830(b)(10)", "url": "https://www.ecfr.gov/current/title-17/section-242.830", "quote": "The scope for all system safeguards testing and assessment required by this section shall be broad enough to include the testing of automated systems and controls that the security-based swap execution facility's required program of risk analysis and oversight and its current cybersecurity threat analysis indicate is necessary", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Penetration, vulnerability and controls tests must use independent contractors or employees not responsible for the systems tested. No certification is named.", "cite": "§ 242.830(b)(8)(iii)(B)", "url": "https://www.ecfr.gov/current/title-17/section-242.830", "quote": "A security-based swap execution facility shall conduct external penetration testing by engaging independent contractors or by using employees of the security-based swap execution facility who are not responsible for development or operation of the systems or capabilities being tested.", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "Employees may test if they are not responsible for developing or operating the systems tested.", "cite": "§ 242.830(b)(8)(iv)(B)", "url": "https://www.ecfr.gov/current/title-17/section-242.830", "quote": "A security-based swap execution facility shall conduct internal penetration testing by engaging independent contractors, or by using employees of the security-based swap execution facility who are not responsible for development or operation of the systems or capabilities being tested.", "confidence": "verified" }, "social_engineering": { "code": "controls_test", "detail": "Controls testing must include testing of each control in the program of risk analysis and oversight (§ 242.830(b)(8)(v)(A)), and the program's information security category includes security awareness training and personnel security and screening (§ 242.830(b)(1)(ii)). No text names social engineering, phishing or pretexting as a test method.", "cite": "§ 242.830(b)(1)(ii); § 242.830(b)(8)(v)(A)", "url": "https://www.ecfr.gov/current/title-17/section-242.830", "confidence": "verified", "quote": "This category includes, but is not limited to, controls relating to: Access to systems and data (including least privilege, separation of duties, account monitoring, and control); user and device identification and authentication; security awareness training", "harmonized_from": "not_addressed", "harmonize_reason": "R2: § 242.830 copies the CFTC structure: controls testing covers each control in the program, which lists security awareness training and personnel security and screening. Coded as this row's physical cell and the CFTC row." }, "physical": { "code": "controls_test", "detail": "Controls testing covers each control in the program, and the program includes physical access and monitoring. No physical intrusion method.", "cite": "§ 242.830(b)(1)(vii); § 242.830(b)(8)(v)(A)", "url": "https://www.ecfr.gov/current/title-17/section-242.830", "quote": "Physical security and environmental controls. This category includes, but is not limited to: Physical access and monitoring; power, telecommunication, and environmental controls; fire protection;", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "Outsourcing and vendor management is listed as a program category (§ 242.830(b)(1)(vi)). No text places provider systems in the test or requires provider reports.", "cite": "No provision; full text reviewed (searched: third party, vendor, outsourcing, service provider)", "url": "https://www.ecfr.gov/current/title-17/section-242.830", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: industrial control, operational technology, SCADA)", "url": "https://www.ecfr.gov/current/title-17/section-242.830", "confidence": "verified" }, "payment_systems": { "code": "required", "detail": "The rule applies to security-based swap trading venues themselves, and testing covers the automated systems that run them.", "cite": "§ 242.830(a)(3)", "url": "https://www.ecfr.gov/current/title-17/section-242.830", "quote": "Periodically conduct tests to verify that the backup resources of the security-based swap execution facility are sufficient to ensure continued: (i) Order processing and trade matching;", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, hosting)", "url": "https://www.ecfr.gov/current/title-17/section-242.830", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "No provision in § 242.830.", "cite": "No provision; full text reviewed (searched: foreign, cross-border, jurisdiction)", "url": "https://www.ecfr.gov/current/title-17/section-242.830", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "Incident response plan tests may use walk-throughs, tabletop exercises, simulations and comprehensive exercises. No joint attacker and defender review.", "cite": "No provision; full text reviewed (searched: purple, replay, red team, lessons learned)", "url": "https://www.ecfr.gov/current/title-17/section-242.830", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Findings must be documented and either remediated in a timely manner or accepted. Senior management and the board review results (§ 242.830(b)(11)). No deadline or retest rule.", "cite": "§ 242.830(b)(12)", "url": "https://www.ecfr.gov/current/title-17/section-242.830", "quote": "When the security-based swap execution facility determines to remediate a vulnerability or deficiency, it must remediate in a timely manner given the nature and magnitude of the associated risk.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "Test reports go to the SEC promptly on request. They are not filed routinely.", "cite": "§ 242.830(b)(7)(iii)", "url": "https://www.ecfr.gov/current/title-17/section-242.830", "quote": "the security-based swap execution facility shall provide to the Commission the following system-safeguards-related books and records, promptly upon the request of any Commission representative:", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Vulnerability testing must include automated scanning. No AI text.", "cite": "§ 242.830(b)(8)(ii)(B)", "url": "https://www.ecfr.gov/current/title-17/section-242.830", "quote": "Such vulnerability testing shall include automated vulnerability scanning, which shall follow generally accepted best practices.", "confidence": "verified" } } }, { "id": "us-irs-pub1075", "jurisdiction": "United States", "region": "US", "sector": "government", "name": "Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (Rev. 11-2021)", "short": "IRS Pub 1075", "issuer": "Internal Revenue Service, Office of Safeguards", "version": "2021-11", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://www.irs.gov/pub/irs-pdf/p1075.pdf", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Missed in September. A federal rule that makes every federal, state and local agency holding federal tax information run a penetration test of that environment every three years (CA-8), as a condition of receiving the data. The IRS Safeguards page, last reviewed June 28, 2026, still lists Rev. 11-2021 as current.", "cells": { "legal_force": { "code": "mandatory", "detail": "The controls are a condition of receiving federal tax information (FTI) under IRC 6103(p)(4). The IRS can withhold FTI from an agency that does not meet them.", "cite": "Publication 1075 (Rev. 11-2021), Introduction (Overview of Publication 1075), p. 24; Sec. 1.1; Sec. 1.7.2", "url": "https://www.irs.gov/pub/irs-pdf/p1075.pdf", "quote": "This document contains the managerial, operational, and technical security controls that must be implemented as a condition of receipt of FTI.", "confidence": "verified" }, "scope": { "code": "federal, state and local agencies holding FTI", "detail": "Every federal, state and local agency that receives FTI, including its consolidated data centers and contractors. Penetration testing applies to the FTI environment.", "cite": "Publication 1075, Introduction, p. 24; Sec. 4.4 CA-8", "url": "https://www.irs.gov/pub/irs-pdf/p1075.pdf", "quote": "Requirements throughout this document apply to all organizational segments of an agency receiving FTI.", "confidence": "verified" }, "frequency": { "code": "every 3 years", "detail": "Penetration test of the FTI environment every three years. Vulnerability scanning every 30 days (RA-5).", "cite": "Publication 1075, Sec. 4.4, CA-8 (p. 110)", "url": "https://www.irs.gov/pub/irs-pdf/p1075.pdf", "quote": "Conduct penetration testing every 3 years on the FTI environment.", "confidence": "verified" }, "threat_intel": { "code": "recommended", "detail": "Supplemental guidance to CA-8 links the rules of engagement to adversary tactics. No rule requires intelligence-led scenarios.", "cite": "Publication 1075, Sec. 4.4, CA-8 Supplemental Guidance", "url": "https://www.irs.gov/pub/irs-pdf/p1075.pdf", "quote": "Organizations correlate the rules of engagement for the penetration tests with the tools, techniques, and procedures that are anticipated to be employed by adversaries.", "confidence": "verified" }, "provider_requirements": { "code": "recommended", "detail": "Supplemental guidance describes testers with demonstrable skills. No accreditation or certification is named. Contracts or rules of engagement must protect any FTI the testers see.", "cite": "Publication 1075, Sec. 4.4, CA-8 Supplemental Guidance", "url": "https://www.irs.gov/pub/irs-pdf/p1075.pdf", "quote": "Penetration testing goes beyond automated vulnerability scanning and is conducted by agents and teams with demonstrable skills and experience that include technical expertise in network, operating system, and/or application level security.", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "No independent tester is required. The agency sets the level of tester independence through its risk assessment.", "cite": "Publication 1075, Sec. 4.4, CA-8 Supplemental Guidance", "url": "https://www.irs.gov/pub/irs-pdf/p1075.pdf", "quote": "Risk assessments guide the decisions on the level of independence required for the personnel conducting penetration testing.", "confidence": "verified" }, "social_engineering": { "code": "required", "detail": "Agencies must run phishing email simulation exercises at least quarterly (AT-2, IRS-defined requirement). Awareness training must also include practical exercises that simulate incidents, with social engineering and spear phishing as examples (Sec. 2.D.2.1). This sits in the awareness control, not in the penetration test. Coded required, as for ARC-AMPE AT-02 b and CBK CORF 4.5.2.8.", "cite": "Publication 1075, Sec. 4.2, AT-2 (IRS-Defined), p. 100; Sec. 2.D.2.1 Disclosure Awareness Training, p. 63", "url": "https://www.irs.gov/pub/irs-pdf/p1075.pdf", "quote": "Conduct phishing email simulation exercises on at least a quarterly basis.", "confidence": "verified" }, "physical": { "code": "controls_test", "detail": "Agencies must inspect physical safeguards for FTI in internal inspections: every 18 months for headquarters, computer facilities and contractors, every 3 years for field offices. No intrusion test is required.", "cite": "Publication 1075, Sec. 2.D.3 Internal Inspections and On-Site Reviews", "url": "https://www.irs.gov/pub/irs-pdf/p1075.pdf", "quote": "Required items to review during internal inspections include recordkeeping, secure storage, limited access, disposal, and cybersecurity.", "confidence": "verified" }, "third_party": { "code": "required", "detail": "The requirements, including CA-8 on the FTI environment, extend to consolidated data centers, contractors and sub-contractors with FTI access. Agencies must also inspect contractors at least every 18 months.", "cite": "Publication 1075, Introduction, p. 24; Sec. 2.D.3", "url": "https://www.irs.gov/pub/irs-pdf/p1075.pdf", "quote": "It is the agency’s responsibility to ensure all functions within the agency, including consolidated data centers, contractors, and sub-contractors (where allowed by federal statute) with access to FTI, understand and implement the requirements in this publication.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No OT testing content. SCADA appears once, in a wireless networking control, not in testing.", "cite": "No provision; full text reviewed (searched: operational technology, industrial, ICS, SCADA)", "url": "https://www.irs.gov/pub/irs-pdf/p1075.pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No payment system content. \"Payment\" appears only for tax refund offset payments.", "cite": "No provision; full text reviewed (searched: payment, SWIFT, card)", "url": "https://www.irs.gov/pub/irs-pdf/p1075.pdf", "confidence": "verified" }, "cloud_saas": { "code": "assurance_only", "detail": "FTI in the cloud needs prior notice to the IRS and a FedRAMP authorized provider. The agency relies on the provider's FedRAMP authorization rather than testing the provider.", "cite": "Publication 1075, Sec. 2.E.6.1 Cloud Computing, p. 76; Sec. 3.3.1 (a), p. 82", "url": "https://www.irs.gov/pub/irs-pdf/p1075.pdf", "quote": "Document the cloud service provider's FedRAMP authorization such that Safeguards does not have the responsibility to assess the physical security of cloud service provider facilities", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "Residency limit. Nobody located outside the United States, its territories, embassies or military installations may access FTI, and FTI systems must be run by people in the United States.", "cite": "Publication 1075, Sec. 2.C.7 Offshore Operations", "url": "https://www.irs.gov/pub/irs-pdf/p1075.pdf", "quote": "FTI cannot be accessed by agency employees, agents, representatives, contractors, or sub-contractors located outside of the legal jurisdictional boundary of the United States", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple team or replay provision. \"Replay\" appears only for replay-resistant authentication.", "cite": "No provision; full text reviewed (searched: purple, replay, red team, blue team, workshop)", "url": "https://www.irs.gov/pub/irs-pdf/p1075.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Findings go into a plan of action and milestones updated at least quarterly (CA-5). Scans must also confirm remediation (RA-5). IRS review findings go into a corrective action plan.", "cite": "Publication 1075, Sec. 4.4 CA-5; Sec. 2.D.9; Sec. 4.16 RA-5; Sec. 2.E.5", "url": "https://www.irs.gov/pub/irs-pdf/p1075.pdf", "quote": "The POA&M must comprise of an all-inclusive tool or document for the agency to track vulnerabilities identified by the self-assessments, internal inspections, external audits and any other vulnerabilities identified", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "The IRS Office of Safeguards reviews agencies on site or remotely, including automated scanning. Agencies send internal inspection results with the annual Safeguard Security Report, and a new recipient sends a security assessment report.", "cite": "Publication 1075, Sec. 1.6 Safeguard Reviews; Sec. 2.D.3; Sec. 2.E.4 Table 3 (CA-2)", "url": "https://www.irs.gov/pub/irs-pdf/p1075.pdf", "quote": "A safeguard review is an on-site, remote, or a combination of both (hybrid) evaluation of the use of FTI and the measures employed by the receiving agency and its agents (where authorized) to protect the data.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Monthly automated vulnerability scanning (RA-5). CA-8 guidance says penetration testing goes beyond automated scanning. No AI provision.", "cite": "Publication 1075, Sec. 4.16 RA-5; Sec. 4.4 CA-8 Supplemental Guidance", "url": "https://www.irs.gov/pub/irs-pdf/p1075.pdf", "quote": "Monitor and scan for vulnerabilities in the system and hosted applications every thirty (30) days", "confidence": "verified" } } }, { "id": "us-cms-arc-ampe", "jurisdiction": "United States", "region": "US", "sector": "government", "name": "Acceptable Risk Controls for ACA, Medicaid, and Partner Entities (ARC-AMPE), Volume I v1.02 and Volume II ACA Administering Entities Mandatory Baseline v1.02", "short": "CMS ARC-AMPE", "issuer": "Centers for Medicare & Medicaid Services, Center for Consumer Information and Insurance Oversight", "version": "2025-03-04 (compliance date 2026-03-04)", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://www.cms.gov/files/document/arc-ampevol2sspp-aca-aev102-50803212025.xlsx", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Mandatory from March 4, 2026, replacing MARS-E. A federal rule that makes state Medicaid, CHIP and BHP agencies and the ACA exchanges run an independent penetration test every year and send the report with raw results to CMS, and run phishing tests of users.", "cells": { "legal_force": { "code": "mandatory", "detail": "ACA Administering Entities must implement the Volume II controls under 45 CFR 155.260 and 155.280 and their agreements with CMS. Compliance date March 4, 2026.", "cite": "ARC-AMPE Volume I v1.02, Sec. 3.1 and Table 2; CMS regulations and guidance page (release and compliance dates)", "url": "https://www.cms.gov/files/document/arc-ampevol2sspp-aca-aev102-50803212025.xlsx", "quote": "Table 2 lists the ARC-AMPE users that must comply with ARC-AMPE Volume II by implementing the operational, technical, and physical controls documented in the ARC-AMPE.", "confidence": "verified" }, "scope": { "code": "state Medicaid, CHIP and BHP agencies and ACA exchanges", "detail": "ACA Administering Entities: the federal and state exchanges, state Medicaid and CHIP agencies and state Basic Health Program agencies. Some private partner entities follow their own overlays.", "cite": "ARC-AMPE Volume I, Sec. 1.3.2", "url": "https://www.cms.gov/files/document/arc-ampevol2sspp-aca-aev102-50803212025.xlsx", "quote": "ACA Administering Entity (ACA AE) – Exchanges, whether federal or state, state Medicaid agencies, state CHIP agencies, or state agencies administering a BHP.", "confidence": "verified" }, "frequency": { "code": "annual", "detail": "Penetration test of the full system boundary at least once a year, and when new threats are reported or CMS asks.", "cite": "ARC-AMPE Volume II, AE Mandatory Baseline, CA-08 control text", "url": "https://www.cms.gov/files/document/arc-ampevol2sspp-aca-aev102-50803212025.xlsx", "quote": "Conduct penetration testing at least every one (1) year on organization-defined systems or system components as agreed with the penetration testers in the Rules of Engagement.", "confidence": "verified" }, "threat_intel": { "code": "recommended", "detail": "Tests are triggered when new threats are reported. A threat awareness program with threat intelligence sharing is required (PM-16), but no rule says intelligence must shape test scenarios. Coded recommended on the trigger language; not_addressed is a defensible alternative.", "cite": "ARC-AMPE Volume II, AE Mandatory Baseline, CA-08 supplemental guidance; PM-16", "url": "https://www.cms.gov/files/document/arc-ampevol2sspp-aca-aev102-50803212025.xlsx", "quote": "Penetration tests are performed when new risks and threats potentially affecting the system/applications are identified and reported or upon request from CMS.", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "The test must be run by an independent assessor or team approved by the organization's CISO (CA-08, CA-08(01)). No named certification.", "cite": "ARC-AMPE Volume II, AE Mandatory Baseline, CA-08 supplemental guidance; CA-08(01)", "url": "https://www.cms.gov/files/document/arc-ampevol2sspp-aca-aev102-50803212025.xlsx", "quote": "The penetration testing must be conducted by an independent assessor or assessor team.", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "The tester must be independent and CISO-approved. The text does not say whether an independent in-house team qualifies; it points to a separate CMS independent assessment framework that was not reviewed. Coded as for FedRAMP Rev5 CA-08(01).", "cite": "ARC-AMPE Volume II, AE Mandatory Baseline, CA-08(01)", "url": "https://www.cms.gov/files/document/arc-ampevol2sspp-aca-aev102-50803212025.xlsx", "quote": "The independent penetration agent or penetration team must be approved by the organization's Chief Information Security Officer (CISO) or equivalent.", "confidence": "verified" }, "social_engineering": { "code": "required", "detail": "Phishing email tests of system users are a mandatory awareness technique (AT-02 b). They sit in the awareness control, not in the penetration test. Coded required as for CBK CORF 4.5.2.8.", "cite": "ARC-AMPE Volume II, AE Mandatory Baseline, AT-02 (b)", "url": "https://www.cms.gov/files/document/arc-ampevol2sspp-aca-aev102-50803212025.xlsx", "quote": "Employ the following techniques to increase the security and privacy awareness of system users: phishing email tests and other organization-defined techniques.", "confidence": "verified" }, "physical": { "code": "controls_test", "detail": "All controls, physical ones included, must be independently assessed over each three-year cycle. No physical intrusion test.", "cite": "ARC-AMPE Volume II, AE Mandatory Baseline, CA-02 supplemental guidance; PE-03", "url": "https://www.cms.gov/files/document/arc-ampevol2sspp-aca-aev102-50803212025.xlsx", "quote": "A complete independent assessment of all security and privacy controls must be conducted over a three (3) year period", "confidence": "verified" }, "third_party": { "code": "assurance_only", "detail": "Providers of external system services must comply with the organization's controls, and the organization monitors their compliance (SA-09). No rule puts supplier systems inside the test beyond the documented system boundary.", "cite": "ARC-AMPE Volume II, AE Mandatory Baseline, SA-09 (a) and (c)", "url": "https://www.cms.gov/files/document/arc-ampevol2sspp-aca-aev102-50803212025.xlsx", "quote": "Require that providers of external system services comply with organizational security and privacy requirements and employ the organization-defined controls", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No OT content.", "cite": "No provision; Volume I and AE Mandatory Baseline reviewed (searched: operational technology, industrial, SCADA, ICS)", "url": "https://www.cms.gov/files/document/arc-ampevol2sspp-aca-aev102-50803212025.xlsx", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No payment system content. \"Payment\" appears only for advance premium tax credit applications.", "cite": "No provision; Volume I and AE Mandatory Baseline reviewed (searched: payment, SWIFT, card)", "url": "https://www.cms.gov/files/document/arc-ampevol2sspp-aca-aev102-50803212025.xlsx", "confidence": "verified" }, "cloud_saas": { "code": "permitted", "detail": "Volume II assumes most systems are hosted in an outsourced facility or a cloud environment, and CA-08 requires a penetration test of the documented system and its full boundary. Cloud-hosted components in that boundary are therefore in the test. No rule names cloud or SaaS testing as such.", "cite": "ARC-AMPE Volume II, Assumptions sheet, item 2; AE Mandatory Baseline, CA-08 supplemental guidance", "url": "https://www.cms.gov/files/document/arc-ampevol2sspp-aca-aev102-50803212025.xlsx", "quote": "Most of the systems will be hosted in an outsourced computing facility or cloud environment.", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "PII must be processed and stored within the continental U.S., Hawaii, or U.S. territories (SA-09(05), SA-09(08)), while support, development and IT services may be off-shored, and an ACA AE must notify CMS 60 days before outsourcing system services outside the U.S. These are data location and outsourcing conditions. SA-09(08) points organizations that process FTI to IRS Publication 1075, whose residency limit is coded in that row. Nothing in ARC-AMPE itself limits where testers or people with system access sit, reaches foreign entities or addresses tests across borders.", "cite": "No cross-border testing provision under R1; SA-09(05) and SA-09(08) considered", "url": "https://www.cms.gov/files/document/arc-ampevol2sspp-aca-aev102-50803212025.xlsx", "confidence": "verified", "harmonized_from": "addressed", "harmonize_reason": "R1: SA-09(05) and SA-09(08) fix where PII is processed and stored, and offshoring needs only notice to CMS; data location and outsourcing conditions are not counted, as decided for SAMA CSF." }, "purple_replay": { "code": "not_addressed", "detail": "No purple team or replay provision.", "cite": "No provision; AE Mandatory Baseline reviewed (searched: purple, replay, red team, blue team)", "url": "https://www.cms.gov/files/document/arc-ampevol2sspp-aca-aev102-50803212025.xlsx", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Penetration test reports must give remediation plans. Findings go into the POA&M (CA-05). Scan findings have fixed deadlines: critical 15 days, high 30, moderate 90, low one year (RA-05 d).", "cite": "ARC-AMPE Volume II, AE Mandatory Baseline, CA-08 supplemental guidance; CA-05; RA-05 (d)", "url": "https://www.cms.gov/files/document/arc-ampevol2sspp-aca-aev102-50803212025.xlsx", "quote": "Penetration Testing reports must be provided to CMS and must summarize the findings and articulate the significance, impact, and risk of the findings and provide remediation plans.", "confidence": "verified" }, "regulator_role": { "code": "receives_results", "detail": "CMS receives penetration test reports with raw results, can ask for a test, and reviews the artifacts before granting the connection to the federal data hub.", "cite": "ARC-AMPE Volume II, AE Mandatory Baseline, CA-08 supplemental guidance; Volume I Sec. 4.1 and Table 4", "url": "https://www.cms.gov/files/document/arc-ampevol2sspp-aca-aev102-50803212025.xlsx", "quote": "Penetration Testing reports provided to CMS must include the underlying raw security information/results in unaltered format.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Vulnerability scans every 30 days with tools that automate parts of vulnerability management (RA-05). No AI provision.", "cite": "ARC-AMPE Volume II, AE Mandatory Baseline, RA-05 (a) and (b)", "url": "https://www.cms.gov/files/document/arc-ampevol2sspp-aca-aev102-50803212025.xlsx", "quote": "Monitor and scan for vulnerabilities in the system and hosted applications every thirty (30) calendar days", "confidence": "verified" } } }, { "id": "sa-sama-csf", "jurisdiction": "Saudi Arabia", "region": "GCC", "sector": "financial", "name": "Cyber Security Framework", "short": "SAMA CSF", "issuer": "Saudi Central Bank (SAMA; issued as Saudi Arabian Monetary Authority)", "version": "Version 1.0, May 2017; Circular No. 381000091275 (24/5/2017G); Rulebook status In-Force", "status": "In force as of 2026-09-28. The SAMA Rulebook page shows Status: In-Force and offers only the Version 1.0 PDF. The Rulebook update log for 2025-01-01 to 2026-09-28 (70 entries, two pages) lists no change to the CSF.", "public": "full", "primary_url": "https://rulebook.sama.gov.sa/en/cyber-security-framework-2", "arabic_title": "الدليل التنظيمي لأمن المعلومات في القطاع المالي", "regulator_arabic": "البنك المركزي السعودي", "arabic_source_url": "https://rulebook.sama.gov.sa/ar/%D8%A7%D9%84%D8%AF%D9%84%D9%8A%D9%84-%D8%A7%D9%84%D8%AA%D9%86%D8%B8%D9%8A%D9%85%D9%8A-%D9%84%D8%A3%D9%85%D9%86-%D8%A7%D9%84%D9%85%D8%B9%D9%84%D9%88%D9%85%D8%A7%D8%AA-%D9%81%D9%8A-%D8%A7%D9%84%D9%82%D8%B7%D8%A7%D8%B9-%D8%A7%D9%84%D9%85%D8%A7%D9%84%D9%8A-2", "arabic_note": "SAMA marks the Arabic page as a translation; the English text is the original.", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No regulatory change. Rulebook page text identical to the 2026-09-28 copy; the PDF is byte-identical (SHA-256 ce68ce5a...). The Rulebook update log for 2026-01-01 to 2026-10-30 has 23 entries, the latest dated August 26, 2026, and none amends the CSF. Two cells are corrected for consistency with the coding rules (see changes); the integrator should confirm. The Arabic page is marked by SAMA as a translation; the English text is the original." }, "notes": "Unchanged since May 2017. The Rulebook update log for January 2025 to September 2026 has no CSF entry; vendor claims of a Q4 2025 CSF update could not be matched to any SAMA publication and are not coded. FEER Sec. 5.4 requires red team recommendations to consider the CSF. The CSF itself sets penetration testing only for customer and internet facing services (annual) and names red teaming only as an example of independent SOC testing.", "cells": { "legal_force": { "code": "mandatory", "detail": "Issued by SAMA circular and listed In-Force in the SAMA Rulebook. Member organizations must adopt it and should operate at maturity level 3 or higher. Where a control cannot be applied, the entity should use compensating controls, accept the risk internally and request a formal SAMA waiver.", "cite": "Sec. 1.1; Sec. 1.5; Sec. 2.2; Sec. 2.4", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3837_VER1.pdf", "quote": "To maintain the protection of information assets and online services, the Member Organizations must adopt the Framework.", "confidence": "verified" }, "scope": { "code": "all SAMA-regulated member organizations", "detail": "Sec. 1.4 lists all banks, insurance and reinsurance companies, financing companies and credit bureaus operating in Saudi Arabia, and the financial market infrastructure. Non-bank institutions are exempt from some subdomains. The Rulebook's current scope line reads banking, finance, payment systems and payment service providers, credit bureaus and the regulatory sandbox, and does not list insurance.", "cite": "Sec. 1.4; SAMA Rulebook header (Scope of application)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3837_VER1.pdf", "quote": "The Framework is applicable to all Member Organizations regulated by SAMA, which include the following:", "confidence": "verified" }, "frequency": { "code": "annual", "detail": "Customer and internet facing services need an annual review and penetration test. Critical information assets need periodic cyber security reviews, and the change management process should include penetration testing where applicable.", "cite": "Sec. 3.2.4, control considerations 1 and 2; Sec. 3.3.7, control consideration 4(b)(1)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3837_VER1.pdf", "quote": "Customer and internet facing services should be subject to annual review and penetration tests.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Sec. 3.3.16 requires a threat intelligence management process using internal and external sources, but no clause ties threat intelligence to test scope or scenarios.", "cite": "No provision linking threat intelligence to testing; full text reviewed (searched: threat intelligence, scenario, penetration, red-teaming, testing)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3837_VER1.pdf", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "The only tester requirement is independence: the security event management process must include independent periodic testing of SOC effectiveness, for example red teaming. There are no qualification, certification or accreditation rules for penetration testers.", "cite": "Sec. 3.3.14, control consideration 4(l)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3837_VER1.pdf", "quote": "independent periodic testing of the effectiveness of the security operations center (e.g., red-teaming).", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "The text does not say who performs penetration tests. The SOC test must be independent, which does not by itself rule out an internal team that is independent of the SOC.", "cite": "No provision; full text reviewed (searched: internal, in-house, external, tester, independent, third party)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3837_VER1.pdf", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "Awareness programs must cover threats such as spear-phishing and be evaluated for effectiveness (Sec. 3.1.6, control considerations 5(c) and 6). No phishing simulation or social engineering test is named.", "cite": "No provision; full text reviewed (searched: social engineering, phishing, simulation, awareness)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3837_VER1.pdf", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Sec. 3.3.2 requires a physical security process whose effectiveness is monitored, measured and periodically evaluated. No physical intrusion test is named.", "cite": "No provision; full text reviewed (searched: physical, intrusion, premises, test, red-teaming)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3837_VER1.pdf", "confidence": "verified" }, "third_party": { "code": "assurance_only", "detail": "Contract management must cover risk-based testing of the agreed cyber security requirements and the right to periodically review and audit the third party. Sec. 3.4 defines third parties to include outsourcing and cloud providers, vendors and government agencies. Pooled or joint tests are not mentioned.", "cite": "Sec. 3.4 (introduction); Sec. 3.4.1, control considerations 4(c) and 5(d)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3837_VER1.pdf", "quote": "The contract management process should cover requirements for: ... testing of the agreed cyber security requirements (risk-based);", "confidence": "verified", "harmonized_from": "required", "harmonize_reason": "3.4.1: contracts should cover risk-based testing of agreed requirements and audit rights; suppliers are not in the firm's penetration test." }, "ot": { "code": "not_addressed", "detail": "No mention of operational technology or industrial control systems.", "cite": "No provision; full text reviewed (searched: operational technology, industrial, ICS, SCADA, OT)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3837_VER1.pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "Sec. 3.2.3 requires compliance with PCI-DSS, EMV and SWIFT CSCF (March 2017), and Sec. 3.3.12 points to SARIE and mada security rules. The CSF itself sets no testing rule for payment systems; ATM controls in Sec. 3.3.13 cover prevention and detection, not testing.", "cite": "No provision on testing payment systems; full text reviewed (searched: payment, SWIFT, SARIE, mada, ATM, card, penetration)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3837_VER1.pdf", "confidence": "verified" }, "cloud_saas": { "code": "assurance_only", "detail": "Coding correction, not a regulatory change. The cloud policy must give the member organization the right to perform a cyber security review, audit and examination at the cloud provider. Under the harmonization rule, contract rights to audit a supplier are assurance_only. The September cell missed control consideration 4(g).", "cite": "Sec. 3.4.3, control consideration 4(g)(1) to 4(g)(3)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3837_VER1.pdf", "confidence": "verified", "history": [ { "date": "2026-10-30", "from": "not_addressed", "to": "assurance_only", "why": "Coding correction, not a regulatory change. The cloud policy must give the member organization the right to perform a cyber security review, audit and examination at the cloud provider. Under the harmonization rule, contract rights to audit a supplier are assurance_only. The September cell missed control consideration 4(g)." } ], "quote": "the Member Organization has the right to perform a cyber security audit at the cloud service provider;" }, "cross_border": { "code": "not_addressed", "detail": "Sec. 3.4.3, control consideration 4(b) says cloud services should in principle be located in Saudi Arabia and use abroad needs explicit SAMA approval. That is a data location rule, not a testing rule.", "cite": "No provision on cross-border testing; full text reviewed (searched: outside Saudi Arabia, foreign, jurisdiction, group, subsidiaries, location)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3837_VER1.pdf", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple team or replay requirement.", "cite": "No provision; full text reviewed (searched: purple, replay, workshop, lessons learned, red-teaming)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3837_VER1.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Review results, issues and recommended actions must be recorded and reported to the business owner, then follow-up reviews check that all issues were addressed. Sec. 3.3.17 requires defined mitigation timelines per vulnerability class. No fixed deadline is set.", "cite": "Sec. 3.2.4, control considerations 3 to 5; Sec. 3.3.17, control consideration 3(d)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3837_VER1.pdf", "quote": "Cyber security review should be subject to follow-up reviews to check that: a. all identified issues have been addressed;", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "SAMA reviews and audits member organizations' self-assessments. Penetration test results are reported to the business owner; the CSF does not require sending them to SAMA.", "cite": "Sec. 2.3; Sec. 3.2.4, control consideration 4", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3837_VER1.pdf", "quote": "The self-assessments will be reviewed and audited by SAMA to determine the level of compliance with the Framework and the cyber security maturity level of the Member Organization.", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "Automation appears only for monitoring and access management (maturity level 4 in Sec. 2.4.2, SIEM in Sec. 3.3.14, Sec. 3.3.5), not for testing.", "cite": "No provision; full text reviewed (searched: automat, artificial intelligence, AI, machine learning, continuous)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3837_VER1.pdf", "confidence": "verified" } } }, { "id": "sa-sama-feer", "jurisdiction": "Saudi Arabia", "region": "GCC", "sector": "financial", "name": "Financial Entities Ethical Red-Teaming Framework (F.E.E.R.)", "short": "SAMA FEER", "issuer": "Saudi Central Bank (SAMA; issued as Saudi Arabian Monetary Authority)", "version": "Version 1.0, May 2019; Circular No. 562240000067 (13/5/2019G); Rulebook status In-Force", "status": "In force as of 2026-09-28. The SAMA Rulebook shows Status: In-Force with a single version (May 13 2019). The Rulebook update log for 2025-01-01 to 2026-09-28 lists no FEER change.", "public": "full", "primary_url": "https://rulebook.sama.gov.sa/en/financial-entities-ethical-red-teaming-0", "arabic_title": "محاكاة الهجمات السيبرانية الأخلاقية في المؤسسات المالية", "regulator_arabic": "البنك المركزي السعودي", "arabic_source_url": "https://rulebook.sama.gov.sa/ar/%D9%85%D8%AD%D8%A7%D9%83%D8%A7%D8%A9-%D8%A7%D9%84%D9%87%D8%AC%D9%85%D8%A7%D8%AA-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A%D8%A9-%D8%A7%D9%84%D8%A3%D8%AE%D9%84%D8%A7%D9%82%D9%8A%D8%A9-%D9%81%D9%8A-%D8%A7%D9%84%D9%85%D8%A4%D8%B3%D8%B3%D8%A7%D8%AA-%D8%A7%D9%84%D9%85%D8%A7%D9%84%D9%8A%D8%A9", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No change. Rulebook pages identical to the September copies; the PDF is byte-identical (57203dfb...). The Arabic issuing circular, which SAMA marks as the original, calls the framework \"الاطار التنظيمي لمحاكاة سيناريوهات الهجمات السيبرانية\" and says SAMA \"will conduct periodic tests\" under it (https://rulebook.sama.gov.sa/en/circular-re-financial-entities-ethical-red-teaming). For the integrator: the cross_border cell is not_addressed, yet regimes.md cites FEER Appendix A(10) (\"stored in encrypted format and locally (not at cloud providers)\") as an in-country limit. \"Locally\" may mean on-premises rather than in Saudi Arabia, so this slice leaves the code unchanged and flags the inconsistency." }, "notes": "Publicly available on the SAMA Rulebook as HTML and PDF; no vendor summary was needed. Four phases: preparation, scenario (up to 5 weeks, Sec. 4.1), execution, lessons learned (about 4 weeks, Sec. 6.1). The White Team is capped at five people and the Blue Team is not told (Sec. 2.2). The provider must immediately disclose implants and accounts used, and the White Team must evidence their removal to SAMA (Sec. 5.4). Version discrepancy: a third-party-hosted PDF also labeled Version 1.0 May 2019 differs only in Secs. 1.3 and 1.6. It says SAMA selects entities 'considering its criticality' and that 'as minimum, Domestic Systemic important entities will be subject to testing once every three (3) years'. The SAMA Rulebook copy, coded here, applies the three-year minimum to every member organization. SAMA has not published a revision.", "cells": { "legal_force": { "code": "mandatory", "detail": "Issued by SAMA circular and listed In-Force in the SAMA Rulebook. The text says SAMA mandates the framework and may require any member organization to run a test, though most operative clauses use 'should'.", "cite": "Sec. 1.4; Sec. 1.3", "url": "https://rulebook.sama.gov.sa/sites/default/files/ar_net_file_store/SAMA_AR_2898_VER1.pdf", "quote": "The framework is mandated by SAMA. SAMA is the owner and is responsible for periodically updating the Framework.", "confidence": "verified" }, "scope": { "code": "all SAMA-regulated member organizations", "detail": "Applies to every financial institution regulated by SAMA. The Rulebook lists the banking sector, finance sector, payment systems and payment service providers, and credit bureaus. SAMA may select any member organization for a test, and entities may also run tests on their own.", "cite": "Sec. 1.3; SAMA Rulebook header (Scope of application)", "url": "https://rulebook.sama.gov.sa/sites/default/files/ar_net_file_store/SAMA_AR_2898_VER1.pdf", "quote": "The Framework applies to all Member Organizations in the Financial Sector, which are regulated by SAMA. SAMA has the authority to select any Member Organization and request the organization to perform a red teaming test", "confidence": "verified" }, "frequency": { "code": "every 3 years", "detail": "Each member organization should be tested at least once every three years. SAMA can also request a test at any time based on emerging threats or threat intelligence.", "cite": "Sec. 1.6; Sec. 1.3", "url": "https://rulebook.sama.gov.sa/sites/default/files/ar_net_file_store/SAMA_AR_2898_VER1.pdf", "quote": "Each Member Organization within the Financial Sector of Saudi Arabia and are regulated by SAMA should be tested, as a minimum once every three (3) years, in line with this framework.", "confidence": "verified" }, "threat_intel": { "code": "required", "detail": "SAMA's Green Team and the entity's White Team each supply threat intelligence; the provider adds its own and derives the scenarios. Detailed scenarios are mapped to critical assets using external, internal and sector-wide intelligence and must be agreed with the Green Team. The scenario phase lasts up to five weeks.", "cite": "Secs. 2.5, 4.1, 4.2, 4.4", "url": "https://rulebook.sama.gov.sa/sites/default/files/ar_net_file_store/SAMA_AR_2898_VER1.pdf", "quote": "Based on the combined threat intelligence the Red Team determines the attack scenarios and strategies.", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "The provider is external, pre-selected and appointed by SAMA's Green Team. Appendix A lists 7 experience criteria and 13 method, governance and data handling criteria, and suggests certifications such as CREST CCSAM and CCSAS, OSCP, GPEN, CISSP and CISM. The certifications are suggested, not mandated.", "cite": "Sec. 2.1(4); Sec. 3.3; Sec. 3.5; Appendix A", "url": "https://rulebook.sama.gov.sa/sites/default/files/ar_net_file_store/SAMA_AR_2898_VER1.pdf", "quote": "The Green Team will appoint the red team provider, who are pre-selected to execute the Red Teaming tests, based on their experiences and skilled staff.", "confidence": "verified" }, "internal_testers": { "code": "not_allowed", "detail": "The framework defines the Red Team as an external, selected third party and gives no route for in-house testers. It does not state a prohibition in those words.", "cite": "Sec. 2.1(4); Sec. 2.2 (Red Team)", "url": "https://rulebook.sama.gov.sa/sites/default/files/ar_net_file_store/SAMA_AR_2898_VER1.pdf", "quote": "The Red Team, a selected third party that executes the attack scenarios and consists of certified and experienced specialists.", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "The kill chain the red team simulates lists phishing and social engineering as delivery means, and reconnaissance covers staff names, emails and interests. No clause requires a social engineering scenario.", "cite": "Sec. 2.4 (stage 1 Reconnaissance; stage 3 Delivery)", "url": "https://rulebook.sama.gov.sa/sites/default/files/ar_net_file_store/SAMA_AR_2898_VER1.pdf", "quote": "The transmission of the crafted attack to the victims by the use of different means, such as: email (attachments), phishing, websites, physical devices or social engineering.", "confidence": "verified" }, "physical": { "code": "permitted", "detail": "Only physical devices and removable media appear, as ways to deliver an attack. Physical entry into premises is not mentioned.", "cite": "Sec. 2.4 (stage 3 Delivery; stage 4 Exploitation)", "url": "https://rulebook.sama.gov.sa/sites/default/files/ar_net_file_store/SAMA_AR_2898_VER1.pdf", "quote": "The transmission of the crafted attack to the victims by the use of different means, such as: email (attachments), phishing, websites, physical devices or social engineering.", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "Third parties appear only as the red team provider. The tested entity's suppliers and service providers are not named as targets or participants, and pooled tests are not mentioned.", "cite": "No provision; full text reviewed (searched: third party, supplier, vendor, outsourc, service provider, pooled)", "url": "https://rulebook.sama.gov.sa/sites/default/files/ar_net_file_store/SAMA_AR_2898_VER1.pdf", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No mention of operational technology or industrial control systems.", "cite": "No provision; full text reviewed (searched: industrial, operational technology, ICS, SCADA, OT)", "url": "https://rulebook.sama.gov.sa/sites/default/files/ar_net_file_store/SAMA_AR_2898_VER1.pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "Payment system operators and payment service providers are in scope as entities (Rulebook header), but the text does not name payment systems, SWIFT or card systems as test targets. Targets are the entity's own critical assets ('flags').", "cite": "No provision; full text reviewed (searched: payment, SWIFT, card, SARIE, mada, ATM)", "url": "https://rulebook.sama.gov.sa/sites/default/files/ar_net_file_store/SAMA_AR_2898_VER1.pdf", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "Cloud appears only in Appendix A(10): any agreed data exfiltration should be stored encrypted and locally, not at cloud providers. Cloud services are not named as test scope.", "cite": "No provision on cloud in test scope; full text reviewed (searched: cloud, SaaS, hosting)", "url": "https://rulebook.sama.gov.sa/sites/default/files/ar_net_file_store/SAMA_AR_2898_VER1.pdf", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "No provision on foreign group entities, multi-jurisdiction tests or mutual recognition.", "cite": "No provision; full text reviewed (searched: foreign, abroad, cross-border, jurisdiction, outside, group, recognition)", "url": "https://rulebook.sama.gov.sa/sites/default/files/ar_net_file_store/SAMA_AR_2898_VER1.pdf", "confidence": "verified" }, "purple_replay": { "code": "required", "detail": "After the final red and blue team reports and a 360 degree feedback session, the White Team organizes a joint Red and Blue Team Replay Exercise. Repeat replays for IT staff and senior management are strongly suggested.", "cite": "Sec. 6.1; Sec. 6.2; Sec. 6.3", "url": "https://rulebook.sama.gov.sa/sites/default/files/ar_net_file_store/SAMA_AR_2898_VER1.pdf", "quote": "After the feedback session, a Replay Exercise should be organized, led by the Blue and Red Team.", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "The White Team drafts a remediation plan with priorities and agreed due dates, shares it with SAMA's Green Team and reports progress periodically to the entity's cyber security committee and the Green Team. No retest is required.", "cite": "Sec. 6.4; Sec. 6.5; Appendix B (Remediation Plan)", "url": "https://rulebook.sama.gov.sa/sites/default/files/ar_net_file_store/SAMA_AR_2898_VER1.pdf", "quote": "The White Team shares the internally agreed and approved remediation plan with the Green Team and periodically track the remediation progress to ensure that the vulnerabilities identified are monitored and mitigated.", "confidence": "verified" }, "regulator_role": { "code": "leads_or_oversees_test", "detail": "SAMA supplies the Green Team and Test Manager, approves the provider, the scoping document, the scenarios and the final plan, and receives a copy of the final report. An anonymized summary goes via SAMA to sector committees such as the Banking Committee for Information Security.", "cite": "Sec. 2.1(1); Sec. 2.2 (Green Team); Secs. 3.3, 3.6, 4.5, 5.4; Appendix B (RTTSR)", "url": "https://rulebook.sama.gov.sa/sites/default/files/ar_net_file_store/SAMA_AR_2898_VER1.pdf", "quote": "The final report should be agreed upon by all Teams involved and copy of the report should be submitted to SAMA by the provider.", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "No mention of automated, continuous or AI-driven testing or of AI systems.", "cite": "No provision; full text reviewed (searched: automat, artificial, AI, machine learning, continuous)", "url": "https://rulebook.sama.gov.sa/sites/default/files/ar_net_file_store/SAMA_AR_2898_VER1.pdf", "confidence": "verified" } } }, { "id": "sa-sama-crfr", "jurisdiction": "Saudi Arabia", "region": "GCC", "sector": "financial", "name": "Cyber Resilience Fundamental Requirements (CRFR)", "short": "SAMA CRFR", "issuer": "Saudi Central Bank (SAMA)", "version": "Version 1.0, January 2022 (Rulebook date 1/1/2022); Rulebook status In-Force", "status": "In force as of 2026-09-28 per the SAMA Rulebook (Status: In-Force). No change listed in the Rulebook update log for 2025-01-01 to 2026-09-28.", "public": "full", "primary_url": "https://rulebook.sama.gov.sa/en/cyber-resilience-fundamental-requirements-crfr-1", "arabic_title": "المتطلبات الأساسية للمرونة السيبرانية (CRFR)", "regulator_arabic": "البنك المركزي السعودي", "arabic_source_url": "https://rulebook.sama.gov.sa/ar/%D8%A7%D9%84%D9%85%D8%AA%D8%B7%D9%84%D8%A8%D8%A7%D8%AA-%D8%A7%D9%84%D8%A3%D8%B3%D8%A7%D8%B3%D9%8A%D8%A9-%D9%84%D9%84%D9%85%D8%B1%D9%88%D9%86%D8%A9-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A%D8%A9-crfr-0", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No change. Rulebook page identical to the September copy; the PDF is byte-identical (cfe9fbac...). Not listed in the 2026 update log." }, "notes": "Added to this slice because it is SAMA's only in-force text that sets a penetration test frequency above annual (twice a year) and the only Saudi text reviewed that mentions adversarial attacks on models. It is a licensing baseline for new fintech and sandbox entities; licensed entities move to the CSF and BCM frameworks (Sec. 1.2).", "cells": { "legal_force": { "code": "mandatory", "detail": "The document calls its controls mandatory requirements, and SAMA may refuse a license or sandbox graduation to an entity that cannot show compliance.", "cite": "Sec. 2.2; Sec. 1.4", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3726_VER1.pdf", "quote": "the fundamental requirements sets the essential cyber security and resilience mandatory requirements for entities that are within the scope of applicability.", "confidence": "verified" }, "scope": { "code": "new licensees and sandbox entities", "detail": "Applies to entities seeking a SAMA license or entry to the Regulatory Sandbox, meant for recently established entities. The Rulebook lists finance, payment systems and payment service providers, money exchange and the sandbox. It does not replace the CSF once an entity is licensed.", "cite": "Sec. 1 (Introduction); Sec. 1.2; SAMA Rulebook header (Scope of application)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3726_VER1.pdf", "quote": "The framework “Fundamental Requirements” applies to entities intending to qualify for SAMA Regulatory Sandbox environment and/or entities seeking license to operate in the kingdom of Saudi Arabia.", "confidence": "verified" }, "frequency": { "code": "every 6 months", "detail": "Penetration testing at least twice a year and after any major or critical change. Vulnerability assessment is periodic, with the interval set by the entity.", "cite": "Control 3.2.6; Control 3.2.5; Appendix A (Periodically)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3726_VER1.pdf", "quote": "Entities should conduct penetration testing (PT) twice a year as a minimum or after major/ critical change to comprehensively evaluate its cyber security defense capability.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "No threat intelligence requirement tied to testing.", "cite": "No provision; full text reviewed (searched: threat intelligence, intelligence, scenario)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3726_VER1.pdf", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "No rules on who performs the penetration test.", "cite": "No provision; full text reviewed (searched: qualif, certif, independent, provider, external)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3726_VER1.pdf", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Silent on internal or external testers.", "cite": "No provision; full text reviewed (searched: internal, in-house, external, tester)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3726_VER1.pdf", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "No social engineering or phishing test. Control 3.2.9 covers brand monitoring of apps, social media and websites.", "cite": "No provision; full text reviewed (searched: social engineering, phishing, awareness, simulation)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3726_VER1.pdf", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "No physical security testing.", "cite": "No provision; full text reviewed (searched: physical, premises, intrusion)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3726_VER1.pdf", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "No third-party control of any kind.", "cite": "No provision; full text reviewed (searched: third, vendor, supplier, outsourc, service provider)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3726_VER1.pdf", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No mention of operational technology.", "cite": "No provision; full text reviewed (searched: industrial, operational technology, ICS, OT)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3726_VER1.pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "Payment service providers are in scope as entities, but no clause names payment systems as test targets.", "cite": "No provision; full text reviewed (searched: payment, SWIFT, card, mada, SARIE)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3726_VER1.pdf", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "No mention of cloud.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, hosting)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3726_VER1.pdf", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "No cross-border provision, though the sandbox admits international firms (Sec. 1).", "cite": "No provision; full text reviewed (searched: foreign, abroad, outside, border, jurisdiction)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3726_VER1.pdf", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple team or replay requirement.", "cite": "No provision; full text reviewed (searched: purple, replay, red team)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3726_VER1.pdf", "confidence": "verified" }, "remediation_retest": { "code": "not_addressed", "detail": "No rule on fixing penetration test findings. Control 3.2.7 requires timely patching and Control 3.1.6 a monitored risk register, neither tied to test results.", "cite": "No provision on remediation of test findings; full text reviewed (searched: remediat, retest, follow-up, finding)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3726_VER1.pdf", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "Entities send a self-assessment to SAMA, which may review it and may audit compliance at any time.", "cite": "Sec. 2.3", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3726_VER1.pdf", "quote": "SAMA also reserves the right to audit the compliance with the fundamental requirements of the entities at any time.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Entities must adopt and evaluate protections against attacks on machine learning models. This concerns defending AI systems, not AI-driven testing.", "cite": "Control 3.1.4(b)", "url": "https://rulebook.sama.gov.sa/sites/default/files/en_net_file_store/SAMA_EN_3726_VER1.pdf", "quote": "adoption and evaluation of cyber security measures for the protection against adversarial attacks (e.g. model stealing, malicious inputs, and poisoning attack).", "confidence": "verified" } } }, { "id": "sa-nca-ecc", "jurisdiction": "Saudi Arabia", "region": "GCC", "sector": "cross-sector", "name": "Essential Cybersecurity Controls (ECC-2:2024)", "short": "NCA ECC-2:2024", "issuer": "National Cybersecurity Authority (NCA)", "version": "ECC-2:2024, with the implementation guide GECC-2:2026", "status": "In force as of 2026-09-28. The NCA ECC page (dated 31/07/2025, last updated 19/07/2026) lists ECC 2-2024 and the Guide to ECC Implementation, which is labeled GECC-2:2026. No later ECC edition was found on nca.gov.sa or in web searches.", "public": "full", "primary_url": "https://nca.gov.sa/en/regulatory-documents/controls-list/ecc/", "arabic_title": "الضوابط الأساسية للأمن السيبراني", "regulator_arabic": "الهيئة الوطنية للأمن السيبراني", "arabic_source_url": "https://nca.gov.sa/ar/regulatory-documents/controls-list/ecc/", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No change. English page still shows last update 19/07/2026 and links the same ECC and GECC PDFs, both byte-identical to the September copies. The Arabic page was last modified 17/05/2026 and links the Arabic ECC-2:2024, which NCA says is the binding text." }, "notes": "ECC-2:2024 has 4 domains, 28 subdomains, 108 main controls and 92 subcontrols (Introduction). Penetration testing is Subdomain 2-11 in both editions; Appendix (C) lists no change to 2-11. The mandatory scope is internet-facing only (2-11-3-1): internal networks are outside the ECC test requirement unless the CSCC applies. Vendor blog claims that the ECC requires annual tests by independent teams are not in the ECC text; the annual schedule appears only in the GECC guide. NCA licenses only managed SOC providers (RFMSOC-1:2024; 6 Tier 1 and 20 Tier 2 licensees listed on 2026-09-28); no NCA license category for penetration testing or red teaming was found.", "cells": { "legal_force": { "code": "mandatory", "detail": "Binding under Article 10(3) of the NCA Statute and High Order No. 57231. The Arabic text is the binding version.", "cite": "Implementation and Compliance; Executive Summary", "url": "https://cdn.nca.gov.sa/api/files/public/upload/86e09090-44e4-481f-bc28-355673607654_ECC--2024-EN.pdf", "quote": "all entities within the scope of these Controls shall take all necessary measures to ensure ongoing and continuous compliance with these Controls.", "confidence": "verified" }, "scope": { "code": "government entities and CNI operators", "detail": "Government agencies and their affiliated companies and entities inside and outside the Kingdom, plus private entities that own, operate or host critical national infrastructure. Other entities are encouraged but not required to apply it. Banks designated as CNI fall under both ECC and SAMA rules.", "cite": "ECC Scope of Work", "url": "https://cdn.nca.gov.sa/api/files/public/upload/86e09090-44e4-481f-bc28-355673607654_ECC--2024-EN.pdf", "quote": "These Controls are applicable to government agencies in the Kingdom of Saudi Arabia (including ministries, authorities, establishments and others) and their affiliated companies and entities (inside and outside the kingdom), as well as all private sector entities owning, operating, or hosting Critical National Infrastructures (CNIs)", "confidence": "verified" }, "frequency": { "code": "periodic (entity-defined)", "detail": "The control requires periodic tests without an interval. NCA's GECC-2:2026 guide tells entities to set an annual penetration testing schedule in an action plan. Scope is all services offered over the Internet and their components (Control 2-11-3-1).", "cite": "Subcontrol 2-11-3-2; GECC-2:2026 guidance on 2-11-3-2", "url": "https://cdn.nca.gov.sa/api/files/public/upload/86e09090-44e4-481f-bc28-355673607654_ECC--2024-EN.pdf", "quote": "Conducting penetration tests periodically.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Subcontrols 2-13-3-4 and 2-13-3-5 require sharing threat intelligence with NCA and handling threat feeds, but nothing ties threat intelligence to penetration test scope or scenarios.", "cite": "No provision linking threat intelligence to testing; full text reviewed (searched: threat intelligence, scenario, penetration, simulation)", "url": "https://cdn.nca.gov.sa/api/files/public/upload/86e09090-44e4-481f-bc28-355673607654_ECC--2024-EN.pdf", "confidence": "verified" }, "provider_requirements": { "code": "recommended", "detail": "The ECC is silent on testers. NCA's implementation guide tells entities to write their own requirements for the testing team into a penetration testing policy but sets none itself. Separately, NCA registration has been required since August 1, 2022 for any provider of cybersecurity services in the Kingdom.", "cite": "GECC-2:2026, guidance on Control 2-11-1; NCA Registration and Licensing page", "url": "https://cdn.nca.gov.sa/api/files/public/upload/94c6c5f5-4d70-4afd-a440-64369aa667e2_Guide-to-Essential-Cybersecurity-Controls-(ECC)-Implementation-en.pdf", "quote": "Define the requirements for the team responsible for performing the penetration testing.", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Neither the ECC nor the GECC says whether tests must be internal or external.", "cite": "No provision; full text of ECC-2:2024 reviewed (searched: internal, external, independent, tester, team)", "url": "https://cdn.nca.gov.sa/api/files/public/upload/86e09090-44e4-481f-bc28-355673607654_ECC--2024-EN.pdf", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "Subcontrol 1-10-3-1 requires awareness training on phishing emails, and the GECC names social engineering as awareness content. No phishing simulation or social engineering test is required.", "cite": "No provision; full text reviewed (searched: social engineering, phishing, simulation, awareness)", "url": "https://cdn.nca.gov.sa/api/files/public/upload/86e09090-44e4-481f-bc28-355673607654_ECC--2024-EN.pdf", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Subdomain 2-14 sets physical security requirements and periodic review, with no physical test.", "cite": "No provision; full text reviewed (searched: physical, intrusion, test, simulation)", "url": "https://cdn.nca.gov.sa/api/files/public/upload/86e09090-44e4-481f-bc28-355673607654_ECC--2024-EN.pdf", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "Test scope covers all externally provided services and their technical components, which may be run by suppliers, but third parties are not named. Subdomain 4-1 sets contract clauses only.", "cite": "No provision; full text reviewed (searched: third party, outsourcing, managed services, vendor, supplier, penetration)", "url": "https://cdn.nca.gov.sa/api/files/public/upload/86e09090-44e4-481f-bc28-355673607654_ECC--2024-EN.pdf", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "ECC-2 deleted the Industrial Control Systems domain (domain 5) of ECC-1 and moved it to the OTCC.", "cite": "No provision; full text reviewed (searched: industrial, ICS, OT, SCADA). Appendix (C) records deletion of main domain 5.", "url": "https://cdn.nca.gov.sa/api/files/public/upload/86e09090-44e4-481f-bc28-355673607654_ECC--2024-EN.pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No mention of payment systems. SWIFT and PCI appear only as examples of international requirements in the definitions.", "cite": "No provision; full text reviewed (searched: payment, SWIFT, PCI, card)", "url": "https://cdn.nca.gov.sa/api/files/public/upload/86e09090-44e4-481f-bc28-355673607654_ECC--2024-EN.pdf", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "Subdomain 4-2 covers cloud and hosting security, with no testing rule. ECC-2 moved data localization rules to the National Data Management Office.", "cite": "No provision; full text reviewed (searched: cloud, hosting, penetration, test)", "url": "https://cdn.nca.gov.sa/api/files/public/upload/86e09090-44e4-481f-bc28-355673607654_ECC--2024-EN.pdf", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "The controls, including penetration testing, apply to government affiliates inside and outside the Kingdom; ECC-2 added the words 'inside and outside the kingdom'. Managed security operations centers that use remote access must be located fully in Saudi Arabia.", "cite": "ECC Scope of Work; Appendix (C) (scope modification); Subcontrol 4-1-3-2", "url": "https://cdn.nca.gov.sa/api/files/public/upload/86e09090-44e4-481f-bc28-355673607654_ECC--2024-EN.pdf", "quote": "Cybersecurity managed service centers for monitoring and operations which use remote access shall be fully located in the Kingdom of Saudi Arabia.", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple team or replay requirement.", "cite": "No provision; full text reviewed (searched: purple, replay, red team, exercise)", "url": "https://cdn.nca.gov.sa/api/files/public/upload/86e09090-44e4-481f-bc28-355673607654_ECC--2024-EN.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Vulnerabilities must be remediated according to their classification and risk, and audit results must include remediation plans. No deadline or retest is tied to penetration test findings.", "cite": "Subcontrol 2-10-3-3; Control 1-8-3", "url": "https://cdn.nca.gov.sa/api/files/public/upload/86e09090-44e4-481f-bc28-355673607654_ECC--2024-EN.pdf", "quote": "Vulnerabilities remediation based on their classification and the associated cyber risks.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "NCA assesses compliance through self-assessments, compliance tool reports and field audits. It does not run or receive individual tests.", "cite": "Implementation and Compliance", "url": "https://cdn.nca.gov.sa/api/files/public/upload/86e09090-44e4-481f-bc28-355673607654_ECC--2024-EN.pdf", "quote": "The NCA shall evaluate the entities’ compliance with the ECC through multiple means, such as self-assessment by the entities, periodic reports of the compliance tool, and/or field auditing visits, in accordance with the mechanism deemed appropriate by the NCA.", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "Artificial intelligence appears only in the executive summary as a general trend. The GECC mentions automated channels for compliance review, not testing.", "cite": "No provision; full text reviewed (searched: automat, artificial intelligence, AI, continuous)", "url": "https://cdn.nca.gov.sa/api/files/public/upload/86e09090-44e4-481f-bc28-355673607654_ECC--2024-EN.pdf", "confidence": "verified" } } }, { "id": "sa-nca-cscc", "jurisdiction": "Saudi Arabia", "region": "GCC", "sector": "cross-sector", "name": "Critical Systems Cybersecurity Controls (CSCC-2:2026)", "short": "NCA CSCC-2:2026", "issuer": "National Cybersecurity Authority (NCA)", "version": "CSCC-2:2026, Arabic only; posted on the NCA Arabic CSCC page, last modified 29/10/2026; PDF created October 29, 2026; replaces CSCC-1:2019", "status": "Current edition as of 2026-10-30. NCA posted CSCC-2:2026 on its Arabic CSCC page on October 29, 2026, replacing CSCC-1:2019.", "public": "full", "primary_url": "https://cdn.nca.gov.sa/api/public/cms/files/14828b9c-c1d5-4c6c-9b06-b6564f3ed17a_CSCC---2-2026-AR-.pdf", "arabic_title": "ضوابط الأمن السيبراني للأنظمة الحساسة", "regulator_arabic": "الهيئة الوطنية للأمن السيبراني", "arabic_source_url": "https://nca.gov.sa/ar/regulatory-documents/controls-list/cscc/", "arabic_note": "NCA published CSCC-2:2026 in Arabic only. Detail text is our English reading of the Arabic, not an official translation.", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "superseded", "note": "CSCC-1:2019 was replaced by CSCC-2:2026 on October 29, 2026, one day before this check. NCA posted it only on its Arabic CSCC page. The English page still shows CSCC-1:2019 (last update 15/06/2025), and no NCA news item announces it. The new edition keeps all 17 codes. It keeps the six-monthly penetration test, the qualified-team rule and the ban on remote access from outside the Kingdom. Appendix D lists the changes: critical systems identified through Haseen criteria, \"national entities\" in scope, compliance assessed through Haseen and on-site audits, and a stricter hosting rule (4-2-1-1). Every cell now cites the Arabic PDF (SHA-256 dd39788d...). The PDF text layer substitutes some Arabic glyphs, so the quotes were transcribed from rendered pages 11, 12, 17 and 20 of the PDF. Detail text is our English reading of the Arabic; it is not an official translation." }, "notes": "4 main domains, 21 subdomains, 32 main controls, 73 subcontrols (Introduction). The CSCC extends the ECC test from internet-facing services to all internal and external services of critical systems and sets a six-month cycle. It also requires an annual CSCC review by the cybersecurity function and an independent review every three years (Controls 1-4-1, 1-4-2).", "cells": { "legal_force": { "code": "mandatory", "detail": "Unchanged. All entities in scope must achieve full and continuous compliance. CSCC-2 drops the compliance period that CSCC-1 allowed. Quote is Arabic, the binding text. English summary is ours.", "cite": "CSCC-2:2026, Implementation and Compliance (p. 9)", "url": "https://cdn.nca.gov.sa/api/public/cms/files/14828b9c-c1d5-4c6c-9b06-b6564f3ed17a_CSCC---2-2026-AR-.pdf", "quote": "يجب على جميع الجهات ضمن نطاق عمل هذه الضوابط تنفيذ ما يحقق الالتزام الكامل والمستمر بهذه الضوابط.", "confidence": "verified" }, "scope": { "code": "critical systems of government and CNI entities", "detail": "Code unchanged. Scope now reads \"national entities\" instead of \"public entities\" (Appendix D). It covers government bodies inside and outside the Kingdom, their companies and private entities that own or operate critical systems. Critical systems are now identified by criteria in NCA's Haseen portal, not by criteria printed in the document.", "cite": "CSCC-2:2026, Scope of Work and Applicability (p. 8); Critical Systems Identification Criteria (p. 7); Appendix D", "url": "https://cdn.nca.gov.sa/api/public/cms/files/14828b9c-c1d5-4c6c-9b06-b6564f3ed17a_CSCC---2-2026-AR-.pdf", "quote": "يجب تطبيق هذه الضوابط على الأنظمة الحساسة -وفقاً للمعايير المذكورة في هذه الوثيقة- من قبل الجهات الوطنية المالكة أو المشغلة لهذه الأنظمة، سواء أكانت جهات حكومية (مثل وزارات وهيئات ومؤسسات وسفارات وغيرها) داخل المملكة العربية السعودية؛ أو خارجها، أو جهات وشركات تابعة للجهات الحكومية، أو جهات القطاع الخاص", "confidence": "verified" }, "frequency": { "code": "every 6 months", "detail": "Unchanged. Critical systems must be penetration tested at least every six months. Test scope must cover all technical components and all internal and external services (2-10-1-1).", "cite": "CSCC-2:2026, Control 2-10-2; Subcontrol 2-10-1-1 (p. 17)", "url": "https://cdn.nca.gov.sa/api/public/cms/files/14828b9c-c1d5-4c6c-9b06-b6564f3ed17a_CSCC---2-2026-AR-.pdf", "quote": "يجب عمل اختبار الاختراق على الأنظمة الحساسة، كل ستة أشهر؛ على الأقل.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Unchanged. The penetration testing objective mentions simulating real attack techniques, but no clause ties threat intelligence to test scope or scenarios.", "cite": "CSCC-2:2026, No provision; full text reviewed (searched: threat intelligence, scenario, red team; Arabic text searched: التهديدات، استخبار، سيناريو)", "url": "https://cdn.nca.gov.sa/api/public/cms/files/14828b9c-c1d5-4c6c-9b06-b6564f3ed17a_CSCC---2-2026-AR-.pdf", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Unchanged. Tests must be run by a qualified team. Qualification is not defined.", "cite": "CSCC-2:2026, Subcontrol 2-10-1-2 (p. 17)", "url": "https://cdn.nca.gov.sa/api/public/cms/files/14828b9c-c1d5-4c6c-9b06-b6564f3ed17a_CSCC---2-2026-AR-.pdf", "quote": "عمل اختبار الاختراق من قبل فريق مؤهل.", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Unchanged. The text does not say whether the qualified team may be in-house.", "cite": "CSCC-2:2026, No provision; full text reviewed (searched: internal, in-house, external, independent, tester; Arabic text searched: داخلي، خارجي، مستقل، فريق)", "url": "https://cdn.nca.gov.sa/api/public/cms/files/14828b9c-c1d5-4c6c-9b06-b6564f3ed17a_CSCC---2-2026-AR-.pdf", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "Unchanged.", "cite": "CSCC-2:2026, No provision; full text reviewed (searched: social engineering, phishing, simulation, awareness; Arabic text searched: الهندسة الاجتماعية، التصيد، التوعية)", "url": "https://cdn.nca.gov.sa/api/public/cms/files/14828b9c-c1d5-4c6c-9b06-b6564f3ed17a_CSCC---2-2026-AR-.pdf", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Unchanged.", "cite": "CSCC-2:2026, No provision; full text reviewed (searched: physical, intrusion, premises, test; Arabic text searched: المادي، الأمن المادي)", "url": "https://cdn.nca.gov.sa/api/public/cms/files/14828b9c-c1d5-4c6c-9b06-b6564f3ed17a_CSCC---2-2026-AR-.pdf", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "Unchanged. Domain 4 requires vetting of outsourcing staff and national providers for outsourced and managed services on critical systems (4-1-1-1, 4-1-1-2), with no testing rule.", "cite": "CSCC-2:2026, No provision; full text reviewed (searched: third party, supplier, outsourcing, vendor, service provider; Arabic text searched: الأطراف الخارجية، الإسناد، الخدمات المدارة)", "url": "https://cdn.nca.gov.sa/api/public/cms/files/14828b9c-c1d5-4c6c-9b06-b6564f3ed17a_CSCC---2-2026-AR-.pdf", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "Unchanged. Operational technology appears only in the executive summary.", "cite": "CSCC-2:2026, No provision; full text reviewed (searched: operational technology, industrial, ICS, SCADA; Arabic text searched: التشغيلية، الصناعية)", "url": "https://cdn.nca.gov.sa/api/public/cms/files/14828b9c-c1d5-4c6c-9b06-b6564f3ed17a_CSCC---2-2026-AR-.pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "Unchanged.", "cite": "CSCC-2:2026, No provision; full text reviewed (searched: payment, card, SWIFT, settlement, market infrastructure; Arabic text searched: المدفوعات)", "url": "https://cdn.nca.gov.sa/api/public/cms/files/14828b9c-c1d5-4c6c-9b06-b6564f3ed17a_CSCC---2-2026-AR-.pdf", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "Unchanged code. Hosting rule changed: critical systems must be hosted in the entity's own data center, the National Information Center or a sovereign cloud (4-2-1-1). CSCC-1 also allowed CCC-compliant government or Saudi cloud providers. No rule on testing cloud services.", "cite": "CSCC-2:2026, No provision; full text reviewed (searched: cloud, SaaS, hosting, test; Arabic text searched: السحابية، الاستضافة)", "url": "https://cdn.nca.gov.sa/api/public/cms/files/14828b9c-c1d5-4c6c-9b06-b6564f3ed17a_CSCC---2-2026-AR-.pdf", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "Unchanged code. Remote access to critical systems from outside the Kingdom stays prohibited (2-2-1-1). Scope still covers government bodies abroad. The new hosting rule (4-2-1-1) keeps critical systems in the entity's data center, the National Information Center or a sovereign cloud.", "cite": "CSCC-2:2026, Subcontrol 2-2-1-1 (p. 14); Subcontrol 4-2-1-1 (p. 20); Scope of Work and Applicability (p. 8)", "url": "https://cdn.nca.gov.sa/api/public/cms/files/14828b9c-c1d5-4c6c-9b06-b6564f3ed17a_CSCC---2-2026-AR-.pdf", "quote": "منع الدخول عن بعد من خارج المملكة.", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "Unchanged.", "cite": "CSCC-2:2026, No provision; full text reviewed (searched: purple, replay, red team, lessons learned; Arabic text searched: الأحمر، محاكاة)", "url": "https://cdn.nca.gov.sa/api/public/cms/files/14828b9c-c1d5-4c6c-9b06-b6564f3ed17a_CSCC---2-2026-AR-.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Unchanged. Vulnerabilities must be assessed and remediated monthly for external and internet-facing critical systems and quarterly for internal ones (2-9-1-2). Newly found critical vulnerabilities must be fixed immediately (2-9-1-3).", "cite": "CSCC-2:2026, Subcontrols 2-9-1-2 and 2-9-1-3 (p. 17)", "url": "https://cdn.nca.gov.sa/api/public/cms/files/14828b9c-c1d5-4c6c-9b06-b6564f3ed17a_CSCC---2-2026-AR-.pdf", "quote": "معالجة فورية للثغرات الحرجة (Critical Vulnerabilities) المكتشفة حديثاً؛ مع اتباع آليات إدارة التغيير، المعتمدة لدى الجهة.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "Code unchanged. NCA now assesses compliance through its Haseen portal and on-site audit visits. CSCC-1 named self-assessment and field visits. NCA reported inspection visits to national entities on September 8, 2026.", "cite": "CSCC-2:2026, Implementation and Compliance (p. 9); Appendix D", "url": "https://cdn.nca.gov.sa/api/public/cms/files/14828b9c-c1d5-4c6c-9b06-b6564f3ed17a_CSCC---2-2026-AR-.pdf", "quote": "تقوم الهيئة بتقييم التزام الجهات بما ورد في هذه الضوابط من خلال بوابة حصين والقيام بالزيارات الميدانية للتدقيق، وفق الآلية التي تراها الهيئة مناسبة لذلك.", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "Unchanged. Artificial intelligence appears only in the executive summary, not in any testing control.", "cite": "CSCC-2:2026, No provision; full text reviewed (searched: automat, artificial intelligence, AI, machine learning, continuous; Arabic text searched: الذكاء الاصطناعي، آلي، مؤتمت)", "url": "https://cdn.nca.gov.sa/api/public/cms/files/14828b9c-c1d5-4c6c-9b06-b6564f3ed17a_CSCC---2-2026-AR-.pdf", "confidence": "verified" } } }, { "id": "sa-nca-otcc", "jurisdiction": "Saudi Arabia", "region": "GCC", "sector": "cross-sector", "name": "Operational Technology Cybersecurity Controls (OTCC-1:2022)", "short": "NCA OTCC-1:2022", "issuer": "National Cybersecurity Authority (NCA)", "version": "OTCC-1:2022, with the Methodology and Mapping Annex", "status": "In force as of 2026-09-28. The NCA OTCC page (last updated 29/10/2025) lists OTCC-1:2022 as current; no OTCC-2 was found. ECC-2:2024 moved all ICS controls here.", "public": "full", "primary_url": "https://nca.gov.sa/en/regulatory-documents/controls-list/otcc/", "arabic_title": "ضوابط الأمن السيبراني للأنظمة التشغيلية", "regulator_arabic": "الهيئة الوطنية للأمن السيبراني", "arabic_source_url": "https://nca.gov.sa/ar/regulatory-documents/controls-list/otcc/", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No change. English and Arabic pages both show last update 29/10/2025. The English PDF is byte-identical to the September copy (8c1e7671...). No OTCC-2 found." }, "notes": "Control counts by level: L1 151, L2 117, L3 56 controls and subcontrols. The OTCC still names ECC-1:2018 as the prerequisite. Control levels were read from the rendered PDF pages because text extraction drops the checkmarks. The OTCC has the most specific Saudi test rules for the human and physical seams (2-13-1-9) and the supplier seam (1-4-1-2), but only for L1 and L2 facilities.", "cells": { "legal_force": { "code": "mandatory", "detail": "Binding under Article 10(3) of the NCA mandate and Royal Decree 57231. Organizations comply at the control level set for each facility (L1 high, L2 moderate, L3 low criticality).", "cite": "Executive Summary; Implementation and Compliance; OTCC Controls and Sub-controls Levels", "url": "https://nca.gov.sa/otcc_en.pdf", "quote": "All applicable organizations must implement all necessary measures to ensure continuous compliance with these controls", "confidence": "verified" }, "scope": { "code": "ICS in critical facilities of government and CNI entities", "detail": "Industrial control systems in facilities deemed critical, owned or operated by government bodies or private CNI operators, in the Kingdom or abroad. Controls apply only where they will not jeopardize operational continuity.", "cite": "Scope of Work; Statement of Applicability", "url": "https://nca.gov.sa/otcc_en.pdf", "quote": "These controls are applicable to Industrial Control Systems (ICSs) that reside in facilities that are deemed critical and owned and/or operated by government organizations ... as well as private sector organizations owning, operating or hosting Critical National Infrastructures (CNIs), whether they are in the kingdom or abroad", "confidence": "verified" }, "frequency": { "code": "3, 6 or 12 months by facility level", "detail": "OT penetration tests every 3 months at L1, 6 months at L2 and 12 months at L3. Vulnerability assessments follow the same cycle (2-9-1-3).", "cite": "Subcontrol 2-10-1-3 (control level table, p. 31)", "url": "https://nca.gov.sa/otcc_en.pdf", "quote": "With reference to the ECC subcontrol 2-11-3-2, penetration testing for OT/ICS systems must be conducted periodically.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "At L1, threat intelligence must identify TTPs of groups targeting OT (2-12-1-8) and tune SIEM alerts (2-11-1-9). Neither is tied to penetration test scope or scenarios.", "cite": "No provision linking threat intelligence to testing; full text reviewed (searched: threat intelligence, TTP, scenario, penetration, simulation)", "url": "https://nca.gov.sa/otcc_en.pdf", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "At L1, test scope must cover the OT environment and connected networks, delivered by a qualified team. No definition, certification or accreditation is given.", "cite": "Subcontrol 2-10-1-1 (L1 only, p. 31)", "url": "https://nca.gov.sa/otcc_en.pdf", "quote": "scope and activities of penetration testing must be defined to ensure the coverage of OT/ICS environment and networks connected to the operational network by qualified team.", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Silent on internal or external testers.", "cite": "No provision; full text reviewed (searched: internal, external, independent, qualified, tester)", "url": "https://nca.gov.sa/otcc_en.pdf", "confidence": "verified" }, "social_engineering": { "code": "required", "detail": "At L1 and L2, physical security readiness must be tested periodically through simulation exercises, with social engineering given as the example. No interval is set.", "cite": "Subcontrol 2-13-1-9 (L1 and L2, p. 34)", "url": "https://nca.gov.sa/otcc_en.pdf", "quote": "Physical security capabilities and readiness must be periodically tested by performing simulation exercises (such as social engineering).", "confidence": "verified" }, "physical": { "code": "required", "detail": "At L1 and L2, physical security capabilities around OT assets must be tested periodically through simulation exercises. This is the only Saudi text reviewed that requires a physical test.", "cite": "Subcontrol 2-13-1-9 (L1 and L2, p. 34)", "url": "https://nca.gov.sa/otcc_en.pdf", "quote": "Physical security capabilities and readiness must be periodically tested by performing simulation exercises (such as social engineering).", "confidence": "verified" }, "third_party": { "code": "assurance_only", "detail": "At L1 and L2, cybersecurity requirements must be part of acceptance testing, including Factory Acceptance Testing, which the glossary places at the vendor's facility. Vendor personnel work on site must be monitored (2-13-1-7). No red team or penetration test of suppliers is required.", "cite": "Subcontrol 1-4-1-2 (L1 and L2, p. 19); Terms and Definitions (Factory Acceptance Test)", "url": "https://nca.gov.sa/otcc_en.pdf", "quote": "Cybersecurity requirements must be included as part of any functional and acceptance testing and evaluation process (such as Factory Acceptance Testing “FAT” , Site Acceptance Testing “SAT”, Commissioning Testing, Change Testing, Integration Testing and Source Code Review).", "confidence": "verified", "harmonized_from": "required", "harmonize_reason": "1-4-1-2 cyber requirements in factory and site acceptance tests; no supplier penetration test or red team." }, "ot": { "code": "required", "detail": "OT penetration testing is required at every level. At L1, tests must have limited or no production impact or run on an identical separate environment, and passive methods must be defined where impact is possible.", "cite": "Subcontrols 2-10-1-2, 2-10-1-3, 2-10-1-4 (p. 31)", "url": "https://nca.gov.sa/otcc_en.pdf", "quote": "penetration testing must only be conducted with limited or no impact on the production environment, or on an identical separate environment.", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No mention of payment systems.", "cite": "No provision; full text reviewed (searched: payment, SWIFT, card, financial)", "url": "https://nca.gov.sa/otcc_en.pdf", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "No mention of cloud.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, hosting)", "url": "https://nca.gov.sa/otcc_en.pdf", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "Scope covers in-scope facilities in the Kingdom or abroad. Remote access to OT networks is exceptional and must be risk assessed, time limited and recorded (2-2-1-7).", "cite": "Scope of Work; Subcontrol 2-2-1-7", "url": "https://nca.gov.sa/otcc_en.pdf", "quote": "whether they are in the kingdom or abroad", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple team or replay requirement. At L1 and L2, incident response must be tested through cyber-attack simulation exercises (2-12-1-7), and BCP and DRP through tabletop exercises (3-1-1-6).", "cite": "No provision; full text reviewed (searched: purple, replay, lessons learned, red team)", "url": "https://nca.gov.sa/otcc_en.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "At L1, newly found critical vulnerabilities with significant risk must be remediated in a timely manner. No deadline or retest is tied to penetration test findings.", "cite": "Subcontrol 2-9-1-2 (L1 only, p. 30)", "url": "https://nca.gov.sa/otcc_en.pdf", "quote": "remediation of newly discovered critical vulnerabilities presenting significant risks to the OT/ICS environment must be performed in a timely manner.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "NCA assesses compliance through self-assessment and field audits by NCA or third parties it designates.", "cite": "Implementation and Compliance", "url": "https://nca.gov.sa/otcc_en.pdf", "quote": "NCA evaluates the organization’s compliance with the (OTCC:1-2022) through multiple means such as self-assessment by the Organization and/or audit field visits by NCA or designated third-parties", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "Automation appears for asset inventory (2-1-1-2) and change detection (1-5-3-5), not testing.", "cite": "No provision; full text reviewed (searched: automat, artificial intelligence, AI, continuous)", "url": "https://nca.gov.sa/otcc_en.pdf", "confidence": "verified" } } }, { "id": "sa-cma-cyber-guidelines", "jurisdiction": "Saudi Arabia", "region": "GCC", "sector": "financial", "name": "Cybersecurity Guidelines for Capital Market Institutions", "short": "CMA Cybersecurity Guidelines", "issuer": "Capital Market Authority (CMA)", "version": "Undated; file metadata dates the Arabic text to late 2019 and the English to September 2020", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://cma.gov.sa/en/RulesRegulations/Guides/Documents/Cyber_Security_en.pdf", "arabic_title": "الدليل الاسترشادي للأمن السيبراني لمؤسسات السوق المالية", "regulator_arabic": "هيئة السوق المالية", "arabic_source_url": "https://cma.gov.sa/RulesRegulations/Guides/Pages/default.aspx", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Sets an annual penetration test of external online services, penetration testing in change management and an independent SOC test, for brokers, asset managers and other capital market institutions under CMA. Not reviewed in September. The document prints no issue date; file metadata dates the Arabic text to late 2019 and the English to September 2020. CMA says the Arabic text is the official reference: https://cma.gov.sa/RulesRegulations/Guides/Documents/Cyber_Security_Guidelines_for_Financial_Market_Institutions.pdf", "cells": { "legal_force": { "code": "mixed", "detail": "CMA calls the document guidelines for all capital market institutions, says CMA may apply it to any entity it supervises, and says its \"Main Controls\" are mandatory. The Arabic text, which CMA names as the official reference, says CMA has the right to impose it.", "cite": "Sec. 2.3 (Applicability); Sec. 3.1; Disclaimer", "url": "https://cma.gov.sa/en/RulesRegulations/Guides/Documents/Cyber_Security_en.pdf", "quote": "This document is considered as “guidelines” to all capital market institutions. CMA may apply this document to any entity under follow-up and supervision of CMA.", "confidence": "verified" }, "scope": { "code": "capital market institutions supervised by CMA", "detail": "Saudi capital market institutions under CMA supervision, such as brokers and asset managers. Market infrastructure operators are not named.", "cite": "Sec. 2.2 (Scope of Work)", "url": "https://cma.gov.sa/en/RulesRegulations/Guides/Documents/Cyber_Security_en.pdf", "quote": "The Guidelines clarifies Cybersecurity controls for Saudi capital market institutions under the supervision of CMA.", "confidence": "verified" }, "frequency": { "code": "annual", "detail": "All external online services need a penetration test at least once a year. Change management must also include security testing with penetration testing (4.3.3, main control 2(2)).", "cite": "Sec. 4.3.10, main control 5(5); Sec. 4.3.3, main control 2(2)", "url": "https://cma.gov.sa/en/RulesRegulations/Guides/Documents/Cyber_Security_en.pdf", "quote": "Conducting penetration testing for all external (Online) services annually at minimum.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Sec. 4.3.9 requires a threat management process fed by internal and external threat intelligence sources, but no clause ties it to test scope or scenarios.", "cite": "No provision; full text reviewed (searched: threat intelligence, scenario, red team)", "url": "https://cma.gov.sa/en/RulesRegulations/Guides/Documents/Cyber_Security_en.pdf", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "The only tester rule is independence: the SOC must be tested periodically and independently, for example by a red team. No qualification or certification rule for penetration testers. Coded the same way as SAMA CSF 3.3.14.", "cite": "Sec. 4.3.8, main control 7(12)", "url": "https://cma.gov.sa/en/RulesRegulations/Guides/Documents/Cyber_Security_en.pdf", "quote": "Conducting a periodic and independent test to verify SOC effectiveness (For example: Red Team).", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "The text does not say who runs penetration tests. The SOC test must be independent.", "cite": "No provision; full text reviewed (searched: internal, in-house, external, independent, tester)", "url": "https://cma.gov.sa/en/RulesRegulations/Guides/Documents/Cyber_Security_en.pdf", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "Awareness programs must cover threats such as phishing (4.1.4, main control 4(2)). No phishing simulation or social engineering test is named.", "cite": "No provision; full text reviewed (searched: social engineering, phishing, simulation, awareness)", "url": "https://cma.gov.sa/en/RulesRegulations/Guides/Documents/Cyber_Security_en.pdf", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Sec. 4.3.14 requires physical security controls whose effectiveness is measured and periodically evaluated. No physical intrusion test is named. Coded the same way as SAMA CSF 3.3.2.", "cite": "No provision; full text reviewed (searched: physical, intrusion, premises, test)", "url": "https://cma.gov.sa/en/RulesRegulations/Guides/Documents/Cyber_Security_en.pdf", "confidence": "verified" }, "third_party": { "code": "assurance_only", "detail": "Contracts must give an authority to audit and review the supplier and must cover risk-based testing of the agreed controls. Third parties include outsourcing, cloud and government providers (Sec. 4.4). Supplier systems are not placed in the institution's own test.", "cite": "Sec. 4.4.1, main controls 4(2) and 5(4); Sec. 4.4 (introduction)", "url": "https://cma.gov.sa/en/RulesRegulations/Guides/Documents/Cyber_Security_en.pdf", "quote": "Test the agreed cybersecurity controls (Risks-Based Testing).", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "The text is silent on this point.", "cite": "No provision; full text reviewed (searched: operational technology, industrial, ICS, SCADA)", "url": "https://cma.gov.sa/en/RulesRegulations/Guides/Documents/Cyber_Security_en.pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "E-trading services have their own controls (4.3.13) and fall within the annual test of external online services, but no clause names payment, card or market infrastructure systems.", "cite": "No provision; full text reviewed (searched: payment, card, SWIFT, settlement, market infrastructure)", "url": "https://cma.gov.sa/en/RulesRegulations/Guides/Documents/Cyber_Security_en.pdf", "confidence": "verified" }, "cloud_saas": { "code": "assurance_only", "detail": "The cloud policy must give the institution the right to review, audit and inspect the cloud provider. No rule on testing cloud services.", "cite": "Sec. 4.4.3, main control 4(8)", "url": "https://cma.gov.sa/en/RulesRegulations/Guides/Documents/Cyber_Security_en.pdf", "quote": "The market institution shall have the right to conduct cybersecurity review, audit and inspection of the cloud computing service provider.", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "Outsourced security monitoring must use providers in Saudi Arabia, and cloud services must be in Saudi Arabia (4.4.3, main control 4(3)). The head of cybersecurity must be Saudi (4.1.1, main control 2).", "cite": "Sec. 4.4.2, main control 5; Sec. 4.4.3, main control 4(3)", "url": "https://cma.gov.sa/en/RulesRegulations/Guides/Documents/Cyber_Security_en.pdf", "quote": "Outsourcing is limited to providing security operations monitoring services for service providers within KSA.", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "The text is silent on this point.", "cite": "No provision; full text reviewed (searched: purple, replay, red team, lessons learned)", "url": "https://cma.gov.sa/en/RulesRegulations/Guides/Documents/Cyber_Security_en.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "The vulnerability management process must set patch timelines by severity. Review results must be documented and reported (4.2.2). No retest rule.", "cite": "Sec. 4.3.12, main control 3(4); Sec. 4.2.2, main control 2", "url": "https://cma.gov.sa/en/RulesRegulations/Guides/Documents/Cyber_Security_en.pdf", "quote": "Setting timelines to patch vulnerabilities, based on their classification;", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "Implementation is subject to periodic self-assessment through questionnaires on a mechanism CMA sets. Test results are not sent to CMA. Cyber incidents are reported to CMA (4.3.7).", "cite": "Sec. 3.2", "url": "https://cma.gov.sa/en/RulesRegulations/Guides/Documents/Cyber_Security_en.pdf", "quote": "Implementation of the Guidelines in market institutions is subject to periodic self-assessment based on questionnaires and self-assessment forms according to a mechanism that CMA deems appropriate.", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "Automation appears only for access management and log analysis, not testing.", "cite": "No provision; full text reviewed (searched: automat, artificial intelligence, AI, machine learning, continuous)", "url": "https://cma.gov.sa/en/RulesRegulations/Guides/Documents/Cyber_Security_en.pdf", "confidence": "verified" } } }, { "id": "sa-nca-ccc", "jurisdiction": "Saudi Arabia", "region": "GCC", "sector": "cross-sector", "name": "Cloud Cybersecurity Controls (CCC-2:2024)", "short": "NCA CCC-2:2024", "issuer": "National Cybersecurity Authority (NCA)", "version": "2024", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://cdn.nca.gov.sa/api/files/public/upload/6d5408a3-d8e6-4e96-963b-2c7198e5b7c2_CCC-2-2024-EN-.pdf", "arabic_title": "ضوابط الأمن السيبراني للحوسبة السحابية", "regulator_arabic": "الهيئة الوطنية للأمن السيبراني", "arabic_source_url": "https://nca.gov.sa/ar/regulatory-documents/controls-list/ccc/", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Requires cloud providers serving government bodies and CNI operators to penetration test their cloud technology stack every six months, and binds those government tenants. September listed CCC as not reviewed. If added, the method doc statements that no GCC regime requires testing of cloud tenancies, and that 2 of 29 GCC regimes require the supplier seam, need revising.", "cells": { "legal_force": { "code": "mandatory", "detail": "Cloud providers and government or CNI tenants in scope must comply continuously, by provider level 1 to 4 (Annex A). The Arabic version is binding.", "cite": "Implementation and Compliance", "url": "https://cdn.nca.gov.sa/api/files/public/upload/6d5408a3-d8e6-4e96-963b-2c7198e5b7c2_CCC-2-2024-EN-.pdf", "quote": "all CSPs and CSTs within the scope of these controls must implement whatever necessary to ensure continuous compliance with the CCC", "confidence": "verified" }, "scope": { "code": "cloud providers serving government and CNI entities, and those tenants", "detail": "Tenants in scope are government bodies inside or outside the Kingdom, their companies and private CNI operators that use cloud services. Providers in scope are any cloud provider serving them.", "cite": "CCC Scope of Work", "url": "https://cdn.nca.gov.sa/api/files/public/upload/6d5408a3-d8e6-4e96-963b-2c7198e5b7c2_CCC-2-2024-EN-.pdf", "quote": "CSPs within the scope of CCC are any CSP which provides cloud computing services to the CSTs within the scope of work.", "confidence": "verified" }, "frequency": { "code": "every 6 months", "detail": "Cloud providers must penetration test the cloud technology stack at least every six months, at all four provider levels (Annex A, Table 2). Tenants have no CCC test control and fall back on ECC 2-11-3.", "cite": "Subcontrol 2-10-P-1-1", "url": "https://cdn.nca.gov.sa/api/files/public/upload/6d5408a3-d8e6-4e96-963b-2c7198e5b7c2_CCC-2-2024-EN-.pdf", "quote": "Scope of penetration tests must cover Cloud Technology Stack and must be conducted at least once every six months.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Providers must subscribe to specialized groups to stay current on threats (2-12-P-1-1), but no clause ties this to testing.", "cite": "No provision; full text reviewed (searched: threat intelligence, scenario, red team)", "url": "https://cdn.nca.gov.sa/api/files/public/upload/6d5408a3-d8e6-4e96-963b-2c7198e5b7c2_CCC-2-2024-EN-.pdf", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "CCC sets no tester rule. ECC applies alongside it.", "cite": "No provision; full text reviewed (searched: qualified, independent, accredited, certified, provider)", "url": "https://cdn.nca.gov.sa/api/files/public/upload/6d5408a3-d8e6-4e96-963b-2c7198e5b7c2_CCC-2-2024-EN-.pdf", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "The text is silent on this point.", "cite": "No provision; full text reviewed (searched: internal, in-house, external, independent, tester)", "url": "https://cdn.nca.gov.sa/api/files/public/upload/6d5408a3-d8e6-4e96-963b-2c7198e5b7c2_CCC-2-2024-EN-.pdf", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "The text is silent on this point.", "cite": "No provision; full text reviewed (searched: social engineering, phishing, simulation, awareness)", "url": "https://cdn.nca.gov.sa/api/files/public/upload/6d5408a3-d8e6-4e96-963b-2c7198e5b7c2_CCC-2-2024-EN-.pdf", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Subdomain 2-13 requires monitoring of access to provider sites, with no testing rule.", "cite": "No provision; full text reviewed (searched: physical, intrusion, premises, test)", "url": "https://cdn.nca.gov.sa/api/files/public/upload/6d5408a3-d8e6-4e96-963b-2c7198e5b7c2_CCC-2-2024-EN-.pdf", "confidence": "verified" }, "third_party": { "code": "required", "detail": "CCC regulates the cloud suppliers of government bodies and requires each to penetration test the stack that serves them every six months. Coded on the same basis as FedRAMP in the US slice. Tenants need not test the provider or obtain its report.", "cite": "Subcontrol 2-10-P-1-1; CCC Scope of Work", "url": "https://cdn.nca.gov.sa/api/files/public/upload/6d5408a3-d8e6-4e96-963b-2c7198e5b7c2_CCC-2-2024-EN-.pdf", "quote": "Scope of penetration tests must cover Cloud Technology Stack and must be conducted at least once every six months.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "The text is silent on this point.", "cite": "No provision; full text reviewed (searched: operational technology, industrial, ICS, SCADA)", "url": "https://cdn.nca.gov.sa/api/files/public/upload/6d5408a3-d8e6-4e96-963b-2c7198e5b7c2_CCC-2-2024-EN-.pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "PCI and SWIFT appear only as examples of international standards in the glossary.", "cite": "No provision; full text reviewed (searched: payment, card, SWIFT, settlement, market infrastructure)", "url": "https://cdn.nca.gov.sa/api/files/public/upload/6d5408a3-d8e6-4e96-963b-2c7198e5b7c2_CCC-2-2024-EN-.pdf", "confidence": "verified" }, "cloud_saas": { "code": "required", "detail": "Provider penetration tests must cover the cloud technology stack. This is the first Saudi text found that puts cloud infrastructure inside a mandatory test.", "cite": "Subcontrol 2-10-P-1-1", "url": "https://cdn.nca.gov.sa/api/files/public/upload/6d5408a3-d8e6-4e96-963b-2c7198e5b7c2_CCC-2-2024-EN-.pdf", "quote": "Scope of penetration tests must cover Cloud Technology Stack and must be conducted at least once every six months.", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "Tenants abroad are in scope. Cybersecurity positions in provider data centers in the Kingdom must be held by Saudi nationals (1-4-P-1-1). CCC-2 deleted the data localization controls and refers entities to the National Data Management Office (Annex D).", "cite": "CCC Scope of Work; Subcontrol 1-4-P-1-1; Annex D", "url": "https://cdn.nca.gov.sa/api/files/public/upload/6d5408a3-d8e6-4e96-963b-2c7198e5b7c2_CCC-2-2024-EN-.pdf", "quote": "CSTs within the scope of CCC are any government agency in the Kingdom of Saudi Arabia inside or outside the Kingdom", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "The text is silent on this point.", "cite": "No provision; full text reviewed (searched: purple, replay, red team, lessons learned)", "url": "https://cdn.nca.gov.sa/api/files/public/upload/6d5408a3-d8e6-4e96-963b-2c7198e5b7c2_CCC-2-2024-EN-.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Providers must assess and remediate vulnerabilities monthly for external and quarterly for internal stack components. Tenants must do so at least quarterly (2-9-T-1-1).", "cite": "Subcontrols 2-9-P-1-1 and 2-9-T-1-1", "url": "https://cdn.nca.gov.sa/api/files/public/upload/6d5408a3-d8e6-4e96-963b-2c7198e5b7c2_CCC-2-2024-EN-.pdf", "quote": "Assessing and remediating vulnerabilities on external components of Cloud Technology Stack at least once every month, and at least once every three months for internal components of Cloud Technology Stack.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "NCA checks compliance through self-assessments, compliance tool reports and on-site audits.", "cite": "Implementation and Compliance", "url": "https://cdn.nca.gov.sa/api/files/public/upload/6d5408a3-d8e6-4e96-963b-2c7198e5b7c2_CCC-2-2024-EN-.pdf", "quote": "NCA evaluates entities’ compliance with the CCC through multiple means such as self-assessments by the entities, periodic reports of the compliance tool or on-site audits.", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "Automation appears only for monitoring remote access sessions (2-11-P-1-7), not testing.", "cite": "No provision; full text reviewed (searched: automat, artificial intelligence, AI, machine learning, continuous)", "url": "https://cdn.nca.gov.sa/api/files/public/upload/6d5408a3-d8e6-4e96-963b-2c7198e5b7c2_CCC-2-2024-EN-.pdf", "confidence": "verified" } } }, { "id": "sa-nca-tcc", "jurisdiction": "Saudi Arabia", "region": "GCC", "sector": "cross-sector", "name": "Telework Cybersecurity Controls (TCC-1:2021)", "short": "NCA TCC-1:2021", "issuer": "National Cybersecurity Authority (NCA)", "version": "2021", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://nca.gov.sa/telework_cybersecurity_controls-en.pdf", "arabic_title": "ضوابط الأمن السيبراني للعمل عن بعد", "regulator_arabic": "الهيئة الوطنية للأمن السيبراني", "arabic_source_url": "https://nca.gov.sa/ar/regulatory-documents/controls-list/tcc/", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Requires government bodies and CNI operators that allow telework to penetration test their telework systems every year. Not reviewed in September. TCC still cites ECC-1:2018 numbering; NCA has issued no TCC-2.", "cells": { "legal_force": { "code": "mandatory", "detail": "Entities in scope must comply continuously. The Arabic version is binding.", "cite": "Implementation and Compliance", "url": "https://nca.gov.sa/telework_cybersecurity_controls-en.pdf", "quote": "all organizations within the scope of these controls must implement whatever is necessary to ensure continuous compliance with the controls.", "confidence": "verified" }, "scope": { "code": "telework systems of government and CNI entities", "detail": "Government bodies, their companies and private CNI operators that allow telework.", "cite": "TCC Scope of Work; TCC Statement of Applicability", "url": "https://nca.gov.sa/telework_cybersecurity_controls-en.pdf", "quote": "Every organization that allows telework must comply with all applicable controls in this document.", "confidence": "verified" }, "frequency": { "code": "annual", "detail": "Telework systems must be penetration tested at least once a year, covering all their technical components (2-10-1-1).", "cite": "Control 2-10-2; Subcontrol 2-10-1-1", "url": "https://nca.gov.sa/telework_cybersecurity_controls-en.pdf", "quote": "penetration tests must be conducted on telework systems at least once every year.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Threat intelligence appears only in incident and threat management (2-12-1-2), not testing.", "cite": "No provision; full text reviewed (searched: threat intelligence, scenario, red team)", "url": "https://nca.gov.sa/telework_cybersecurity_controls-en.pdf", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "The text is silent on this point.", "cite": "No provision; full text reviewed (searched: qualified, independent, accredited, certified, provider)", "url": "https://nca.gov.sa/telework_cybersecurity_controls-en.pdf", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "The text is silent on this point.", "cite": "No provision; full text reviewed (searched: internal, in-house, external, independent, tester)", "url": "https://nca.gov.sa/telework_cybersecurity_controls-en.pdf", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "The text is silent on this point.", "cite": "No provision; full text reviewed (searched: social engineering, phishing, simulation, awareness)", "url": "https://nca.gov.sa/telework_cybersecurity_controls-en.pdf", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "The text is silent on this point.", "cite": "No provision; full text reviewed (searched: physical, intrusion, premises, test)", "url": "https://nca.gov.sa/telework_cybersecurity_controls-en.pdf", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "The text is silent on this point.", "cite": "No provision; full text reviewed (searched: third party, supplier, outsourcing, vendor, service provider)", "url": "https://nca.gov.sa/telework_cybersecurity_controls-en.pdf", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "ICS appears only in the ECC reference figure.", "cite": "No provision; full text reviewed (searched: operational technology, industrial, ICS, SCADA)", "url": "https://nca.gov.sa/telework_cybersecurity_controls-en.pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "The text is silent on this point.", "cite": "No provision; full text reviewed (searched: payment, card, SWIFT, settlement, market infrastructure)", "url": "https://nca.gov.sa/telework_cybersecurity_controls-en.pdf", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "Hosted telework systems must be in the Kingdom (3-1-1-1), with no rule on testing cloud services.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, hosting, test)", "url": "https://nca.gov.sa/telework_cybersecurity_controls-en.pdf", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "TCC scope covers organizations in the Kingdom only. Hosted telework systems must be in Saudi Arabia (3-1-1-1), and remote access from outside the Kingdom must be monitored (2-11-1-4). Neither rule limits who may test or from where, and neither reaches foreign entities.", "cite": "No provision on cross-border testing; full text reviewed (searched: outside the Kingdom, inside the Kingdom, abroad, foreign, location). Subcontrols 3-1-1-1 and 2-11-1-4 considered.", "url": "https://nca.gov.sa/telework_cybersecurity_controls-en.pdf", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "The text is silent on this point.", "cite": "No provision; full text reviewed (searched: purple, replay, red team, lessons learned)", "url": "https://nca.gov.sa/telework_cybersecurity_controls-en.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Vulnerabilities in telework systems must be assessed and remediated at least every three months.", "cite": "Subcontrols 2-9-1-1 and 2-9-1-2", "url": "https://nca.gov.sa/telework_cybersecurity_controls-en.pdf", "quote": "Remediating vulnerabilities for telework systems, at least once every three months.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "NCA checks compliance through self-assessments and external compliance assessments.", "cite": "Implementation and Compliance", "url": "https://nca.gov.sa/telework_cybersecurity_controls-en.pdf", "quote": "NCA evaluates organizations’ compliance with the TCC through multiple means such as self-assessments by the organizations, and/or External Compliance Assessment.", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "Artificial intelligence appears only in the introduction.", "cite": "No provision; full text reviewed (searched: automat, artificial intelligence, AI, machine learning, continuous)", "url": "https://nca.gov.sa/telework_cybersecurity_controls-en.pdf", "confidence": "verified" } } }, { "id": "sa-sama-ipo-rules", "jurisdiction": "Saudi Arabia", "region": "GCC", "sector": "financial", "name": "Initial Public Offering (IPO) Rules for Receiving and Lending Banks", "short": "SAMA IPO Rules", "issuer": "Saudi Central Bank (SAMA)", "version": "2022-02-09", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://rulebook.sama.gov.sa/en/initial-public-offering-ipo-rules-receiving-and-lending-banks", "arabic_title": "قواعد تنظيم عمل البنوك المستلمة والممولة في الطرح العام الأولي للأوراق المالية", "regulator_arabic": "البنك المركزي السعودي", "arabic_source_url": "https://rulebook.sama.gov.sa/ar/%D9%82%D9%88%D8%A7%D8%B9%D8%AF-%D8%AA%D9%86%D8%B8%D9%8A%D9%85-%D8%B9%D9%85%D9%84-%D8%A7%D9%84%D8%A8%D9%86%D9%88%D9%83-%D8%A7%D9%84%D9%85%D8%B3%D8%AA%D9%84%D9%85%D8%A9-%D9%88%D8%A7%D9%84%D9%85%D9%85%D9%88%D9%84%D8%A9-%D9%81%D9%8A-%D8%A7%D9%84%D8%B7%D8%B1%D8%AD-%D8%A7%D9%84%D8%B9%D8%A7%D9%85-%D8%A7%D9%84%D8%A3%D9%88%D9%84%D9%8A-%D9%84%D9%84%D8%A3%D9%88%D8%B1%D8%A7%D9%82-%D8%A7%D9%84%D9%85%D8%A7%D9%84%D9%8A%D8%A9", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Requires banks acting as receiving or lending banks in an IPO to run a testing program that includes vulnerability assessment, penetration testing and compromise assessment of IPO systems (Circular No. 43060832, Sec. 7, para 24). Found through a Rulebook search; not reviewed in September. Narrow scope: the integrator may prefer to record it in the SAMA CSF row rather than as a separate regime.", "cells": { "legal_force": { "code": "mandatory", "detail": "Issued by SAMA circular; in force from the issue date (para 35).", "cite": "Para. 24; para. 35", "url": "https://rulebook.sama.gov.sa/en/initial-public-offering-ipo-rules-receiving-and-lending-banks", "quote": "Banks shall conduct a comprehensive testing program to ensure cyber resiliency and controls effectiveness of the systems and applications used in the IPO process", "confidence": "verified" }, "scope": { "code": "banks acting as receiving or lending banks in IPOs", "detail": "Testing covers the systems and applications used in the IPO process, not the whole bank.", "cite": "Para. 3 (Scope); para. 24", "url": "https://rulebook.sama.gov.sa/en/initial-public-offering-ipo-rules-receiving-and-lending-banks", "quote": "These Rules apply to all banks that take part in an IPO of Securities, whether inside or outside Saudi Arabia, in the capacity of:", "confidence": "verified" }, "frequency": { "code": "not specified", "detail": "No cycle is set. Banks must ensure all relevant systems are effective before starting an IPO (para 6). The program must include vulnerability assessment, penetration testing and compromise assessment (para 24(a) to (b)).", "cite": "Para. 24; para. 6", "url": "https://rulebook.sama.gov.sa/en/initial-public-offering-ipo-rules-receiving-and-lending-banks", "quote": "Banks shall ensure the effectiveness of all relevant systems before commencing an IPO.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "The text is silent on this point.", "cite": "No provision; full text reviewed (searched: threat intelligence, scenario, red team)", "url": "https://rulebook.sama.gov.sa/en/initial-public-offering-ipo-rules-receiving-and-lending-banks", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "The text is silent on this point.", "cite": "No provision; full text reviewed (searched: qualified, independent, accredited, certified, provider)", "url": "https://rulebook.sama.gov.sa/en/initial-public-offering-ipo-rules-receiving-and-lending-banks", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "The text is silent on this point.", "cite": "No provision; full text reviewed (searched: internal, in-house, external, independent, tester)", "url": "https://rulebook.sama.gov.sa/en/initial-public-offering-ipo-rules-receiving-and-lending-banks", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "The text is silent on this point.", "cite": "No provision; full text reviewed (searched: social engineering, phishing, simulation, awareness)", "url": "https://rulebook.sama.gov.sa/en/initial-public-offering-ipo-rules-receiving-and-lending-banks", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "The text is silent on this point.", "cite": "No provision; full text reviewed (searched: physical, intrusion, premises, test)", "url": "https://rulebook.sama.gov.sa/en/initial-public-offering-ipo-rules-receiving-and-lending-banks", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "Para 26 requires measures against third-party dependency risk and readiness of third-party arrangements, with no test or audit right.", "cite": "No provision; full text reviewed (searched: third party, supplier, outsourcing, vendor, service provider)", "url": "https://rulebook.sama.gov.sa/en/initial-public-offering-ipo-rules-receiving-and-lending-banks", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "The text is silent on this point.", "cite": "No provision; full text reviewed (searched: operational technology, industrial, ICS, SCADA)", "url": "https://rulebook.sama.gov.sa/en/initial-public-offering-ipo-rules-receiving-and-lending-banks", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "Test scope is IPO process systems, which handle subscription money (definition of receiving bank), but no clause names payment, card or market infrastructure systems.", "cite": "No provision; full text reviewed (searched: payment, card, SWIFT, settlement, market infrastructure)", "url": "https://rulebook.sama.gov.sa/en/initial-public-offering-ipo-rules-receiving-and-lending-banks", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "The text is silent on this point.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, hosting, test)", "url": "https://rulebook.sama.gov.sa/en/initial-public-offering-ipo-rules-receiving-and-lending-banks", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "The rules apply to banks taking part in an IPO inside or outside Saudi Arabia. Coded on the same basis as the ECC scope.", "cite": "Para. 3", "url": "https://rulebook.sama.gov.sa/en/initial-public-offering-ipo-rules-receiving-and-lending-banks", "quote": "These Rules apply to all banks that take part in an IPO of Securities, whether inside or outside Saudi Arabia", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "The text is silent on this point.", "cite": "No provision; full text reviewed (searched: purple, replay, red team, lessons learned)", "url": "https://rulebook.sama.gov.sa/en/initial-public-offering-ipo-rules-receiving-and-lending-banks", "confidence": "verified" }, "remediation_retest": { "code": "not_addressed", "detail": "The text is silent on this point.", "cite": "No provision; full text reviewed (searched: remediate, retest, follow-up, finding)", "url": "https://rulebook.sama.gov.sa/en/initial-public-offering-ipo-rules-receiving-and-lending-banks", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "A bank acting as receiving bank for the first time, or in a large-scale or government offering, must notify SAMA in advance and prove its operational capacity. Test results are not sent to SAMA.", "cite": "Para. 12", "url": "https://rulebook.sama.gov.sa/en/initial-public-offering-ipo-rules-receiving-and-lending-banks", "quote": "the bank shall notify SAMA in advance and, in particular, prove its financial and operational capacity to process the share applications", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "The text is silent on this point.", "cite": "No provision; full text reviewed (searched: automat, artificial intelligence, AI, machine learning, continuous)", "url": "https://rulebook.sama.gov.sa/en/initial-public-offering-ipo-rules-receiving-and-lending-banks", "confidence": "verified" } } }, { "id": "bh-cbb-om55-banks", "jurisdiction": "Bahrain", "region": "GCC", "sector": "financial", "name": "CBB Rulebook Volume 1 (Conventional Banks), Module OM Operational Risk Management, Section OM-5.5 Cyber Security Risk Management", "short": "CBB OM-5.5 banks", "issuer": "Central Bank of Bahrain (CBB)", "version": "Module OM change log last entry 'Full Module 05/2026'. OM-5.5 text identical to the 2026-09-28 capture. Volume 1 was updated October 26, 2026 in Modules FC and CA only.", "status": "In force as of 2026-09-28. Checked the live Rulebook section, the module change log (last entry May 2026, alignment with the new FP Module, no change to testing paragraphs) and the Volume 2 ad-hoc communications list (latest cyber item: letter EDS/NA/C/03/2025 of July 16, 2025 to all licensees, which adds measures but does not change testing rules). The Volume 1 ad-hoc list was not opened separately.", "public": "full", "primary_url": "https://cbben.thomsonreuters.com/entiresection/116037", "regulator_arabic": "مصرف البحرين المركزي", "arabic_source_url": "https://www.cbb.gov.bh/ar/", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "Checked 2026-10-30. The live OM-5.5 section and the full Volume 1 and Volume 2 OM modules match the September captures word for word. The Rulebook's 30-day change list (70 entries, latest October 26, 2026) shows only Financial Crime and Capital Adequacy changes. The latest cyber item in the Volume 1 ad-hoc list is still the letter of July 17, 2025. All 12 stored quotes for this row still match the live text. Arabic title left null: the CBB Arabic site links to the English Rulebook, labels Volume 1 'المصارف - التقليدية', and gives no Arabic title for Module OM or Section OM-5.5." }, "notes": "Volume 2 (Islamic banks) has the same text with the same paragraph numbers (OM-5.5.28, 5.5.29, 5.5.30, 5.5.61) in its Module OM (entiresection/211494), also amended May 2026. Volumes 3 and 4 differ (annual test, no red team clause) and have their own row. Volume 5 Type 7 ancillary service providers (GR-12.2.3, GR-12.2.4): PSPs, AISPs and PISPs test twice a year, other licensees offering digital services once a year, in June and December; testers must be 'external, independent third parties' rotated every two years; reports to CBB by September 30 and March 31. CBB letter EDS/NA/C/03/2025 (July 16, 2025) to all licensees directs patching of public-facing systems, MFA, backups and reporting to the NCSC hotline, and makes the NCSC 'Protect Your Organization' recommendations (which include regular vulnerability assessments) applicable; it adds no penetration test or red team rule. The Rulebook host returned HTTP 403 to curl, so pages were captured with a headless browser. Volume 6 (capital markets) was only spot-checked: Module MIR has no penetration testing text; other Volume 6 and Volume 7 modules were not reviewed.", "cells": { "legal_force": { "code": "mandatory", "detail": "Module OM is a CBB Directive issued under Article 38 of the CBB Law 2006. The testing paragraphs use 'must'.", "cite": "OM-A.1.3; OM-5.5.28", "url": "https://cbben.thomsonreuters.com/entiresection/2300930", "quote": "This Module contains the CBB's Directive, as amended from time to time, relating to Operational Risk Management and is issued under the powers available to the CBB under Article 38 of the Central Bank of Bahrain and Financial Institutions Law 2006 ('CBB Law').", "confidence": "verified" }, "scope": { "code": "all conventional bank licensees", "detail": "Bahraini conventional bank licensees and branches of foreign bank licensees. OM-5.5.28 says 'All licensees'. Volume 2 applies the same text to Islamic bank licensees.", "cite": "OM-B.1.1; OM-B.1.3; OM-5.5.28", "url": "https://cbben.thomsonreuters.com/entiresection/2300930", "quote": "Bahraini conventional bank licensees must comply with all requirements included in this Module.", "confidence": "verified" }, "frequency": { "code": "every 6 months", "detail": "Penetration testing at least twice a year. Red teaming only when CBB requires it. The reporting example in OM-5.5.61 assumes June and December tests.", "cite": "OM-5.5.28; OM-5.5.29; OM-5.5.61", "url": "https://cbben.thomsonreuters.com/entiresection/116037", "quote": "All licensees must perform penetration testing of their systems, applications, and network devices to verify the robustness of the security controls in place at least twice a year.", "confidence": "verified" }, "threat_intel": { "code": "recommended", "detail": "Tests must simulate real world attacks, but no rule ties penetration test or red team scenarios to threat intelligence. Threat intelligence 'should' update cyber incident scenario tests, and banks 'should' subscribe to a threat intelligence service (OM-5.5.20).", "cite": "OM-5.5.37; OM-5.5.20; OM-5.5.28", "url": "https://cbben.thomsonreuters.com/entiresection/116037", "quote": "Licensees should regularly use threat intelligence to update the scenarios so that they remain current and relevant.", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Testers must be qualified, experienced and certified in penetration testing. Independent testers should be changed at least every two years. No certification body or scheme (such as CREST) is named.", "cite": "OM-5.5.28(c), (d)", "url": "https://cbben.thomsonreuters.com/entiresection/116037", "quote": "(c) Be conducted by qualified and experienced security professionals who are certified in providing penetration testing services; (d) Be performed by internal and external independent third parties which should be changed at least every two years", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "The text names 'internal and external independent third parties' and does not define 'internal'. Read literally, both internal and external testers take part, subject to independence and two-year rotation. The CBB rule for payment and other ancillary service providers (Vol. 5, GR-12.2.3(d)) instead says 'external, independent third parties'.", "cite": "OM-5.5.28(d)", "url": "https://cbben.thomsonreuters.com/entiresection/116037", "quote": "(d) Be performed by internal and external independent third parties which should be changed at least every two years", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "A red team required by CBB may attack people. OM-5.5.55 also gives testing employee reactions to simulated attacks as an example of training.", "cite": "OM-5.5.29; OM-5.5.55", "url": "https://cbben.thomsonreuters.com/entiresection/116037", "quote": "The red team may attack 3 fronts: cyber, social (attack on people's behavior) and physical (attack on an organization's physical facility and or 3rd party premises).", "confidence": "verified" }, "physical": { "code": "permitted", "detail": "A red team required by CBB may attack the bank's physical facility.", "cite": "OM-5.5.29", "url": "https://cbben.thomsonreuters.com/entiresection/116037", "quote": "The red team may attack 3 fronts: cyber, social (attack on people's behavior) and physical (attack on an organization's physical facility and or 3rd party premises).", "confidence": "verified" }, "third_party": { "code": "required", "detail": "Vulnerability assessments must cover connections with third parties, defined as API or other connections with fintechs, technology providers and outsourcing providers (OM-5.5.26). A red team may attack third-party premises (OM-5.5.29). The penetration test rule itself does not name third parties. No pooled tests.", "cite": "OM-5.5.25; OM-5.5.26; OM-5.5.29", "url": "https://cbben.thomsonreuters.com/entiresection/116037", "quote": "The vulnerability assessments must be comprehensive and cover internal technology, external technology, and connections with third parties.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "Appendix C lists a baseline configuration for 'information technology/industrial control systems' as a control. No testing provision covers OT.", "cite": "No provision; full text reviewed (searched: operational technology, OT, industrial control, ICS, SCADA)", "url": "https://cbben.thomsonreuters.com/entiresection/2300930", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "Retail banks must hold PCI-DSS certification (OM-5.1.1) and cards must be EMV compliant (OM-5.2.1). The testing paragraphs do not name payment systems, SWIFT or card infrastructure.", "cite": "No provision; full text reviewed (searched: payment, SWIFT, card, ATM, PCI, penetration, test)", "url": "https://cbben.thomsonreuters.com/entiresection/2300930", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "Threat assessments must consider cloud attack vectors (OM-5.5.22(b)) and cloud outsourcing needs CBB notification (OM-2.1.7(ii)). No testing provision covers cloud or SaaS.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, penetration, test)", "url": "https://cbben.thomsonreuters.com/entiresection/2300930", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "Branches of foreign banks may rely on head office or regional office functions with CBB approval and a gap analysis. Nothing addresses multi-jurisdiction tests or recognition of tests run abroad.", "cite": "OM-5.5.6; OM-B.1.3; OM-B.1.5; OM-B.1.6", "url": "https://cbben.thomsonreuters.com/entiresection/2300930", "quote": "Branches of foreign bank licensees must be governed under a framework of cyber security risk management policies which ensure that an adequate level of oversight is exercised by the regional office or head office.", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "OM-5.5.29 says the red team tests the blue team's response. OM-5.5.50 requires an exercise program (attack simulations, war games, table top). Neither mentions purple teaming or replay.", "cite": "No provision; full text reviewed (searched: purple, replay, workshop, blue team, lessons)", "url": "https://cbben.thomsonreuters.com/entiresection/116037", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Red team results go to CBB within one month with a plan to fix weaknesses. Penetration test reports must record mitigation steps. Vulnerabilities must be fixed on a risk-based timeline (OM-5.5.27). No fixed deadline and no retest rule.", "cite": "OM-5.5.30; OM-5.5.61; OM-5.5.27", "url": "https://cbben.thomsonreuters.com/entiresection/116037", "quote": "Where licensees have been required to conduct a red teaming exercise the results of such an exercise must be provided to CBB within one month of the completion of the exercise together with a comprehensive plan to address any observed weaknesses.", "confidence": "verified" }, "regulator_role": { "code": "receives_results", "detail": "CBB receives every penetration test report within two months of the test month, and red team results within one month. CBB can order red teaming. CBB does not lead tests or accredit testers.", "cite": "OM-5.5.61; OM-5.5.29; OM-5.5.30", "url": "https://cbben.thomsonreuters.com/entiresection/116037", "quote": "must be provided to CBB within two months following the end of the month where the testing took place, i.e. for a June test, the report must be submitted at the latest by 31st August and for a December test, by 28th February.", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "OM-5.5.44 lists incidents 'detected and responded via automation' as a metric. Nothing on automated or AI-driven testing, or on testing AI systems.", "cite": "No provision; full text reviewed (searched: automat, artificial intelligence, AI, machine learning, continuous)", "url": "https://cbben.thomsonreuters.com/entiresection/2300930", "confidence": "verified" } } }, { "id": "bh-cbb-rm9-insurance-investment", "jurisdiction": "Bahrain", "region": "GCC", "sector": "financial", "name": "CBB Rulebook Volume 3 (Insurance) and Volume 4 (Investment Business), Module RM Risk Management, Chapter RM-9 Cyber Security Risk Management", "short": "CBB RM-9 insur/invest", "issuer": "Central Bank of Bahrain (CBB)", "version": "Module RM change log last entry 'Full Module 05/2026' in both volumes. RM-9 text identical to the 2026-09-28 captures. Volumes 3 and 4 were updated October 26, 2026 in Module FC only.", "status": "In force as of 2026-09-28. Checked the live Rulebook module text and change logs for both volumes and the Volume 3 and 4 ad-hoc communications lists (latest cyber item: July 17, 2025 letter).", "public": "full", "primary_url": "https://cbben.thomsonreuters.com/entiresection/301270", "regulator_arabic": "مصرف البحرين المركزي", "arabic_source_url": "https://www.cbb.gov.bh/ar/", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "Checked 2026-10-30 against the live Volume 3 (entiresection/301270) and Volume 4 (entiresection/401215) RM modules. No textual change. All 11 stored quotes still match. The cross-reference slip noted in September (Vol. 3 RM-9.1.27 points to RM-9.1.25) is still there. Arabic title left null for the same reason as the OM-5.5 row. The CBB Arabic site labels the volumes 'التأمين' and 'شركات الاستثمار'." }, "notes": "Volumes 3 and 4 use the same paragraph numbers. Differences from Volume 1: annual rather than twice-yearly testing, a fixed June test and September 30 report, and no red team paragraph (RM-9.1.30 lets CBB require 'additional third-party security reviews' instead). Volume 4 RM-9.1.61 drops the phrase requiring the report to be provided to CBB that appears in Volume 3 RM-9.1.61, but RM-9.1.31 still requires submission in both. Volume 3 RM-9.1.27 refers to 'Paragraph RM-9.1.25' while the vulnerability assessment rule is RM-9.1.26; this looks like a cross-reference slip in the Rulebook. Quoted text uses straight quotes where the Rulebook uses curly quotes.", "cells": { "legal_force": { "code": "mandatory", "detail": "Rulebook requirement using 'must'. In Volume 3, failure to keep adequate systems and controls breaches a licensing condition (RM-B.1.8).", "cite": "Vol. 3 and Vol. 4 RM-9.1.29; Vol. 3 RM-B.1.8", "url": "https://cbben.thomsonreuters.com/entiresection/301270", "quote": "All licensees must perform penetration testing of their systems, applications, and network devices to verify the robustness of the security controls in place at least once a year.", "confidence": "verified" }, "scope": { "code": "insurers, brokers, Cat 1-2 investment firms", "detail": "Volume 3: Bahraini and overseas insurance firms and brokers, and insurance exchange operators; not insurance consultants, managers or appointed representatives (RM-B.1.6). Volume 4: Category 1 and Category 2 investment firms only; Category 3 firms are exempt from Module RM except RM-7 and RM-8 (RM-B.1.2).", "cite": "Vol. 3 RM-B.1.1, RM-B.1.5, RM-B.1.6; Vol. 4 RM-B.1.1, RM-B.1.2", "url": "https://cbben.thomsonreuters.com/entiresection/301270", "quote": "the contents of this Module apply to Bahraini insurance firms and Bahraini insurance brokers on a consolidated basis, and to overseas insurance firms and overseas insurance brokers with respect to their operations either booked in or undertaken from Bahrain.", "confidence": "verified" }, "frequency": { "code": "annual", "detail": "At least once a year, conducted in June, report to CBB before September 30. No red team clause.", "cite": "RM-9.1.29; RM-9.1.31", "url": "https://cbben.thomsonreuters.com/entiresection/301270", "quote": "The tests referred to in Paragraph RM-9.1.29 must be conducted each year in June and the report on such testing must be submitted to the CBB before 30th September.", "confidence": "verified" }, "threat_intel": { "code": "recommended", "detail": "Same wording as Volume 1: threat intelligence 'should' update incident scenario tests; subscription to a threat intelligence service 'should' be taken (RM-9.1.21). Not tied to penetration test design.", "cite": "RM-9.1.38; RM-9.1.21", "url": "https://cbben.thomsonreuters.com/entiresection/301270", "quote": "Licensees should regularly use threat intelligence to update the scenarios so that they remain current and relevant.", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Certified, qualified testers; independent testers rotated at least every two years. No named scheme.", "cite": "RM-9.1.29(c), (d)", "url": "https://cbben.thomsonreuters.com/entiresection/301270", "quote": "(c) Be conducted by qualified and experienced security professionals who are certified in providing penetration testing services; (d) Be performed by internal and external independent third parties who are rotated out at least every two years", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "Same 'internal and external independent third parties' wording as Volume 1, with two-year rotation. 'Internal' is not defined.", "cite": "RM-9.1.29(d)", "url": "https://cbben.thomsonreuters.com/entiresection/301270", "quote": "(d) Be performed by internal and external independent third parties who are rotated out at least every two years", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "Only as an example of staff training. No red team clause.", "cite": "RM-9.1.56", "url": "https://cbben.thomsonreuters.com/entiresection/301270", "quote": "The licensee must ensure that all employees receive adequate training on a regular basis, in relation to cyber security and the threats they could encounter, such as through testing employee reactions to simulated cyber-attack scenarios.", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Physical access appears only as an attack vector to consider in threat assessment (RM-9.1.23(b)). No physical testing provision.", "cite": "No provision; full text reviewed (searched: physical, red team, premises)", "url": "https://cbben.thomsonreuters.com/entiresection/301270", "confidence": "verified" }, "third_party": { "code": "required", "detail": "Vulnerability assessments must cover connections with third parties. CBB may also require additional third-party security reviews (RM-9.1.30).", "cite": "RM-9.1.26; RM-9.1.27; RM-9.1.30", "url": "https://cbben.thomsonreuters.com/entiresection/301270", "quote": "The vulnerability assessments must be comprehensive and cover internal technology, external technology, and connections with third parties.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "Appendix A mentions industrial control system configuration baselines only.", "cite": "No provision; full text reviewed (searched: operational technology, OT, industrial control, ICS)", "url": "https://cbben.thomsonreuters.com/entiresection/301270", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No testing provision names payment systems, SWIFT or card infrastructure.", "cite": "No provision; full text reviewed (searched: payment, SWIFT, card, PCI)", "url": "https://cbben.thomsonreuters.com/entiresection/301270", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "Cloud appears as a threat vector (RM-9.1.23(b)) and in outsourcing rules. No testing provision.", "cite": "No provision; full text reviewed (searched: cloud, SaaS)", "url": "https://cbben.thomsonreuters.com/entiresection/301270", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "Volume 3 applies on a consolidated basis, including branches and subsidiaries outside Bahrain (RM-B.1.4). Volume 4 requires the same or equivalent provisions at branches outside Bahrain (RM-B.2.1). Nothing on recognition of foreign tests.", "cite": "Vol. 3 RM-B.1.1, RM-B.1.4; Vol. 4 RM-B.2.1", "url": "https://cbben.thomsonreuters.com/entiresection/401215", "quote": "Bahraini investment firm licensees must ensure that, as a minimum, the same or equivalent provisions of this Module apply to their branches, whether located inside or outside the Kingdom of Bahrain", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "RM-9.1.51 requires an exercise program (attack simulations, war games, table top). No purple teaming or replay.", "cite": "No provision; full text reviewed (searched: purple, replay, workshop, blue team)", "url": "https://cbben.thomsonreuters.com/entiresection/301270", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Reports must list passed and failed tests and mitigation steps. Vulnerability remediation processes required (RM-9.1.28). No deadline, no retest rule.", "cite": "RM-9.1.31; RM-9.1.28; RM-9.1.61", "url": "https://cbben.thomsonreuters.com/entiresection/301270", "quote": "The penetration testing reports must include the vulnerabilities identified and a full list of 'passed' tests and 'failed' tests together with the steps taken to mitigate the risks identified.", "confidence": "verified" }, "regulator_role": { "code": "receives_results", "detail": "Reports go to CBB before September 30 each year. CBB may require additional third-party security reviews.", "cite": "RM-9.1.31; RM-9.1.30", "url": "https://cbben.thomsonreuters.com/entiresection/301270", "quote": "CBB may require additional third-party security reviews to be performed as needed.", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "Only an incident metric on automation (RM-9.1.45 list). Nothing on automated or AI-driven testing.", "cite": "No provision; full text reviewed (searched: automat, artificial intelligence, AI, machine learning)", "url": "https://cbben.thomsonreuters.com/entiresection/301270", "confidence": "verified" } } }, { "id": "bh-ncsc-baseline-controls", "jurisdiction": "Bahrain", "region": "GCC", "sector": "cross-sector", "name": "Baseline Cybersecurity Controls (NCSC-CP-D22-0001)", "short": "NCSC BH Baseline", "issuer": "National Cyber Security Center (NCSC), Kingdom of Bahrain", "version": "Cover 'Draft v 0.2, Jan 2022'. Same file as on 2026-09-28 (SHA-256 befec5e5f6dd087470e464f5d7a4731ca980e46dd6819ed6a86e90786705a52e).", "status": "Published on the NCSC website on 2026-09-28 and described there as the baseline for entities in Bahrain. Its introduction says it is mandatory for CNI entities. NCSC Decision No. (36) of 2026 (August 19, 2026) separately adopted non-public Cyber Security Standards for Critical Sectors; that decision does not name the Baseline as repealed, so the relationship between the two is unclear.", "public": "full", "primary_url": "https://www.ncsc.gov.bh/assets/images/baseline_cybersecurity_controls_v1_80828fdb7d.pdf", "arabic_title": "الضوابط الأساسية للأمن السيبراني", "regulator_arabic": "المركز الوطني للأمن السيبراني", "arabic_source_url": "https://www.ncsc.gov.bh/ar/standards-controls/baseline-cyber-security-controls.html", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "The NCSC site was rebuilt since September (page footer 'Last Updated on October 26, 2026') but the Baseline page links to the same PDF, and the file hash is unchanged. All 8 stored quotes still match. The Arabic standards page links to the same English PDF; no Arabic edition of the controls was found. Decision 36/2026 still does not say whether the Baseline continues alongside the new critical-sector standards." }, "notes": "This is the only public NCSC Bahrain control set. The NCSC CNI page describes sector documents (Government Cybersecurity Controls with nine domains, Financial Cybersecurity Controls with a 'cybersecurity assessment' domain, and others) but offers no download. NCSC Decision No. (36) of 2026 adopts Cyber Security Standards for Critical Sectors as a non-public annex (separate row). Royal Order No. (17) of 2025 on the NCSC is cited in the preamble of Decision 36/2026; its text was not opened. Royal Order No. (30) of 2024 moved the NCSC under the Supreme Defence Council (Decision 36/2026 preamble).", "cells": { "legal_force": { "code": "mandatory", "detail": "Mandatory for public and private CNI entities; other entities are encouraged to follow it. The document still carries a 'Draft v 0.2' label.", "cite": "Introduction, p. 4", "url": "https://www.ncsc.gov.bh/assets/images/baseline_cybersecurity_controls_v1_80828fdb7d.pdf", "quote": "Following the document's controls is mandatory for the private and public entities being part of the Kingdom's CNI.", "confidence": "verified" }, "scope": { "code": "CNI entities incl. government", "detail": "Public and private entities in the CNI sectors. NCSC lists them as Gas, Electricity and Oil; Financial Services; ICT; Healthcare; Government Services; Critical Industry; Transportation.", "cite": "Introduction, p. 4; NCSC CNI Cybersecurity Controls web page", "url": "https://www.ncsc.gov.bh/en/standards-controls/CNI-cybersecurity-controls.html", "quote": "This document's controls target all private and public entities of all the critical sectors in the Kingdom's Critical National Infrastructure (CNI).", "confidence": "verified" }, "frequency": { "code": "annual", "detail": "Penetration testing annually; vulnerability assessment at least every three months (Control 3.3.1) and before new systems go live (Control 3.3.2).", "cite": "Control 3.3.4; Control 3.3.1", "url": "https://www.ncsc.gov.bh/assets/images/baseline_cybersecurity_controls_v1_80828fdb7d.pdf", "quote": "After vulnerability assessment, penetration testing must be performed annually and conducted either manually or automatically using software applications.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "No provision on threat intelligence.", "cite": "No provision; full text reviewed (searched: threat intelligence, threat-led, scenario, intelligence)", "url": "https://www.ncsc.gov.bh/assets/images/baseline_cybersecurity_controls_v1_80828fdb7d.pdf", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "No tester qualification, certification or independence rule. Senior management must approve the test scope.", "cite": "No provision; full text reviewed (searched: certif, qualif, independent, accredit, provider)", "url": "https://www.ncsc.gov.bh/assets/images/baseline_cybersecurity_controls_v1_80828fdb7d.pdf", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Control 3.3.4 says the entity should plan 'whether external or internal' testing, which describes the test perspective, not who tests.", "cite": "No provision; full text reviewed (searched: internal, external, third-party, tester, assessor)", "url": "https://www.ncsc.gov.bh/assets/images/baseline_cybersecurity_controls_v1_80828fdb7d.pdf", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "Simulated phishing is given as an example way to assess the awareness program.", "cite": "Control 2.2.2", "url": "https://www.ncsc.gov.bh/assets/images/baseline_cybersecurity_controls_v1_80828fdb7d.pdf", "quote": "For example, the entity may conduct social engineering tests for employees through simulated and organized phishing attacks.", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Subdomain 3.5 sets physical controls for IT/OT assets but no testing. The penetration test scope 'involves the systems, locations, techniques, and tools', which does not state physical intrusion testing.", "cite": "No provision; full text reviewed (searched: physical, premises, intrusion, test)", "url": "https://www.ncsc.gov.bh/assets/images/baseline_cybersecurity_controls_v1_80828fdb7d.pdf", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "Third-party services must be monitored, audited and reviewed (Control 5.1.3). No testing of third parties.", "cite": "No provision; full text reviewed (searched: third-party, supplier, vendor, test)", "url": "https://www.ncsc.gov.bh/assets/images/baseline_cybersecurity_controls_v1_80828fdb7d.pdf", "confidence": "verified" }, "ot": { "code": "required", "detail": "Domain 6 (OT and IoT) requires a network scan for running services, open ports and protocols. This is a scan, not a penetration test.", "cite": "Control 6.6", "url": "https://www.ncsc.gov.bh/assets/images/baseline_cybersecurity_controls_v1_80828fdb7d.pdf", "quote": "The entity must perform a network scan to identify running services, open ports, and supported protocols.", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No provision on payment systems.", "cite": "No provision; full text reviewed (searched: payment, SWIFT, card)", "url": "https://www.ncsc.gov.bh/assets/images/baseline_cybersecurity_controls_v1_80828fdb7d.pdf", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "Subdomain 5.2 covers cloud risk, access, encryption and logging. No testing.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, test, assessment)", "url": "https://www.ncsc.gov.bh/assets/images/baseline_cybersecurity_controls_v1_80828fdb7d.pdf", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "No provision on cross-border matters.", "cite": "No provision; full text reviewed (searched: cross-border, foreign, abroad, outside, residency)", "url": "https://www.ncsc.gov.bh/assets/images/baseline_cybersecurity_controls_v1_80828fdb7d.pdf", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: purple, red team, replay, exercise)", "url": "https://www.ncsc.gov.bh/assets/images/baseline_cybersecurity_controls_v1_80828fdb7d.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Weaknesses must be prioritized under a remediation plan. No deadline or retest rule.", "cite": "Control 3.3.5; Control 3.3.3", "url": "https://www.ncsc.gov.bh/assets/images/baseline_cybersecurity_controls_v1_80828fdb7d.pdf", "quote": "The identified weaknesses must be prioritized, and a remediation plan must be developed to treat the weaknesses.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "External audit is coordinated with NCSC and the sector regulator. Test results are not sent to NCSC.", "cite": "Control 7.4", "url": "https://www.ncsc.gov.bh/assets/images/baseline_cybersecurity_controls_v1_80828fdb7d.pdf", "quote": "The external audit should be performed with the coordination between the NCSC and the sector regulator.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Penetration tests may be run manually or automatically; vulnerability scanning tools may be used (Control 3.3.1). Nothing on AI.", "cite": "Control 3.3.4; Control 3.3.1", "url": "https://www.ncsc.gov.bh/assets/images/baseline_cybersecurity_controls_v1_80828fdb7d.pdf", "quote": "conducted either manually or automatically using software applications", "confidence": "verified" } } }, { "id": "bh-ncsc-cni-standards-2026", "jurisdiction": "Bahrain", "region": "GCC", "sector": "cross-sector", "name": "Cyber Security Standards for Critical Sectors (Annex 1 to NCSC Decision No. (36) of 2026)", "short": "NCSC BH CNI Std 2026", "issuer": "National Cyber Security Center (NCSC), Kingdom of Bahrain", "version": "Decision No. (36) of 2026, issued August 19, 2026. Same file as on 2026-09-28 (SHA-256 4b16a3c026286978b80c2d406a683c05eec17249e2683bfbce58b7db4f76dbda). Annex 1 is still not public.", "status": "In force from issue (Art. 10). Entities must apply the standards once notified by NCSC (Art. 4). Checked the NCSC Executive Decisions page on 2026-09-28; this is the only decision listed.", "public": "not_public", "primary_url": "https://www.ncsc.gov.bh/static_assets/documents/decision-36-2026.pdf", "arabic_title": "قرار رقم (36) لسنة 2026 بشأن إصدار معايير الأمن السيبراني للقطاعات الحيوية والبرنامج الوطني لقياس النضج السيبراني والبرنامج الوطني لتقييم أخطار الأمن السيبراني في مملكة البحرين", "regulator_arabic": "المركز الوطني للأمن السيبراني", "arabic_source_url": "https://www.ncsc.gov.bh/ar/legal-regulatory-framework/executive-decisions.html", "arabic_note": "The Arabic title is that of Decision No. (36) of 2026 as a whole, not a separate title for Annex 1.", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "Decision 36/2026 is still the only item on the NCSC Executive Decisions page (English and Arabic). The Arabic title is the decision title as the NCSC Arabic page lists it; the standards themselves are named inside it as 'معايير الأمن السيبراني للقطاعات الحيوية'. The decision PDF prints 'مخاطر' (risks) where the web page prints 'أخطار' (dangers) in the third program's name. Royal Order No. (17) of 2025, cited in the decision preamble and unread in September, was opened this time (Official Gazette issue 3820, July 10, 2025). It gives NCSC the power to set binding policies and standards and to issue rules for accrediting cyber security experts. It sets no testing duty itself and changes no cell." }, "notes": "Art. 3 states the standards are 'not publishable' and circulate only to subject entities via NCSC secure channels; Art. 10 says the same for Annexes 1 to 3 (standards, maturity program, risk assessment program). The maturity program has four levels (Art. 5). Financial Services is a CNI sector, so CBB licensees that NCSC treats as critical-sector entities fall under both CBB rules and these standards; how the two interact is not public. Arabic quotes are given in corrected Unicode because the PDF text layer uses presentation forms; wording checked against the PDF.", "cells": { "legal_force": { "code": "mandatory", "detail": "Subject entities must apply the standards immediately on notification by NCSC, on a schedule NCSC may agree per entity or sector. Translation by Bendings.", "cite": "Decision 36/2026, Art. 4", "url": "https://www.ncsc.gov.bh/static_assets/documents/decision-36-2026.pdf", "quote": "تلتزم الجهات الخاضعة بتطبيق المعايير فور إخطارها بها من المركز", "confidence": "verified" }, "scope": { "code": "critical-sector entities", "detail": "All government or private entities in the critical sectors named in the National Cyber Security Strategy; NCSC may add others. Translation by Bendings.", "cite": "Decision 36/2026, Art. 1 (definition of 'entity'); Art. 2", "url": "https://www.ncsc.gov.bh/static_assets/documents/decision-36-2026.pdf", "quote": "تسري أحكام هذا القرار على جميع الجهات العاملة ضمن القطاعات الحيوية المحددة بموجب الاستراتيجية الوطنية للأمن السيبراني", "confidence": "verified" }, "frequency": { "code": "unknown_not_public", "detail": "The public decision requires an annual cyber risk assessment (Art. 8), not a test. Any testing frequency would sit in the restricted Annex 1.", "cite": "Decision 36/2026, Art. 3; Art. 8; Art. 10", "url": "https://www.ncsc.gov.bh/static_assets/documents/decision-36-2026.pdf", "quote": "وتعد هذه المعايير وثيقة غير قابلة للنشر، ويقتصر تداولها على الجهات الخاضعة والجهات المعنية بتنفيذ هذا القرار", "confidence": "verified" }, "threat_intel": { "code": "unknown_not_public", "detail": "Annex 1 is restricted to subject entities.", "cite": "Decision 36/2026, Art. 3; Art. 10", "url": "https://www.ncsc.gov.bh/static_assets/documents/decision-36-2026.pdf", "quote": "وتعد هذه المعايير وثيقة غير قابلة للنشر", "confidence": "verified" }, "provider_requirements": { "code": "unknown_not_public", "detail": "Annex 1 is restricted to subject entities.", "cite": "Decision 36/2026, Art. 3; Art. 10", "url": "https://www.ncsc.gov.bh/static_assets/documents/decision-36-2026.pdf", "quote": "وتعد هذه المعايير وثيقة غير قابلة للنشر", "confidence": "verified" }, "internal_testers": { "code": "unknown_not_public", "detail": "Annex 1 is restricted to subject entities.", "cite": "Decision 36/2026, Art. 3; Art. 10", "url": "https://www.ncsc.gov.bh/static_assets/documents/decision-36-2026.pdf", "quote": "وتعد هذه المعايير وثيقة غير قابلة للنشر", "confidence": "verified" }, "social_engineering": { "code": "unknown_not_public", "detail": "Annex 1 is restricted to subject entities.", "cite": "Decision 36/2026, Art. 3; Art. 10", "url": "https://www.ncsc.gov.bh/static_assets/documents/decision-36-2026.pdf", "quote": "وتعد هذه المعايير وثيقة غير قابلة للنشر", "confidence": "verified" }, "physical": { "code": "unknown_not_public", "detail": "Annex 1 is restricted to subject entities.", "cite": "Decision 36/2026, Art. 3; Art. 10", "url": "https://www.ncsc.gov.bh/static_assets/documents/decision-36-2026.pdf", "quote": "وتعد هذه المعايير وثيقة غير قابلة للنشر", "confidence": "verified" }, "third_party": { "code": "unknown_not_public", "detail": "Annex 1 is restricted to subject entities.", "cite": "Decision 36/2026, Art. 3; Art. 10", "url": "https://www.ncsc.gov.bh/static_assets/documents/decision-36-2026.pdf", "quote": "وتعد هذه المعايير وثيقة غير قابلة للنشر", "confidence": "verified" }, "ot": { "code": "unknown_not_public", "detail": "Annex 1 is restricted to subject entities.", "cite": "Decision 36/2026, Art. 3; Art. 10", "url": "https://www.ncsc.gov.bh/static_assets/documents/decision-36-2026.pdf", "quote": "وتعد هذه المعايير وثيقة غير قابلة للنشر", "confidence": "verified" }, "payment_systems": { "code": "unknown_not_public", "detail": "Annex 1 is restricted to subject entities.", "cite": "Decision 36/2026, Art. 3; Art. 10", "url": "https://www.ncsc.gov.bh/static_assets/documents/decision-36-2026.pdf", "quote": "وتعد هذه المعايير وثيقة غير قابلة للنشر", "confidence": "verified" }, "cloud_saas": { "code": "unknown_not_public", "detail": "Annex 1 is restricted to subject entities.", "cite": "Decision 36/2026, Art. 3; Art. 10", "url": "https://www.ncsc.gov.bh/static_assets/documents/decision-36-2026.pdf", "quote": "وتعد هذه المعايير وثيقة غير قابلة للنشر", "confidence": "verified" }, "cross_border": { "code": "unknown_not_public", "detail": "Annex 1 is restricted to subject entities.", "cite": "Decision 36/2026, Art. 3; Art. 10", "url": "https://www.ncsc.gov.bh/static_assets/documents/decision-36-2026.pdf", "quote": "وتعد هذه المعايير وثيقة غير قابلة للنشر", "confidence": "verified" }, "purple_replay": { "code": "unknown_not_public", "detail": "Annex 1 is restricted to subject entities.", "cite": "Decision 36/2026, Art. 3; Art. 10", "url": "https://www.ncsc.gov.bh/static_assets/documents/decision-36-2026.pdf", "quote": "وتعد هذه المعايير وثيقة غير قابلة للنشر", "confidence": "verified" }, "remediation_retest": { "code": "unknown_not_public", "detail": "The public decision requires internal plans to treat risks found in the annual risk assessment (Art. 8). Test remediation rules, if any, sit in Annex 1.", "cite": "Decision 36/2026, Art. 3; Art. 8; Art. 10", "url": "https://www.ncsc.gov.bh/static_assets/documents/decision-36-2026.pdf", "quote": "وتعد هذه المعايير وثيقة غير قابلة للنشر", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "Entities must submit to NCSC assessment and audit under the maturity program and share annual risk assessment results with NCSC, in coordination with the sector regulator. Translation by Bendings.", "cite": "Decision 36/2026, Art. 6; Art. 8", "url": "https://www.ncsc.gov.bh/static_assets/documents/decision-36-2026.pdf", "quote": "وتوفير المعلومات اللازمة للتقييم والتدقيق والمتابعة، والخضوع للتقييم والتدقيق", "confidence": "verified" }, "automated_ai": { "code": "unknown_not_public", "detail": "Annex 1 is restricted to subject entities.", "cite": "Decision 36/2026, Art. 3; Art. 10", "url": "https://www.ncsc.gov.bh/static_assets/documents/decision-36-2026.pdf", "quote": "وتعد هذه المعايير وثيقة غير قابلة للنشر", "confidence": "verified" } } }, { "id": "bh-cbb-gr12-ancillary-payments", "jurisdiction": "Bahrain", "region": "GCC", "sector": "financial", "name": "CBB Rulebook Volume 5 (Specialised Licensees), Type 7 Ancillary Service Providers: Module GR Section GR-12.2 Cyber Security Risk Management, with Module OB (Open Banking) Section OB-1.1", "short": "CBB GR-12.2 payments and open banking", "issuer": "Central Bank of Bahrain (CBB)", "version": "2022-01", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://cbben.thomsonreuters.com/entiresection/506116", "regulator_arabic": "مصرف البحرين المركزي", "arabic_source_url": "https://www.cbb.gov.bh/ar/", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Sets the penetration testing duty for Bahrain's payment firms: PSPs, AISPs and PISPs must test twice a year with external, rotated testers and report to CBB (GR-12.2.3, GR-12.2.4). GR-12.2 was added July 2021 and enhanced January 2022; Module OB was first issued in November 2018 (OB-A.2.1), with its paragraphs marked 'Added: December 2018' (https://cbben.thomsonreuters.com/entiresection/506901). The September matrix recorded GR-12.2 only in the notes of the OM-5.5 row and did not code it. CBB's draft Payment Service Requirements Module (February 2026) keeps PSPs under GR-12 (PS-1.3.3).", "cells": { "legal_force": { "code": "mandatory", "detail": "Module GR is a CBB Directive under Article 38 of the CBB Law. The testing paragraphs use \"must\". Module OB is a Directive on the same basis (OB-A.1.3).", "cite": "GR-A.1.2; GR-12.2.3; OB-A.1.3", "url": "https://cbben.thomsonreuters.com/entiresection/506116", "quote": "This Module contains the Central Bank of Bahrain ('CBB') Directive (as amended from time to time) regarding general requirements applicable to ancillary service provider licensees, and is issued under the powers available to the CBB under Article 38", "confidence": "verified" }, "scope": { "code": "PSPs, AISPs, PISPs and other digital ancillary service providers", "detail": "GR-12.2 applies to ancillary service provider licensees that offer services through digital channels. Payment service providers, account information service providers and payment initiation service providers carry the strictest cycle. Module OB adds API tests for AISPs and PISPs.", "cite": "GR-12.2.1; GR-12.2.3; OB-A.1.1", "url": "https://cbben.thomsonreuters.com/entiresection/506116", "quote": "This Section applies to ancillary service provider licensees that provide services through digital channels.", "confidence": "verified" }, "frequency": { "code": "every 6 months", "detail": "PSPs, AISPs and PISPs test at least twice a year, in June and December. Other digital licensees test once a year, in June. AISPs and PISPs also get a third-party API vulnerability assessment and penetration test every 6 months (OB-1.1.10) and an external review of systems and controls at least every 3 years (OB-1.1.11).", "cite": "GR-12.2.3; GR-12.2.4; OB-1.1.10; OB-1.1.11", "url": "https://cbben.thomsonreuters.com/entiresection/506116", "quote": "PSPs, AISPs, and PISPs must perform penetration testing of their systems, applications, and network devices to verify the robustness of the security controls in place at least twice a year", "confidence": "verified" }, "threat_intel": { "code": "recommended", "detail": "Tests must simulate real world attacks, but no rule ties test scenarios to threat intelligence. Threat intelligence \"should\" update incident scenario tests, and licensees \"should\" subscribe to a threat intelligence service (GR-12.2.25).", "cite": "GR-12.2.39; GR-12.2.25; GR-12.2.3", "url": "https://cbben.thomsonreuters.com/entiresection/506116", "quote": "Licensees should regularly use threat intelligence to update the scenarios so that they remain current and relevant.", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Certified, qualified and experienced testers. External, independent testers changed at least every two years. No scheme named. OB-1.1.10 requires a third-party specialist for API tests.", "cite": "GR-12.2.3(c), (d); OB-1.1.10", "url": "https://cbben.thomsonreuters.com/entiresection/506116", "quote": "(c) Be conducted by qualified and experienced security professionals who are certified in providing penetration testing services; (d) Be performed by external, independent third parties which must be changed at least every two years", "confidence": "verified" }, "internal_testers": { "code": "not_allowed", "detail": "The test must be run by external, independent third parties. Unlike the bank and insurance rules (OM-5.5.28(d), RM-9.1.29(d)), the text does not name internal testers.", "cite": "GR-12.2.3(d); OB-1.1.11", "url": "https://cbben.thomsonreuters.com/entiresection/506116", "quote": "(d) Be performed by external, independent third parties which must be changed at least every two years", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "GR-12.2.57 gives testing employee reactions to simulated cyber-attack scenarios as a way to train staff, the same text that makes the CBB bank, insurance, investment, crypto-asset, stablecoin and money changer rows permitted. For AISPs and PISPs, the six-monthly API tests must also consider the risk of social engineering (OB-1.1.10), a controls test that names no method. Not required: OB-1.1.10 asks the tests to consider the risk, while CBUAE Art. 13(17) requires the test scope to cover social engineering.", "cite": "GR-12.2.57; OB-1.1.10 (Module OB, https://cbben.thomsonreuters.com/entiresection/506901)", "url": "https://cbben.thomsonreuters.com/entiresection/506116", "quote": "The licensee must ensure that all employees receive adequate training on a regular basis, in relation to cyber security and the threats they could encounter, such as through testing employee reactions to simulated cyber-attack scenarios.", "confidence": "verified", "harmonized_from": "controls_test", "harmonize_reason": "R2: GR-12.2.57 names testing employee reactions to simulated cyber-attack scenarios as a training option, the text that makes the other CBB rows permitted; the OB-1.1.10 controls test stays in the detail." }, "physical": { "code": "not_addressed", "detail": "Physical access appears only as an attack vector to consider in threat assessments (GR-12.2.27(b)). No physical testing provision.", "cite": "No provision; GR-12.2 and Module OB reviewed (searched: physical, premises, red team)", "url": "https://cbben.thomsonreuters.com/entiresection/506116", "confidence": "verified" }, "third_party": { "code": "required", "detail": "Vulnerability assessments must cover connections with third parties, defined as API or other connections with fintechs, technology providers and outsourcing providers (GR-12.2.31). CBB may require additional third-party security reviews (GR-12.2.32). The penetration test rule itself does not name third parties. No pooled tests.", "cite": "GR-12.2.30; GR-12.2.31; GR-12.2.32", "url": "https://cbben.thomsonreuters.com/entiresection/506116", "quote": "The vulnerability assessments must be comprehensive and cover internal technology, external technology, and connections with third parties.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "Appendix A lists a baseline configuration for information technology and industrial control systems as a control. No testing provision covers OT.", "cite": "No provision; GR-12.2 and Module OB reviewed (searched: operational technology, OT, industrial control, ICS, SCADA)", "url": "https://cbben.thomsonreuters.com/entiresection/506116", "confidence": "verified" }, "payment_systems": { "code": "required", "detail": "The twice-yearly test duty is placed on payment service providers and payment initiation providers by name, so the tested systems are payment systems. Module OB adds tests of the open banking APIs used to initiate payments. SWIFT and card schemes are not named.", "cite": "GR-12.2.3; OB-1.1.10 (Module OB, https://cbben.thomsonreuters.com/entiresection/506901)", "url": "https://cbben.thomsonreuters.com/entiresection/506116", "quote": "AISPs and PISPs must appoint a third party specialist to conduct vulnerability assessments against cyber-attacks and penetration testing on the specific API security standards every 6 months.", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "Cloud appears only as an attack vector to consider in threat assessments (GR-12.2.27(b)). No testing provision covers cloud or SaaS.", "cite": "No provision; GR-12.2 and Module OB reviewed (searched: cloud, SaaS)", "url": "https://cbben.thomsonreuters.com/entiresection/506116", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "Overseas licensees must be overseen by their regional or head office under a cyber security risk framework. Nothing on multi-jurisdiction tests, recognition of foreign tests or tester location.", "cite": "GR-12.2.10", "url": "https://cbben.thomsonreuters.com/entiresection/506116", "quote": "Overseas licensees must be governed under a framework of cyber security risk management policies which ensure that an adequate level of oversight is exercised by the regional office or head office.", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "GR-12.2.52 requires an exercise program (attack simulations, war games, table top). No purple teaming or replay.", "cite": "No provision; GR-12.2 and Module OB reviewed (searched: purple, replay, workshop, blue team, red team)", "url": "https://cbben.thomsonreuters.com/entiresection/506116", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Penetration test reports must record the steps taken to mitigate each risk (GR-12.2.4). AISPs and PISPs must send CBB an action plan with each API test report. Vulnerabilities must be fixed on a risk-based timeline (GR-12.2.2). No fixed deadline and no retest rule.", "cite": "OB-1.1.10; GR-12.2.4; GR-12.2.2", "url": "https://cbben.thomsonreuters.com/entiresection/506116", "quote": "The specialist's report must be submitted to the CBB, along with the licensee's related action plan to resolve any issues identified.", "confidence": "verified" }, "regulator_role": { "code": "receives_results", "detail": "Reports go to CBB before September 30 for June tests and before March 31 for December tests. CBB may require additional third-party security reviews (GR-12.2.32). CBB does not lead tests or accredit testers.", "cite": "GR-12.2.4; GR-12.2.32; OB-1.1.10", "url": "https://cbben.thomsonreuters.com/entiresection/506116", "quote": "Reports on penetration testing must be submitted to CBB before 30th September for the tests as at 30th June and 31st March for the tests as at 31st December.", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "GR-12.2.46 lists incidents 'detected and responded via automation' as a metric. Nothing on automated or AI-driven testing, or on testing AI systems.", "cite": "No provision; GR-12.2 and Module OB reviewed (searched: automat, artificial intelligence, AI, machine learning, continuous)", "url": "https://cbben.thomsonreuters.com/entiresection/506116", "confidence": "verified" } } }, { "id": "bh-cbb-cra58-crypto", "jurisdiction": "Bahrain", "region": "GCC", "sector": "financial", "name": "CBB Rulebook Volume 6 (Capital Markets), Module CRA Crypto-Asset, Chapter CRA-5 Technology Governance and Cyber Security (Section CRA-5.8 Cyber Security)", "short": "CBB CRA-5.8 crypto-asset", "issuer": "Central Bank of Bahrain (CBB)", "version": "2023-04", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://cbben.thomsonreuters.com/entiresection/605259", "regulator_arabic": "مصرف البحرين المركزي", "arabic_source_url": "https://www.cbb.gov.bh/ar/", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Sets a twice-yearly vulnerability assessment and penetration test, external and internal, for CBB crypto-asset licensees, including crypto-asset exchanges that run trading platforms and custodians (CRA-5.8.13G). The testing rules were added in the April 2023 rewrite of the module. The May 2026 amendments (Fit and Proper alignment, and CRA-5.4.10 on key management) did not change CRA-5.8. The September coding reviewed only Module MIR in Volume 6 and did not see this module.", "cells": { "legal_force": { "code": "mandatory", "detail": "Module CRA is a CBB Directive under Article 38 of the CBB Law. The testing paragraph uses \"must\". CBB may grant written exemptions from specific technology governance and cyber security requirements where a licensee shows its business does not need them (CRA-5.1.3).", "cite": "CRA-A.1.3; CRA-5.8.13G; CRA-5.1.3", "url": "https://cbben.thomsonreuters.com/entiresection/605259", "quote": "This Module contains the CBB's Directive (as amended from time-to-time) relating to licensees providing regulated crypto-asset services (henceforth referred to as licensees) as defined in the Rulebook and is issued under the powers available to the CBB under Article 38 of the CBB Law.", "confidence": "verified" }, "scope": { "code": "crypto-asset licensees, Categories 1 to 4", "detail": "Licensees trading, dealing, advising, managing portfolios or holding custody in crypto-assets, and crypto-asset exchanges. Digital token issuers under Chapter CRA-15 are outside Chapters CRA-1 to CRA-14.", "cite": "CRA-A.1.1; CRA-B.1.5", "url": "https://cbben.thomsonreuters.com/entiresection/605259", "quote": "Chapters CRA-1 to CRA-14 apply to Category 1, 2, 3 and 4 licensees offering regulated crypto-asset services.", "confidence": "verified" }, "frequency": { "code": "every 6 months", "detail": "Vulnerability assessment and penetration testing at least twice a year, with 6 months between external tests (CRA-5.8.13I). Vulnerability assessments \"preferably\" monthly for internal and weekly for external systems (CRA-5.8.13D).", "cite": "CRA-5.8.13G; CRA-5.8.13I; CRA-5.8.13D", "url": "https://cbben.thomsonreuters.com/entiresection/605259", "quote": "All licensees must perform vulnerability assessment and penetration testing of their systems, applications, and network devices to verify the robustness of the security controls in place at least twice a year.", "confidence": "verified" }, "threat_intel": { "code": "recommended", "detail": "Tests must simulate real world attacks, but no rule ties test scenarios to threat intelligence. Threat intelligence \"should\" update incident scenario tests, and a threat intelligence subscription \"should\" be taken (CRA-5.8.11C).", "cite": "CRA-5.8.14G; CRA-5.8.11C", "url": "https://cbben.thomsonreuters.com/entiresection/605259", "quote": "Licensees should regularly use threat intelligence to update the scenarios so that they remain current and relevant.", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Certified, qualified and experienced testers. The twice-yearly test must be run by external, independent third parties rotated out at least every two years. No scheme named.", "cite": "CRA-5.8.13G(c), (e)", "url": "https://cbben.thomsonreuters.com/entiresection/605259", "quote": "(c) Be conducted by qualified and experienced security professionals who are certified in providing penetration testing services;", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "In-house staff with adequate expertise must also test at periodic intervals, but the twice-yearly test must be external. Internal testing adds to the external test and cannot replace it.", "cite": "CRA-5.8.13G(d), (e)", "url": "https://cbben.thomsonreuters.com/entiresection/605259", "quote": "(d) Be performed internally at periodic intervals by employees having adequate expertise and competency in such testing; (e) Be performed, twice a year, by external independent third parties who are rotated out at least every two years; and", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "Only as an example of staff training. No red team clause.", "cite": "CRA-5.8.31", "url": "https://cbben.thomsonreuters.com/entiresection/605259", "quote": "The licensee must ensure that all employees receive adequate training on a regular basis, in relation to cyber security and the threats they could encounter, such as through testing employee reactions to simulated cyber-attack scenarios.", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Physical access appears only as an attack vector to consider in threat assessments (CRA-5.8.13A(b)). The security plan must cover physical facilities (CRA-5.1.2(d)). No physical testing provision.", "cite": "No provision; full module reviewed (searched: physical, premises, red team, intrusion)", "url": "https://cbben.thomsonreuters.com/entiresection/605259", "confidence": "verified" }, "third_party": { "code": "required", "detail": "Vulnerability assessments must cover connections with third parties, defined as API or other connections with fintechs, technology providers and outsourcing providers. CBB may require additional third-party security reviews (CRA-5.8.13H). No pooled tests.", "cite": "CRA-5.8.13D; CRA-5.8.13H", "url": "https://cbben.thomsonreuters.com/entiresection/605259", "quote": "The vulnerability assessments must be comprehensive and cover internal technology, external technology, and connections with third parties.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No provision on OT or industrial control systems.", "cite": "No provision; full module reviewed (searched: operational technology, OT, industrial control, ICS, SCADA)", "url": "https://cbben.thomsonreuters.com/entiresection/605259", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "IT systems including trading and settlement systems must be \"fully tested\" for capacity and orderly trading under stress (CRA-5.1.4). That is a resilience test, not a security test. The security testing paragraphs do not name payment, settlement, card or SWIFT systems.", "cite": "No provision; full module reviewed (searched: payment, settlement, SWIFT, card, penetration, test)", "url": "https://cbben.thomsonreuters.com/entiresection/605259", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "The security plan must cover cloud based services (CRA-5.1.2(d)) and cloud is an attack vector to consider (CRA-5.8.13A(b)). No testing provision covers cloud or SaaS.", "cite": "No provision; full module reviewed (searched: cloud, SaaS)", "url": "https://cbben.thomsonreuters.com/entiresection/605259", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "No provision on multi-jurisdiction tests, foreign testers or test data location. Physical copies of seeds and private keys must be kept in Bahrain (CRA-5.4.11(c)) and outsourcing outside Bahrain needs CBB approval (CRA-6.6.7). Neither is a testing rule.", "cite": "No provision on testing; full module reviewed (searched: cross-border, overseas, outside Bahrain, foreign, branch, residency)", "url": "https://cbben.thomsonreuters.com/entiresection/605259", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming, replay or red team provision.", "cite": "No provision; full module reviewed (searched: purple, replay, workshop, blue team, red team)", "url": "https://cbben.thomsonreuters.com/entiresection/605259", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Test reports must record the steps taken to mitigate each risk and be kept for five years. Vulnerabilities must be fixed on a risk-based timeline (CRA-5.8.13F). No fixed deadline and no retest rule.", "cite": "CRA-5.8.13I; CRA-5.8.13F; CRA-5.8.36", "url": "https://cbben.thomsonreuters.com/entiresection/605259", "quote": "The vulnerability assessment and penetration testing reports must include the vulnerabilities identified and a full list of ‘passed’ tests and ‘failed’ tests together with the steps taken to mitigate the risks identified.", "confidence": "verified" }, "regulator_role": { "code": "receives_results", "detail": "Each external test report goes to CBB within two months of the test month. CBB may require additional third-party security reviews. CBB does not lead tests or accredit testers.", "cite": "CRA-5.8.13I; CRA-5.8.13H", "url": "https://cbben.thomsonreuters.com/entiresection/605259", "quote": "the report on such testing must be provided to CBB within two months following the end of the month where the testing took place.", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "The only automation text is an incident metric, 'Volume of incidents detected and responded via automation' (CRA-5.8.14N). Nothing on automated or AI-driven testing, or on testing AI systems.", "cite": "No provision; full module reviewed (searched: automat, artificial intelligence, AI, machine learning, continuous)", "url": "https://cbben.thomsonreuters.com/entiresection/605259", "confidence": "verified" } } }, { "id": "bh-cbb-sio96-stablecoin", "jurisdiction": "Bahrain", "region": "GCC", "sector": "financial", "name": "CBB Rulebook Volume 6 (Capital Markets), Module SIO Stablecoin Issuance & Offering, Chapter SIO-9 Technology Governance & Cyber Security (Section SIO-9.6 Cyber Security)", "short": "CBB SIO-9.6 stablecoin issuers", "issuer": "Central Bank of Bahrain (CBB)", "version": "2025-07", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://cbben.thomsonreuters.com/entiresection/2305008", "regulator_arabic": "مصرف البحرين المركزي", "arabic_source_url": "https://www.cbb.gov.bh/ar/", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Sets the same twice-yearly testing duty for licensed issuers of fiat-backed stablecoins, which the module treats as usable to pay for goods and services in Bahrain (SIO-8.1.1(d), SIO-8.1.4). Issued July 2025 (ad-hoc communication of July 2, 2025) and amended May 2026 outside Chapter SIO-9. Missed by the September coding. SIO-9.6.32 refers to 'SIO-9.7.30(e)', which looks like a cross-reference slip for SIO-9.6.30(e).", "cells": { "legal_force": { "code": "mandatory", "detail": "Module SIO is a CBB Directive under Article 38 of the CBB Law. The testing paragraph uses \"must\".", "cite": "SIO-A.1.3; SIO-9.6.30", "url": "https://cbben.thomsonreuters.com/entiresection/2305008", "quote": "This Module contains the CBB’s Directive (as amended from time-to-time) relating to issuance and offering of stablecoins and is issued under the powers available to the CBB under Article 38 of the CBB Law.", "confidence": "verified" }, "scope": { "code": "licensed stablecoin issuers", "detail": "Issuers of single-currency stablecoins backed by BHD, USD or other approved fiat reserves (SIO-1.2.1). The issuer must report use of its stablecoin as a medium of exchange in Bahrain (SIO-8.1.1(d)).", "cite": "SIO-1.1.1; SIO-1.2.1", "url": "https://cbben.thomsonreuters.com/entiresection/2305008", "quote": "This Module sets out the requirements for stablecoin issuers undertaking regulated stablecoin offering service.", "confidence": "verified" }, "frequency": { "code": "every 6 months", "detail": "Vulnerability assessment and penetration testing at least twice a year, with 6 months between external tests (SIO-9.6.32). Vulnerability assessments \"preferably\" monthly for internal and weekly for external systems (SIO-9.6.27).", "cite": "SIO-9.6.30; SIO-9.6.32; SIO-9.6.27", "url": "https://cbben.thomsonreuters.com/entiresection/2305008", "quote": "Stablecoin issuers must perform vulnerability assessment and penetration testing of their systems, applications, and network devices to verify the robustness of the security controls in place at least twice a year.", "confidence": "verified" }, "threat_intel": { "code": "recommended", "detail": "Tests must simulate real world attacks, but no rule ties test scenarios to threat intelligence. Threat intelligence \"should\" update incident scenario tests, and a threat intelligence subscription \"should\" be taken (SIO-9.6.20).", "cite": "SIO-9.6.39; SIO-9.6.20", "url": "https://cbben.thomsonreuters.com/entiresection/2305008", "quote": "Stablecoin issuers should regularly use threat intelligence to update the scenarios so that they remain current and relevant.", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Certified, qualified and experienced testers. The twice-yearly test must be run by external, independent third parties rotated out at least every two years. No scheme named.", "cite": "SIO-9.6.30(c), (e)", "url": "https://cbben.thomsonreuters.com/entiresection/2305008", "quote": "(c) Be conducted by qualified and experienced security professionals who are certified in providing penetration testing services;", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "In-house staff with adequate expertise must also test at periodic intervals, but the twice-yearly test must be external. Internal testing adds to the external test and cannot replace it.", "cite": "SIO-9.6.30(d), (e)", "url": "https://cbben.thomsonreuters.com/entiresection/2305008", "quote": "(d) Be performed internally at periodic intervals by employees having adequate expertise and competency in such testing; (e) Be performed, twice a year, by external independent third parties who are rotated out at least every two years; and", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "Only as an example of staff training. No red team clause.", "cite": "SIO-9.6.59", "url": "https://cbben.thomsonreuters.com/entiresection/2305008", "quote": "Stablecoin issuer must ensure that all employees receive adequate training on a regular basis, in relation to cyber security and the threats they could encounter, such as through testing employee reactions to simulated cyber-attack scenarios.", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Physical access appears only as an attack vector to consider in threat assessments (SIO-9.6.24(b)). The security plan must cover physical facilities (SIO-9.1.2). No physical testing provision.", "cite": "No provision; full module reviewed (searched: physical, premises, red team, intrusion)", "url": "https://cbben.thomsonreuters.com/entiresection/2305008", "confidence": "verified" }, "third_party": { "code": "required", "detail": "Vulnerability assessments must cover connections with third parties, defined as API or other connections with fintechs, technology providers and outsourcing providers. CBB may require additional third-party security reviews (SIO-9.6.31). No pooled tests.", "cite": "SIO-9.6.27; SIO-9.6.31", "url": "https://cbben.thomsonreuters.com/entiresection/2305008", "quote": "The vulnerability assessments must be comprehensive and cover internal technology, external technology, and connections with third parties.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No provision on OT or industrial control systems.", "cite": "No provision; full module reviewed (searched: operational technology, OT, industrial control, ICS, SCADA)", "url": "https://cbben.thomsonreuters.com/entiresection/2305008", "confidence": "verified" }, "payment_systems": { "code": "required", "detail": "The module applies only to stablecoin issuers, and approved stablecoins serve as a medium of exchange in Bahrain, which issuers must report (SIO-8.1.1(d)). The twice-yearly penetration test (SIO-9.6) therefore covers the systems that issue, redeem and transfer a payment instrument. Coded as the OCC GENIUS rule and the CBK e-money rule. The testing paragraphs do not name payment, card or SWIFT systems.", "cite": "SIO-1.1.1; SIO-8.1.1(d); SIO-9.6", "url": "https://cbben.thomsonreuters.com/entiresection/2305008", "confidence": "verified", "quote": "an estimate of the average number and average aggregate value of transaction per day during the quarter that are associated to its use as a medium of exchange within Bahrain.", "harmonized_from": "not_addressed", "harmonize_reason": "R8: The module applies only to stablecoin issuers, whose stablecoins serve as a medium of exchange (SIO-8.1.1(d)); issuers of payment instruments are coded as the OCC GENIUS and CBK e-money rules." }, "cloud_saas": { "code": "not_addressed", "detail": "The security plan must cover cloud based services (SIO-9.1.2) and cloud is an attack vector to consider (SIO-9.6.24(b)). No testing provision covers cloud or SaaS.", "cite": "No provision; full module reviewed (searched: cloud, SaaS)", "url": "https://cbben.thomsonreuters.com/entiresection/2305008", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "Access to seeds and private keys for approved stablecoins is restricted to senior managers residing in Bahrain (SIO-9.4.3(c)), a residency limit on people with access to systems in scope. Outsourcing outside Bahrain needs CBB approval (SIO-5.10.7), which R1 does not count on its own. Nothing on multi-jurisdiction tests, recognition of tests run abroad or foreign testers.", "cite": "SIO-9.4.3(c); SIO-5.10.7 considered", "url": "https://cbben.thomsonreuters.com/entiresection/2305008", "confidence": "verified", "quote": "Access to seed and private key relating to approved stablecoins is tightly restricted among senior management personnel residing in Bahrain", "harmonized_from": "not_addressed", "harmonize_reason": "R1: SIO-9.4.3(c) limits access to seeds and private keys to senior managers residing in Bahrain, a residency limit on people with access to in-scope systems, coded as IRS Pub 1075 Sec. 2.C.7." }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming, replay or red team provision.", "cite": "No provision; full module reviewed (searched: purple, replay, workshop, blue team, red team)", "url": "https://cbben.thomsonreuters.com/entiresection/2305008", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Test reports must record the steps taken to mitigate each risk and be kept for five years. Vulnerabilities must be fixed on a risk-based timeline (SIO-9.6.29). No fixed deadline and no retest rule.", "cite": "SIO-9.6.32; SIO-9.6.29; SIO-9.6.64", "url": "https://cbben.thomsonreuters.com/entiresection/2305008", "quote": "The vulnerability assessment and penetration testing reports must include the vulnerabilities identified and a full list of ‘passed’ tests and ‘failed’ tests together with the steps taken to mitigate the risks identified.", "confidence": "verified" }, "regulator_role": { "code": "receives_results", "detail": "Each external test report goes to CBB within two months of the test month. CBB may require additional third-party security reviews. CBB does not lead tests or accredit testers.", "cite": "SIO-9.6.32; SIO-9.6.31", "url": "https://cbben.thomsonreuters.com/entiresection/2305008", "quote": "the report on such testing must be provided to CBB within two months following the end of the month where the testing took place.", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "The only automation text is an incident metric, 'Volume of incidents detected and responded via automation' (SIO-9.6.46). Nothing on automated or AI-driven testing, or on testing AI systems.", "cite": "No provision; full module reviewed (searched: automat, artificial intelligence, AI, machine learning, continuous)", "url": "https://cbben.thomsonreuters.com/entiresection/2305008", "confidence": "verified" } } }, { "id": "bh-cbb-rm3-money-changers", "jurisdiction": "Bahrain", "region": "GCC", "sector": "financial", "name": "CBB Rulebook Volume 5 (Specialised Licensees), Type 1 Money Changers, Module RM Money Changers Risk Management, Chapter RM-3 Cyber Security Risk Management", "short": "CBB RM-3 money changers", "issuer": "Central Bank of Bahrain (CBB)", "version": "2022-01", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://cbben.thomsonreuters.com/entiresection/501572", "regulator_arabic": "مصرف البحرين المركزي", "arabic_source_url": "https://www.cbb.gov.bh/ar/", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Money changers' regulated services include 'Currency transfer to/from Bahrain' (AU-1.1.8(b), https://cbben.thomsonreuters.com/node/500675), a payment service. RM-3 requires annual penetration tests, twice a year for licensees with digital channels, reported to CBB (RM-3.1.29, RM-3.1.61). Added January 2022. The September coding listed Volume 5 types other than Type 7 as not reviewed.", "cells": { "legal_force": { "code": "mandatory", "detail": "Module RM is a CBB Directive under Article 38 of the CBB Law. The testing paragraph uses \"must\".", "cite": "RM-A.1.3; RM-3.1.29", "url": "https://cbben.thomsonreuters.com/entiresection/501572", "quote": "This Module contains the Central Bank of Bahrain's ('CBB') Directive (as amended from time to time) regarding Risk Management requirements applicable to licensees, and is issued under the powers available to the CBB under Article 38", "confidence": "verified" }, "scope": { "code": "all money changer licensees", "detail": "All money changers licensed in Bahrain. Their regulated services include currency transfer to and from Bahrain (Volume 5 Type 1, AU-1.1.8(b), https://cbben.thomsonreuters.com/node/500675).", "cite": "RM-B.1.1; AU-1.1.8", "url": "https://cbben.thomsonreuters.com/entiresection/501572", "quote": "The content of this Module applies to all Money Changer licensees authorised in the Kingdom, thereafter referred to in this Module as licensees.", "confidence": "verified" }, "frequency": { "code": "every 6 months", "detail": "Once a year for all licensees, twice a year for licensees with digital channels. RM-3.1.31 then says tests are held each June and December, citing RM-3.1.59, which looks like a cross-reference slip for RM-3.1.29.", "cite": "RM-3.1.29; RM-3.1.31", "url": "https://cbben.thomsonreuters.com/entiresection/501572", "quote": "All licensees must perform penetration testing of their systems, applications, and network devices to verify the robustness of the security controls in place at least once a year. However, licensees that provide services through digital channels must perform penetrating testing at least twice a year.", "confidence": "verified" }, "threat_intel": { "code": "recommended", "detail": "Same text as the bank and insurance rules. Threat intelligence \"should\" update incident scenario tests, and a threat intelligence subscription \"should\" be taken (RM-3.1.21).", "cite": "RM-3.1.38; RM-3.1.21", "url": "https://cbben.thomsonreuters.com/entiresection/501572", "quote": "Licensees should regularly use threat intelligence to update the scenarios so that they remain current and relevant.", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Certified, qualified testers; independent testers changed at least every two years. No scheme named.", "cite": "RM-3.1.29(c), (d)", "url": "https://cbben.thomsonreuters.com/entiresection/501572", "quote": "(c) Be conducted by qualified and experienced security professionals who are certified in providing penetration testing services; (d) Be performed by internal and external independent third parties which should be changed at least every two years", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "Same 'internal and external independent third parties' wording as Volume 1, with two-year rotation. 'Internal' is not defined.", "cite": "RM-3.1.29(d)", "url": "https://cbben.thomsonreuters.com/entiresection/501572", "quote": "(d) Be performed by internal and external independent third parties which should be changed at least every two years", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "Only as an example of staff training. No red team clause.", "cite": "RM-3.1.56", "url": "https://cbben.thomsonreuters.com/entiresection/501572", "quote": "The licensee must ensure that all employees receive adequate training on a regular basis, in relation to cyber security and the threats they could encounter, such as through testing employee reactions to simulated cyber-attack scenarios.", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Physical access appears only as an attack vector to consider in threat assessments (RM-3.1.23(b)). No physical testing provision.", "cite": "No provision; full module reviewed (searched: physical, premises, red team, intrusion)", "url": "https://cbben.thomsonreuters.com/entiresection/501572", "confidence": "verified" }, "third_party": { "code": "required", "detail": "Vulnerability assessments must cover connections with third parties. CBB may require additional third-party security reviews (RM-3.1.30). RM-3.1.27, which defines third-party connections, refers to 'RM-3.1.25'; it appears to mean RM-3.1.26, as with Vol. 3 RM-9.1.27. No pooled tests.", "cite": "RM-3.1.26; RM-3.1.27; RM-3.1.30", "url": "https://cbben.thomsonreuters.com/entiresection/501572", "quote": "The vulnerability assessments must be comprehensive and cover internal technology, external technology, and connections with third parties.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "Appendix A lists industrial control system configuration baselines only. No testing provision covers OT.", "cite": "No provision; full module reviewed (searched: operational technology, OT, industrial control, ICS, SCADA)", "url": "https://cbben.thomsonreuters.com/entiresection/501572", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "The test covers all systems. Money changers may transfer currency to and from Bahrain (AU-1.1.8(b)), but the testing paragraphs do not name remittance, payment, card or SWIFT systems.", "cite": "No provision; full module reviewed (searched: payment, remittance, transfer, SWIFT, card)", "url": "https://cbben.thomsonreuters.com/entiresection/501572", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "Cloud appears as an attack vector (RM-3.1.23(b)) and in the outsourcing rules (Chapter RM-2). No testing provision.", "cite": "No provision; full module reviewed (searched: cloud, SaaS)", "url": "https://cbben.thomsonreuters.com/entiresection/501572", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "Overseas licensees must be overseen by their regional or head office under a cyber security risk framework, the same text as OM-5.5.6. Outsourcing outside Bahrain needs CBB approval (RM-2.1.7). Nothing on multi-jurisdiction tests, recognition of foreign tests or tester location.", "cite": "RM-3.1.6; RM-2.1.7", "url": "https://cbben.thomsonreuters.com/entiresection/501572", "quote": "Overseas licensees must be governed under a framework of cyber security risk management policies which ensure that an adequate level of oversight is exercised by the regional office or head office.", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming, replay or red team provision.", "cite": "No provision; full module reviewed (searched: purple, replay, workshop, blue team, red team)", "url": "https://cbben.thomsonreuters.com/entiresection/501572", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Reports must record the steps taken to mitigate each risk. Vulnerability remediation processes required (RM-3.1.28). No deadline, no retest rule.", "cite": "RM-3.1.31; RM-3.1.28; RM-3.1.61", "url": "https://cbben.thomsonreuters.com/entiresection/501572", "quote": "The penetration testing reports must include the vulnerabilities identified and a full list of ‘passed’ tests and ‘failed’ tests together with the steps taken to mitigate the risks identified.", "confidence": "verified" }, "regulator_role": { "code": "receives_results", "detail": "Reports go to CBB within three months of the test month. CBB may require additional third-party security reviews. CBB does not lead tests or accredit testers.", "cite": "RM-3.1.61; RM-3.1.31; RM-3.1.30", "url": "https://cbben.thomsonreuters.com/entiresection/501572", "quote": "must be provided to CBB within three months following the end of the month where the testing took place, i.e. for a June test, the report must be submitted at the latest by 30th September and for a December test, by 31st March.", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "The only automation text is an incident metric, 'Volume of incidents detected and responded via automation' (RM-3.1.45). Nothing on automated or AI-driven testing.", "cite": "No provision; full module reviewed (searched: automat, artificial intelligence, AI, machine learning, continuous)", "url": "https://cbben.thomsonreuters.com/entiresection/501572", "confidence": "verified" } } }, { "id": "bh-cbb-om52-financing", "jurisdiction": "Bahrain", "region": "GCC", "sector": "financial", "name": "CBB Rulebook Volume 5 (Specialised Licensees), Type 3 Financing Companies, Module OM Operational Risk Management, Section OM-5.2 Internet Security (with BR-1.6)", "short": "CBB OM-5.2 financing companies", "issuer": "Central Bank of Bahrain (CBB)", "version": "2014-01", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://cbben.thomsonreuters.com/entiresection/504263", "regulator_arabic": "مصرف البحرين المركزي", "arabic_source_url": "https://www.cbb.gov.bh/ar/", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Sets a twice-yearly penetration test and vulnerability assessment for CBB-licensed financing companies that offer internet financial services, run by security professionals \"such as ethical hackers\", with the report to CBB within two months (OM-5.2.1 to OM-5.2.3; BR-1.6). Financing companies lend and issue cards, and some acquire card payments (OM-5.1.19 to OM-5.1.20E). In the Rulebook since January 2014. The Bahrain recheck left it out on a narrower scope; its verifier noted that the regimes.md scope (\"financial institutions\") covers financing companies, as the FTC Safeguards Rule row covers non-bank lenders.", "cells": { "legal_force": { "code": "mandatory", "detail": "Module OM is a CBB Directive under Article 38 of the CBB Law. The testing paragraphs use \"must\".", "cite": "OM-A.1.3; OM-5.2.1", "url": "https://cbben.thomsonreuters.com/entiresection/503991", "quote": "This Module contains the CBB's Directive (as amended from time to time) relating to operational risk management and is issued under the powers available to the CBB under Article 38 of the Central Bank of Bahrain and Financial Institutions Law 2006 ('CBB Law').", "confidence": "verified" }, "scope": { "code": "financing companies with internet services", "detail": "Module OM applies to all financing company licensees (OM-B.1.1). The test duty covers those providing internet financial services, a term the module does not define.", "cite": "OM-B.1.1; OM-5.2.1; BR-1.6.1", "url": "https://cbben.thomsonreuters.com/entiresection/504263", "quote": "Licensees providing internet financial services must regularly test their systems against security breaches and verify the robustness of the security controls in place.", "confidence": "verified" }, "frequency": { "code": "every 6 months", "detail": "Penetration tests each June and December, the same cycle as the bank rules (OM-5.5.61).", "cite": "OM-5.2.2; BR-1.6.2", "url": "https://cbben.thomsonreuters.com/entiresection/504263", "quote": "The penetration testing referred to in Paragraph OM-5.2.1, must be conducted each year in June and December.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Threat scenarios appear only in business continuity planning (OM-4.3, OM-4.8.9). Nothing ties tests to threat intelligence.", "cite": "No provision; full module reviewed (searched: threat intelligence, intelligence, scenario)", "url": "https://cbben.thomsonreuters.com/entiresection/503991", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Tests must be run by security professionals \"such as ethical hackers\" who provide penetration testing services. No certification, accreditation, independence or rotation rule, unlike Volume 1 OM-5.5.28(c) and (d).", "cite": "OM-5.2.1", "url": "https://cbben.thomsonreuters.com/entiresection/504263", "quote": "These tests must be conducted by security professionals, such as ethical hackers, that provide penetration testing services and a vulnerability assessment of the system.", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Silent on whether the security professionals may be the licensee's own staff. \"That provide penetration testing services\" suggests an outside provider but does not exclude in-house testers.", "cite": "No provision; full module reviewed (searched: internal, in-house, external, independent, third party)", "url": "https://cbben.thomsonreuters.com/entiresection/504263", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "Staff get annual security training on branch security (OM-5.1.16), and customers get fraud warnings (OM-3.1.8). No social engineering test.", "cite": "No provision; full module reviewed (searched: social engineering, phishing, simulat, red team, awareness)", "url": "https://cbben.thomsonreuters.com/entiresection/503991", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Section OM-5.1 prescribes physical security for branches (steel doors, intrusion alarms, CCTV, strong rooms) but no test of it. The OM-5.2 test covers systems.", "cite": "No provision; full module reviewed (searched: physical, premises, intrusion, red team, test)", "url": "https://cbben.thomsonreuters.com/entiresection/503991", "confidence": "verified" }, "third_party": { "code": "assurance_only", "detail": "The penetration test duty does not mention third parties. Outsourcing agreements must give CBB and auditors access to the provider's records (OM-2.1.7(iv)), assessments may use provider certifications, audit reports or pooled audits (OM-2.1.8), and annual continuity tests must include vendors' recovery services.", "cite": "OM-4.8.2(c); OM-2.1.7(iv); OM-2.1.8", "url": "https://cbben.thomsonreuters.com/entiresection/503991", "quote": "(c) Important recovery services provided by vendors or counterparties must form part of the testing scope;", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full module reviewed (searched: operational technology, OT, industrial control, ICS, SCADA)", "url": "https://cbben.thomsonreuters.com/entiresection/503991", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "All licensees must hold PCI-DSS certification and are audited by PCI authorised companies (OM-5.1.19, OM-5.1.19A). The OM-5.2 test names no payment, card or SWIFT system. Coded as the CBB bank row.", "cite": "No provision; full module reviewed (searched: payment, card, PCI, SWIFT, ATM, POS)", "url": "https://cbben.thomsonreuters.com/entiresection/503991", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "Cloud services appear only as an outsourcing example (OM-2.1.2) and in the CBB notification rules (OM-2.1.7(i), (ii)). No testing provision.", "cite": "No provision; full module reviewed (searched: cloud, SaaS)", "url": "https://cbben.thomsonreuters.com/entiresection/503991", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "Outsourcing to a third party outside Bahrain needs prior CBB approval, cloud data services excepted (OM-2.1.7(i)). For branches of foreign entities, CBB may treat third-party outsourcing arranged by the head office as intragroup, given a letter of comfort (OM-2.1.3), and the branch may outsource its risk management function to the head office with CBB approval (OM-2.1.6). These are outsourcing conditions, not testing rules, and the module has no rule on head-office oversight of overseas licensees' cyber risk, unlike OM-5.5.6, GR-12.2.10 and RM-3.1.6. Coded as the crypto-asset row, whose outsourcing approval rule (CRA-6.6.7) is also not counted.", "cite": "No cross-border testing provision under R1; OM-2.1.3, OM-2.1.6 and OM-2.1.7(i) considered (searched: overseas, outside Bahrain, foreign, branch)", "url": "https://cbben.thomsonreuters.com/entiresection/503991", "confidence": "verified", "harmonized_from": "addressed", "harmonize_reason": "R1: OM-2.1.7(i) and OM-2.1.3 set outsourcing conditions; the module has no overseas-licensee cyber rule like OM-5.5.6, so it is coded as the crypto-asset row (CRA-6.6.7)." }, "purple_replay": { "code": "not_addressed", "detail": "Workshops appear only as a risk self-assessment tool (OM-1.3.4(a)). No purple teaming or replay.", "cite": "No provision; full module reviewed (searched: purple, replay, workshop, blue team, red team)", "url": "https://cbben.thomsonreuters.com/entiresection/503991", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "The report must be kept with the steps taken to mitigate the risks. Material gaps found in periodic control evaluations need immediate corrective action (OM-5.3.2). No deadline for test findings, no retest rule.", "cite": "OM-5.2.3; OM-5.3.2", "url": "https://cbben.thomsonreuters.com/entiresection/504263", "quote": "The vulnerability assessment report, along with the steps taken to mitigate the risks must be maintained by the licensee for a 5-year period from the date of testing", "confidence": "verified" }, "regulator_role": { "code": "receives_results", "detail": "The vulnerability assessment report goes to CBB within two months of the test month (also BR-1.6.2). CBB does not lead tests or approve testers.", "cite": "OM-5.2.3; BR-1.6.2", "url": "https://cbben.thomsonreuters.com/entiresection/504263", "quote": "must be provided to the CBB within two months following the end of the month where the testing took place, i.e. for the June test, the report must be submitted at the latest by 31st August and for the December test, by 28th February", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "Automation appears only in a risk statement on loss patterns (OM-1.5.10). Nothing on automated or AI-driven testing.", "cite": "No provision; full module reviewed (searched: automat, artificial intelligence, AI, machine learning, continuous)", "url": "https://cbben.thomsonreuters.com/entiresection/503991", "confidence": "verified" } } }, { "id": "kw-cbk-corf", "jurisdiction": "Kuwait", "region": "GCC", "sector": "financial", "name": "Cyber and Operational Resilience Framework for All Local Banks and Financial Institutions (CORF)", "short": "CBK CORF", "issuer": "Central Bank of Kuwait (CBK)", "version": "Version 1.0, December 3, 2025, 'First Release'. The PDF fetched on 2026-10-30 is byte-identical to the 2026-09-28 copy (SHA-256 7615be60938dda29c67a5f188b72543483baa1559a5b1d4443a99efc6c56c664). The CBK English and Arabic CORF pages still link only this file.", "status": "In force as of 2026-09-28. CBK press statement of December 3, 2025 says banks and financial institutions must implement the framework from its date. CORF describes itself as the successor to the 2020 Cybersecurity Framework (CSF). Checked the CBK CORF page (still links v1.0) and the press release.", "public": "full", "primary_url": "https://www.cbk.gov.kw/en/images/corf-170113_v10_tcm10-170113.pdf", "arabic_title": "إطار المرونة السيبرانية والتشغيلية للبنوك والمؤسسات المالية المحلية", "regulator_arabic": "بنك الكويت المركزي", "arabic_source_url": "https://www.cbk.gov.kw/ar/supervision/cyber_operational_resilience_framework", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No amendment, new version, FAQ or withdrawal found on cbk.gov.kw as of 2026-10-30. The issuing instrument is CBK Circular No. (14/رب، رم/2025/603) of December 3, 2025, now posted in CBK's Arabic instruction compendia for banks, Islamic banks, exchange companies, finance companies, credit information companies and e-payment firms (PDFs created May 2026). It says entities must implement the framework from its date and file an inherent risk profile and a self-assessment of applicable controls by January 15, 2026. Its footnote defines local financial institutions as exchange companies, finance companies, e-payment service providers, e-money service providers, e-payment system operators and the Kuwait credit information network company. The CBK Arabic CORF page carries the mandate in CBK's own words: 'ويتعين على البنوك والمؤسسات المالية المحلية تنفيذ متطلبات الإطار المشار إليه اعتباراً من تاريخه 3-12-2025.' This is a stronger primary cite for legal_force than the press statement; the code stays mandatory. The Arabic page links the framework as 'باللغة الإنجليزية' (in English); no Arabic text of CORF itself was found. Circular No. (2/رب، رب أ، رص، رك، رم/2025/605) of December 8, 2025 only asks for working group nominees. Scope label: CORF's defined term 'Regulated Entities' lists Kuwaiti banks, foreign banks, finance, exchange, e-payment, credit information and open banking firms. CBK-regulated investment companies are not listed, and CBK's investment company instruction pages carry no CORF link. The label 'all CBK-regulated entities' follows CORF's own wording and is kept; readers should not take it to include investment companies. Secondary only: Times Kuwait (October 20, 2026, citing Al-Rai of October 19) reports that CBK told exchange companies, e-payment and e-money providers, e-payment system operators and the credit information company to obtain CBK approval of an external assessor by November 30 and to file a CORF compliance assessment within six months of contracting; banks did the same last year. The CBK circular was not found on cbk.gov.kw. This fits CORF Ch. 3 s. 5.3 and changes no code. Al-Rai (August 11, 2026, secondary) reports a CBK reminder to report operational incidents under CORF; not a testing rule." }, "notes": "CORF has six chapters (framework, working group terms, toolkit, cyber resilience baselines, operational resilience baselines, third-party risk baselines) in 389 pages. The red team paragraphs sit under the heading 'Red Teaming and Adversarial Simulations' but are numbered 5.13.2.5 to 5.13.2.11 inside 5.13.2 'Security Patch Management' (CORF pp. 260 to 261). The Level 3 (Baseline) maturity descriptor for testing includes 'periodic vulnerability scanning and annual penetration testing' (CORF p. 163), although the baseline control 5.13.1.2 itself only says 'periodic'. The 2020 CSF, which CORF replaces, listed penetration testing only as one kind of vulnerability assessment (CSF 5.15.2) and as security testing for changes (CSF 5.8.6(c)); it had no red team requirement. CORF also asks for operational resilience testing at least annually (Ch. 4 9.1.4.9). Controls may be excluded only with formal justification in the SoA approved by CBK.", "cells": { "legal_force": { "code": "mandatory", "detail": "Issued under Article 15 of Law No. 32 of 1968. CBK's press statement says local banks and financial institutions must implement the framework from its issue date. Controls use 'shall'. Translation by Bendings.", "cite": "CORF Ch. 1 §1; CBK press statement December 3, 2025 (Arabic PDF), p. 3", "url": "https://www.cbk.gov.kw/en/images/press-corf-170114_v40_tcm10-170114.pdf", "quote": "ويتعين على البنوك والمؤسسات المالية المحلية تنفيذ متطلبات الإطار المشار إليه اعتباراً من تاريخه", "confidence": "verified" }, "scope": { "code": "all CBK-regulated entities", "detail": "Kuwaiti banks, foreign banks in Kuwait, exchange companies, finance companies, e-payment companies, credit information companies and open banking providers. Controls apply per a CBK-approved Statement of Applicability; CBK tiers entities for supervision.", "cite": "CORF Ch. 3 (Toolkit) §4, §4.1; Ch. 1 §10.1", "url": "https://www.cbk.gov.kw/en/images/corf-170113_v10_tcm10-170113.pdf", "quote": "The SoA must be submitted by all entities regulated by the CBK. This includes: Kuwaiti Banks; Foreign Banks operating in the State of Kuwait; Exchange Companies; Finance Companies; E-Payment of Funds Companies; Credit Information Companies; and Open Banking Service Providers.", "confidence": "verified" }, "frequency": { "code": "annual", "detail": "Red teaming at least once a year. Annual penetration testing of IoT/OT (5.14.2.3). Other vulnerability assessments and penetration tests are periodic or on significant change (5.13.1.2).", "cite": "CORF Ch. 4 5.13.2.7; 5.14.2.3; 5.13.1.2", "url": "https://www.cbk.gov.kw/en/images/corf-170113_v10_tcm10-170113.pdf", "quote": "Red teaming exercises shall be conducted at least once a year or as required based on changes to the threat landscape, critical systems, or regulatory requirements.", "confidence": "verified" }, "threat_intel": { "code": "required", "detail": "Threat intelligence must shape red team scenarios. A threat intelligence platform is also required (5.15.1.4).", "cite": "CORF Ch. 4 5.13.2.6", "url": "https://www.cbk.gov.kw/en/images/corf-170113_v10_tcm10-170113.pdf", "quote": "Threat intelligence shall be incorporated into red teaming exercises to ensure scenarios reflect real-world adversary TTPs and emerging threats.", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "A dedicated, qualified team with specialized expertise. No certification or accreditation scheme is named. The CBK-approved assessor requirement applies to the annual CORF assessment, not to testing.", "cite": "CORF Ch. 4 5.13.2.8; Ch. 3 §5.3", "url": "https://www.cbk.gov.kw/en/images/corf-170113_v10_tcm10-170113.pdf", "quote": "Regulated Entities shall engage a dedicated qualified team with specialized expertise to conduct red teaming exercises.", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "5.13.2.8 does not say whether the team is in-house or external. 5.13.2.9 requires the exercise to run without prior knowledge of monitoring, incident response and asset owner teams.", "cite": "No provision; full text reviewed (searched: internal, in-house, external, independent, red team)", "url": "https://www.cbk.gov.kw/en/images/corf-170113_v10_tcm10-170113.pdf", "confidence": "verified" }, "social_engineering": { "code": "required", "detail": "Red teaming must assess people as well as systems (5.13.2.5). Awareness programs must be measured with simulated social engineering attacks.", "cite": "CORF Ch. 4 4.5.2.8; 5.13.2.5", "url": "https://www.cbk.gov.kw/en/images/corf-170113_v10_tcm10-170113.pdf", "quote": "Regulated Entities shall assess and monitor the effectiveness of the security awareness and training programs through knowledge assessments and simulated social engineering attacks (e.g., mock phishing attacks/phishing simulations).", "confidence": "verified" }, "physical": { "code": "controls_test", "detail": "Physical and environmental controls must be tested at least quarterly. The text reads as control and maintenance testing, not adversarial intrusion. The red team clauses do not mention physical access.", "cite": "CORF Ch. 4 5.14.1.11", "url": "https://www.cbk.gov.kw/en/images/corf-170113_v10_tcm10-170113.pdf", "quote": "The implemented physical and environmental controls shall be appropriately and periodically tested, at least quarterly.", "confidence": "verified", "harmonized_from": "required", "harmonize_reason": "CORF Ch. 4 5.14.1.11 quarterly testing of physical and environmental controls reads as control testing; the red team clauses do not mention physical access." }, "third_party": { "code": "assurance_only", "detail": "No rule puts third parties in the security testing scope. Cloud risk assessments must weigh limits on the right to conduct security assessments of the provider; contracts must give a right to audit third parties and subcontractors (Ch. 6 5.2.1.2(a)). Third parties must test their own business continuity plans (Ch. 6 7.3.2.1).", "cite": "CORF Ch. 4 7.2.2.2(g); Ch. 6 5.2.1.2(a); Ch. 6 7.3.2.1", "url": "https://www.cbk.gov.kw/en/images/corf-170113_v10_tcm10-170113.pdf", "quote": "limitations to right to audit, right to conduct security assessments and right to inspect (onsite and offsite)", "confidence": "verified", "harmonized_from": "permitted", "harmonize_reason": "Ch. 4 7.2.2.2(g), Ch. 6 5.2.1.2(a): rights to audit and assess providers; no rule puts third parties in test scope." }, "ot": { "code": "required", "detail": "IoT/OT devices and networks need quarterly vulnerability assessments and annual penetration tests. Examples given are CCTV and building management systems (5.14.2.1).", "cite": "CORF Ch. 4 5.14.2.3", "url": "https://www.cbk.gov.kw/en/images/corf-170113_v10_tcm10-170113.pdf", "quote": "IoT/OT devices and their associated networks shall be subject to security assessments, including quarterly vulnerability assessments and annual penetration testing.", "confidence": "verified" }, "payment_systems": { "code": "required", "detail": "Annual and ad-hoc independent security audits of electronic payment systems using the testing sub-domain procedures. SWIFT CSCF attestation and PCI DSS certification required (4.3.1.3). Digital wallet APIs and gateways need periodic VA/PT (8.3.3.5).", "cite": "CORF Ch. 4 8.1.1.3; 4.3.1.3; 8.3.3.5", "url": "https://www.cbk.gov.kw/en/images/corf-170113_v10_tcm10-170113.pdf", "quote": "Regulated Entities shall conduct annual and ad-hoc independent security audits of the electronic payment systems in accordance with: a) the assessment procedures outlined in the Cybersecurity Testing and Threat Management Sub-Domain", "confidence": "verified" }, "cloud_saas": { "code": "assurance_only", "detail": "The cloud risk assessment must consider the entity's right to conduct security assessments of the provider. Otherwise cloud assurance rests on certifications and SOC reports (7.2.3.1, 7.2.3.4(d)). No rule requires testing cloud tenancy.", "cite": "CORF Ch. 4 7.2.2.2(g); 7.2.3.4(d)", "url": "https://www.cbk.gov.kw/en/images/corf-170113_v10_tcm10-170113.pdf", "quote": "limitations to right to audit, right to conduct security assessments and right to inspect (onsite and offsite)", "confidence": "verified", "harmonized_from": "permitted", "harmonize_reason": "Ch. 4 7.2.2.2(g), 7.2.3.4(d): cloud assurance through assessment rights, certifications and SOC reports." }, "cross_border": { "code": "addressed", "detail": "Similar controls must apply to foreign affiliates. Cloud risk assessments must weigh data location and residency (7.2.2.2(d)). DFIR arrangements must cover cross-border investigations (5.12.4.10(b)). Nothing is specific to tests.", "cite": "CORF Ch. 6 15.3.1.1; Ch. 4 7.2.2.2(d); 5.12.4.10(b)", "url": "https://www.cbk.gov.kw/en/images/corf-170113_v10_tcm10-170113.pdf", "quote": "Regulated entities shall ensure similar controls and governance are adhered to in the case of foreign affiliates apart from considering geo-political relations between countries.", "confidence": "verified" }, "purple_replay": { "code": "recommended", "detail": "Purple teaming appears only as a Level 4 (Advanced) maturity descriptor, not as a baseline control. Entities are scored on maturity.", "cite": "CORF Ch. 3 (Toolkit), maturity model, Technology & Operations, sub-domain Cybersecurity Testing and Threat Management, Level 4 (CORF p. 163)", "url": "https://www.cbk.gov.kw/en/images/corf-170113_v10_tcm10-170113.pdf", "quote": "Red teaming, purple teaming, or simulated attacks (e.g., phishing, lateral movement) are used to assess detection and response readiness.", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Red team findings need a remediation plan with timelines tracked to closure (5.13.2.11). Remediated vulnerabilities must be validated.", "cite": "CORF Ch. 4 5.13.2.11; 5.13.1.5", "url": "https://www.cbk.gov.kw/en/images/corf-170113_v10_tcm10-170113.pdf", "quote": "Regulated Entities shall conduct validation after remediating the vulnerabilities to assess and confirm whether the gaps addressed are in line with documented risk mitigation decisions.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "Red team findings go to senior management, not to CBK (5.13.2.10). CBK receives annual self-assessments and annual CBK-approved third-party assessments, and runs its own CORF assessments by supervisory tier.", "cite": "CORF Ch. 3 §5.3; Ch. 4 5.13.2.10", "url": "https://www.cbk.gov.kw/en/images/corf-170113_v10_tcm10-170113.pdf", "quote": "Furthermore, CBK will conduct CORF assessments for the Regulated Entities based on the frequency corresponding to the supervisory tier in which the Entity is categorized", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "AI and ML models must be defended against adversarial attacks. Emerging technology must be tested before and after deployment (7.1.1.6). Maturity Level 4 cites Breach and Attack Simulation; Level 5 cites AI/ML attack path simulation and fully automated testing.", "cite": "CORF Ch. 4 7.1.2.2; 7.1.1.6; Ch. 3 maturity model Levels 4 and 5", "url": "https://www.cbk.gov.kw/en/images/corf-170113_v10_tcm10-170113.pdf", "quote": "Regulated Entities shall implement adequate defenses against adversarial attacks (e.g., evasion, data poisoning, inference attacks) targeting AI models.", "confidence": "verified" } } }, { "id": "kw-ncsc-nbcc", "jurisdiction": "Kuwait", "region": "GCC", "sector": "cross-sector", "name": "Kuwait National Basic Cybersecurity Controls (Annex 1 to NCSC Decision No. 2 of 2026)", "short": "KW NCSC NBCC", "issuer": "National Cyber Security Center (NCSC), State of Kuwait", "version": "Decision No. 2 of 2026, dated March 31, 2026; Kuwait Al-Youm issue 1785 of April 5, 2026 (gazette search index: issuer المركز الوطني للأمن السيبراني, category قرارات, title 2026/2). No later NCSC decision appears in the gazette index through issue 1814 (October 25, 2026).", "status": "In force from gazette publication (Art. 8); full compliance within 18 months of publication (Art. 7). Checked: gazette index lists issue 1785 dated 05/04/2026; Al-Rai and Al-Jarida reports of April 5, 2026. The gazette PDF needs a registered login and ncsc.gov.kw returned HTTP 403, so the text was read from a law-firm reproduction.", "public": "partial", "primary_url": "https://kuwaitalyawm.media.gov.kw/online/editions", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "The regulator's text still cannot be read: www.ncsc.gov.kw returned HTTP 403 from an Azure application gateway on 2026-10-30 (curl, browser user agent and WebFetch), cybersecurity.gov.kw does not resolve in DNS, and the gazette's browse, copy and download services are for subscribers only. Status rests on the official gazette search index, which lists four NCSC decisions since 2023 (7/2023, 35/2023, 1/2025, 2/2026) and none after 2/2026. Decision 2/2026 Art. 9 says amendments come by a later NCSC decision. The law-firm reproduction is unchanged since April 7, 2026 (dateModified), so all other cells keep their September codes and stay 'secondary'. Art. 7 gives 18 months from gazette publication for full compliance. Art. 5 lets NCSC request self-assessments and examine compliance ('وإجراء ما يلزم من فحص لمدى التزام الجهة المعنية'), which supports regulator_role 'examines'. third_party stays not_addressed: GOV-6 requires a provider inventory and shared responsibilities but no audit or test right for non-cloud providers. A reviewer could argue for assurance_only because CLD-3 covers cloud providers, which are suppliers. Arabic: the reproduction names the annex 'الضوابط الوطنية الأساسية للأمن السيبراني' (Decision Art. 6) and is signed 'رئيس المركز الوطني للأمن السيبراني'; the gazette index spells the issuer 'المركز الوطني للأمن السيبراني'. Neither is the regulator's own page, so arabic_title and regulator_arabic stay null. Verifier, 2026-10-30: third_party is now recoded to assurance_only; see changes." }, "notes": "All cells rest on a law-firm reproduction of the gazette text, so confidence is 'secondary' even where the text is clear. Annex 1 says it aligns with CIS Controls v8.1 IG1 and NIST CSF and is 'designed for Entities with limited cybersecurity resources'. Art. 6 makes the English Annex the authoritative technical text. Art. 4 says an entity also under sector rules (for example CBK CORF) must meet the stricter requirement. Kuwait al-Youm confirms issue 1785 dated 05/04/2026 but its viewer requires login. Related decisions not opened: NCSC Decision 35/2023 (National Cybersecurity Governance Framework) and Decision 1/2025 (National Data Classification Framework).", "cells": { "legal_force": { "code": "mandatory", "detail": "Entities in NCSC's remit must implement the mandatory requirements; exceptions need a documented, time-limited, risk-based approval (Art. 4). Other entities are encouraged to adopt it voluntarily.", "cite": "Decision 2/2026 Art. 4; Annex 1 §4", "url": "https://mesferlaw.com/%D8%A7%D9%84%D9%85%D8%B1%D9%83%D8%B2-%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A-%D9%84%D9%84%D8%A3%D9%85%D9%86-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A-%D9%82%D8%B1%D8%A7%D8%B1-%D8%B1%D9%82-2/", "quote": "This baseline defines the national minimum cybersecurity controls that Entities MUST implement.", "confidence": "secondary" }, "scope": { "code": "government and NCSC-remit entities", "detail": "Civil, military and security government bodies and private-sector institutions in Kuwait within NCSC's competence, plus entities NCSC designates under Decree 37/2022. Translation by Bendings.", "cite": "Decision 2/2026 Art. 1 (definition of 'concerned entities'); Art. 3; Annex 1 §3", "url": "https://mesferlaw.com/%D8%A7%D9%84%D9%85%D8%B1%D9%83%D8%B2-%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A-%D9%84%D9%84%D8%A3%D9%85%D9%86-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A-%D9%82%D8%B1%D8%A7%D8%B1-%D8%B1%D9%82-2/", "quote": "الجهات الحكومية المدنية والعسكرية والأمنية ومؤسسات القطاع الخاص داخل دولة الكويت ذات الصلة باختصاصات المركز", "confidence": "secondary" }, "frequency": { "code": "monthly scans; no pentest", "detail": "No penetration test requirement. Automated vulnerability scans monthly for internet-facing systems, quarterly for other important internal systems, and after major changes.", "cite": "Annex 1 PR-1.2", "url": "https://mesferlaw.com/%D8%A7%D9%84%D9%85%D8%B1%D9%83%D8%B2-%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A-%D9%84%D9%84%D8%A3%D9%85%D9%86-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A-%D9%82%D8%B1%D8%A7%D8%B1-%D8%B1%D9%82-2/", "quote": "Run automated vulnerability scans on key systems: at least monthly for internet-facing systems, at least quarterly for other important internal systems, and after major changes.", "confidence": "secondary" }, "threat_intel": { "code": "not_addressed", "detail": "No provision in the reproduced text.", "cite": "No provision; full text reviewed (searched: threat intelligence, penetration, test, scenario)", "url": "https://mesferlaw.com/%D8%A7%D9%84%D9%85%D8%B1%D9%83%D8%B2-%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A-%D9%84%D9%84%D8%A3%D9%85%D9%86-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A-%D9%82%D8%B1%D8%A7%D8%B1-%D8%B1%D9%82-2/", "confidence": "secondary" }, "provider_requirements": { "code": "not_addressed", "detail": "No tester rules. Cloud providers must hold independent certifications (CLD-2).", "cite": "No provision; full text reviewed (searched: tester, certif, qualif, independent, accredit)", "url": "https://mesferlaw.com/%D8%A7%D9%84%D9%85%D8%B1%D9%83%D8%B2-%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A-%D9%84%D9%84%D8%A3%D9%85%D9%86-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A-%D9%82%D8%B1%D8%A7%D8%B1-%D8%B1%D9%82-2/", "confidence": "secondary" }, "internal_testers": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: internal, external, tester, assessor)", "url": "https://mesferlaw.com/%D8%A7%D9%84%D9%85%D8%B1%D9%83%D8%B2-%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A-%D9%84%D9%84%D8%A3%D9%85%D9%86-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A-%D9%82%D8%B1%D8%A7%D8%B1-%D8%B1%D9%82-2/", "confidence": "secondary" }, "social_engineering": { "code": "not_addressed", "detail": "Annual awareness training must cover social engineering and phishing (PR-3). No simulated phishing or social engineering testing.", "cite": "No provision; full text reviewed (searched: simulat, phishing, social engineering, test)", "url": "https://mesferlaw.com/%D8%A7%D9%84%D9%85%D8%B1%D9%83%D8%B2-%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A-%D9%84%D9%84%D8%A3%D9%85%D9%86-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A-%D9%82%D8%B1%D8%A7%D8%B1-%D8%B1%D9%82-2/", "confidence": "secondary" }, "physical": { "code": "not_addressed", "detail": "PR-6 sets physical protections for critical IT areas. No testing.", "cite": "No provision; full text reviewed (searched: physical, test)", "url": "https://mesferlaw.com/%D8%A7%D9%84%D9%85%D8%B1%D9%83%D8%B2-%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A-%D9%84%D9%84%D8%A3%D9%85%D9%86-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A-%D9%82%D8%B1%D8%A7%D8%B1-%D8%B1%D9%82-2/", "confidence": "secondary" }, "third_party": { "code": "assurance_only", "detail": "Correction added by the verifier. GOV-6 counts cloud providers among the service providers an entity must govern. CLD-3 makes a contract right to audit those providers mandatory, exercised through their third-party audit reports. That is supplier assurance under the assurance_only definition. No provider system is placed inside a test. Source is the law-firm reproduction (secondary).", "cite": "Annex 1, Appendix A, CLD-3; GOV-6", "url": "https://mesferlaw.com/%D8%A7%D9%84%D9%85%D8%B1%D9%83%D8%B2-%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A-%D9%84%D9%84%D8%A3%D9%85%D9%86-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A-%D9%82%D8%B1%D8%A7%D8%B1-%D8%B1%D9%82-2/", "confidence": "secondary", "history": [ { "date": "2026-10-30", "from": "not_addressed", "to": "assurance_only", "why": "Correction added by the verifier. GOV-6 counts cloud providers among the service providers an entity must govern. CLD-3 makes a contract right to audit those providers mandatory, exercised through their third-party audit reports. That is supplier assurance under the assurance_only definition. No provider system is placed inside a test. Source is the law-firm reproduction (secondary)." } ], "quote": "Contracts MUST include a “Right to Audit. ” To protect the security of multi-tenant environments, this right is exercised by the Entity reviewing the CSP’s independent Third-Party Audit Reports (e.g., SOC 2, C5) rather than conducting physical data center visits." }, "ot": { "code": "not_addressed", "detail": "IoT/OT devices appear only in the hardware inventory control.", "cite": "No provision; full text reviewed (searched: OT, operational technology, industrial, IoT)", "url": "https://mesferlaw.com/%D8%A7%D9%84%D9%85%D8%B1%D9%83%D8%B2-%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A-%D9%84%D9%84%D8%A3%D9%85%D9%86-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A-%D9%82%D8%B1%D8%A7%D8%B1-%D8%B1%D9%82-2/", "confidence": "secondary" }, "payment_systems": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: payment, SWIFT, card)", "url": "https://mesferlaw.com/%D8%A7%D9%84%D9%85%D8%B1%D9%83%D8%B2-%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A-%D9%84%D9%84%D8%A3%D9%85%D9%86-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A-%D9%82%D8%B1%D8%A7%D8%B1-%D8%B1%D9%82-2/", "confidence": "secondary" }, "cloud_saas": { "code": "assurance_only", "detail": "Correction, not a change in the text. CLD-3 makes a right to audit the cloud provider a contract term, exercised by reviewing the provider's independent third-party audit reports. CLD-2 requires review of the provider's certifications before selection. This is assurance_only as defined in harmonize.json and as applied to CBK CORF. The harmonization pass that added assurance_only recoded only cells first coded required or permitted, so this cell was never reviewed. Cloud systems stay outside any test, and the NBCC sets no penetration test. Source is the law-firm reproduction (secondary).", "cite": "Annex 1, Appendix A, CLD-3; CLD-2", "url": "https://mesferlaw.com/%D8%A7%D9%84%D9%85%D8%B1%D9%83%D8%B2-%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A-%D9%84%D9%84%D8%A3%D9%85%D9%86-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A-%D9%82%D8%B1%D8%A7%D8%B1-%D8%B1%D9%82-2/", "confidence": "secondary", "history": [ { "date": "2026-10-30", "from": "not_addressed", "to": "assurance_only", "why": "Correction, not a change in the text. CLD-3 makes a right to audit the cloud provider a contract term, exercised by reviewing the provider's independent third-party audit reports. CLD-2 requires review of the provider's certifications before selection. This is assurance_only as defined in harmonize.json and as applied to CBK CORF. The harmonization pass that added assurance_only recoded only cells first coded required or permitted, so this cell was never reviewed. Cloud systems stay outside any test, and the NBCC sets no penetration test. Source is the law-firm reproduction (secondary)." } ], "quote": "Contracts MUST include a “Right to Audit. ” To protect the security of multi-tenant environments, this right is exercised by the Entity reviewing the CSP’s independent Third-Party Audit Reports (e.g., SOC 2, C5) rather than conducting physical data center visits." }, "cross_border": { "code": "not_addressed", "detail": "Cloud providers must be authorized in Kuwait (CLD-1) and cloud data handled per the National Data Classification Framework. Nothing on tests.", "cite": "No provision; full text reviewed (searched: cross-border, abroad, outside, foreign, residency)", "url": "https://mesferlaw.com/%D8%A7%D9%84%D9%85%D8%B1%D9%83%D8%B2-%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A-%D9%84%D9%84%D8%A3%D9%85%D9%86-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A-%D9%82%D8%B1%D8%A7%D8%B1-%D8%B1%D9%82-2/", "confidence": "secondary" }, "purple_replay": { "code": "not_addressed", "detail": "Only recovery tests and tabletop exercises (RC-2).", "cite": "No provision; full text reviewed (searched: purple, red team, exercise, replay)", "url": "https://mesferlaw.com/%D8%A7%D9%84%D9%85%D8%B1%D9%83%D8%B2-%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A-%D9%84%D9%84%D8%A3%D9%85%D9%86-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A-%D9%82%D8%B1%D8%A7%D8%B1-%D8%B1%D9%82-2/", "confidence": "secondary" }, "remediation_retest": { "code": "required", "detail": "After each scan, review, list actions and fix the most serious issues first; keep records. No deadline beyond monthly patching as an aim.", "cite": "Annex 1 PR-1.2", "url": "https://mesferlaw.com/%D8%A7%D9%84%D9%85%D8%B1%D9%83%D8%B2-%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A-%D9%84%D9%84%D8%A3%D9%85%D9%86-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A-%D9%82%D8%B1%D8%A7%D8%B1-%D8%B1%D9%82-2/", "quote": "After each scan, review the report, produce a short action list, and fix the most serious issues first (for example, high and critical findings).", "confidence": "secondary" }, "regulator_role": { "code": "examines", "detail": "NCSC supervises compliance and may request self-assessment results, reports and evidence and examine compliance. Entities self-assess at least yearly (Art. 4, GOV-5). Translation by Bendings.", "cite": "Decision 2/2026 Art. 5; Art. 4; Annex 1 GOV-5", "url": "https://mesferlaw.com/%D8%A7%D9%84%D9%85%D8%B1%D9%83%D8%B2-%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A-%D9%84%D9%84%D8%A3%D9%85%D9%86-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A-%D9%82%D8%B1%D8%A7%D8%B1-%D8%B1%D9%82-2/", "quote": "يتولى المركز الإشراف على تنفيذ هذا القرار ومتابعة مدى الالتزام به، وله في سبيل ذلك طلب نتائج التقييم الذاتي", "confidence": "secondary" }, "automated_ai": { "code": "addressed", "detail": "Automated vulnerability scanning is required. Nothing on AI.", "cite": "Annex 1 PR-1.2", "url": "https://mesferlaw.com/%D8%A7%D9%84%D9%85%D8%B1%D9%83%D8%B2-%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A-%D9%84%D9%84%D8%A3%D9%85%D9%86-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A-%D9%82%D8%B1%D8%A7%D8%B1-%D8%B1%D9%82-2/", "quote": "Run automated vulnerability scans on key systems", "confidence": "secondary" } } }, { "id": "kw-cbk-epay-cyber-min", "jurisdiction": "Kuwait", "region": "GCC", "sector": "financial", "name": "Instructions on Minimum Cybersecurity and Business Continuity Requirements for E-Payment Service Providers and E-Money Service Providers (CBK Circular No. (2/PS/527/2023))", "short": "CBK e-payment cyber minimum", "issuer": "Central Bank of Kuwait (CBK)", "version": "2023-07-05", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://www.cbk.gov.kw/en/images/epayment-chap2-152798_v120_tcm10-152798.pdf", "arabic_title": "تعليمات بشأن الحد الأدنى لمتطلبات الأمن السيبراني واستمرارية الأعمال لمقدمي خدمات الدفع الإلكتروني ومقدمي خدمات النقود الإلكترونية", "regulator_arabic": "بنك الكويت المركزي", "arabic_source_url": "https://www.cbk.gov.kw/ar/images/epayment-chap2-v1-1_v00_tcm11-171404.pdf", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Missed in September. A binding CBK instruction that sets a testing duty for payment firms: an independent comprehensive security assessment test of each product or service before launch, with all findings fixed first (Control 4). It is still listed in CBK's current e-payment circulars chapter (Arabic PDF, pp. 20 to 22 of the chapter, modified May 2026; English translation pp. 21 to 23). CORF also applies to these firms since December 3, 2025 and is stricter, so this row matters mainly as the pre-launch test rule. Board approval June 26, 2023; circular dated July 5, 2023.", "cells": { "legal_force": { "code": "mandatory", "detail": "Approved by the CBK Board on June 26, 2023 under Article 28 of the e-payment instructions, which Board decision No. (45/471/2023) issued. Sent by circular on July 5, 2023. Controls use 'shall' and 'must'. The circular is still listed in CBK's Arabic e-payment circulars chapter, last modified May 2026. CBK publishes Arabic and English texts; quotes use CBK's English text.", "cite": "Circular No. (2/PS/527/2023); Instructions, 'Instructions Controls'", "url": "https://www.cbk.gov.kw/en/images/epayment-chap2-152798_v120_tcm10-152798.pdf", "quote": "E-Payment Service Providers and E-Money Service Providers shall abide by the following:", "confidence": "verified" }, "scope": { "code": "e-payment and e-money service providers", "detail": "Current and new e-payment service providers and e-money service providers. Banks and e-payment system operators are not named. Since December 3, 2025 the same firms also fall under CBK CORF as e-payment of funds companies.", "cite": "Instructions, 'Scope of Instructions'", "url": "https://www.cbk.gov.kw/en/images/epayment-chap2-152798_v120_tcm10-152798.pdf", "quote": "These instructions apply to all E-Payment Service Providers and E-Money Service Providers, both current and newly established.", "confidence": "verified" }, "frequency": { "code": "pre-launch only", "detail": "One comprehensive security assessment test of each product or service before launch. No recurring cycle is set.", "cite": "Instructions, Control 4", "url": "https://www.cbk.gov.kw/en/images/epayment-chap2-152798_v120_tcm10-152798.pdf", "quote": "Comprehensive security assessment tests for the product/service must be conducted by a third party – and all observations in the assessment report must be addressed according to a clear plan compatible with the service provider’s risk management prior to launch of service.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "No provision in the instructions.", "cite": "No provision; full text reviewed (searched: threat, intelligence, scenario, red team)", "url": "https://www.cbk.gov.kw/en/images/epayment-chap2-152798_v120_tcm10-152798.pdf", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "The test must be run by an independent party. CBK's Arabic text reads 'من قبل طرف مستقل' (by an independent party), and the Arabic governs (R4); its English text says 'a third party'. No certification, accreditation or qualification is named.", "cite": "Control 4 in CBK's Arabic text (printed p. 22) and English text", "url": "https://www.cbk.gov.kw/ar/images/epayment-chap2-v1-1_v00_tcm11-171404.pdf", "quote": "إجراء اختبارات التقييم الأمني الشامل للمنتج/الخدمة من قبل طرف مستقل", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "CBK's Arabic Control 4 says the pre-launch test is conducted 'من قبل طرف مستقل' (by an independent party). Its English Control 4 says 'by a third party'. The Arabic Control 3 uses 'طرف ثالث' (third party) for the PCI DSS approver, so the change of term in Control 4 is in the Arabic itself. CBK does not say which text prevails, so the Arabic is coded (R4). The Arabic does not exclude an in-house team independent of the product; the English does.", "cite": "Control 4 in CBK's Arabic text (printed p. 22) and English text; Arabic Control 3", "url": "https://www.cbk.gov.kw/ar/images/epayment-chap2-v1-1_v00_tcm11-171404.pdf", "quote": "إجراء اختبارات التقييم الأمني الشامل للمنتج/الخدمة من قبل طرف مستقل", "confidence": "verified", "harmonized_from": "not_allowed", "harmonize_reason": "R4: CBK's Arabic Control 4 requires an independent party (طرف مستقل), not a third party; CBK states no prevailing language, so the Arabic governs and 'independent party' is coded as NCSA NIA SS 7." }, "social_engineering": { "code": "not_addressed", "detail": "No provision in the instructions.", "cite": "No provision; full text reviewed (searched: social engineering, phishing, awareness, simulat)", "url": "https://www.cbk.gov.kw/en/images/epayment-chap2-152798_v120_tcm10-152798.pdf", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "No provision in the instructions.", "cite": "No provision; full text reviewed (searched: physical, premises, site, facility)", "url": "https://www.cbk.gov.kw/en/images/epayment-chap2-152798_v120_tcm10-152798.pdf", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "'Third party' appears only as the tester (Control 4) and as the PCI DSS approver (Control 3). Suppliers are not mentioned.", "cite": "No provision; full text reviewed (searched: outsourc, service provider, supplier, vendor, third party)", "url": "https://www.cbk.gov.kw/en/images/epayment-chap2-152798_v120_tcm10-152798.pdf", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No provision in the instructions.", "cite": "No provision; full text reviewed (searched: OT, operational technology, IoT, industrial)", "url": "https://www.cbk.gov.kw/en/images/epayment-chap2-152798_v120_tcm10-152798.pdf", "confidence": "verified" }, "payment_systems": { "code": "required", "detail": "The test covers the e-payment or e-money product or service itself. Firms that store or process bank card data must also hold PCI DSS certification approved by a third party and renewed regularly (Control 3).", "cite": "Instructions, Controls 3 and 4", "url": "https://www.cbk.gov.kw/en/images/epayment-chap2-152798_v120_tcm10-152798.pdf", "quote": "Comprehensive security assessment tests for the product/service must be conducted by a third party", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "No provision in the instructions.", "cite": "No provision; full text reviewed (searched: cloud, hosting, SaaS, data center)", "url": "https://www.cbk.gov.kw/en/images/epayment-chap2-152798_v120_tcm10-152798.pdf", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "No provision. Circular No. (2/PS/528/2023) of the same date covers operating outside Kuwait and has no testing text.", "cite": "No provision; full text reviewed (searched: outside Kuwait, foreign, cross-border, abroad)", "url": "https://www.cbk.gov.kw/en/images/epayment-chap2-152798_v120_tcm10-152798.pdf", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No provision in the instructions.", "cite": "No provision; full text reviewed (searched: purple, replay, red team, exercise)", "url": "https://www.cbk.gov.kw/en/images/epayment-chap2-152798_v120_tcm10-152798.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Every finding in the assessment report must be addressed under a clear plan before the service launches. No retest is named.", "cite": "Instructions, Control 4", "url": "https://www.cbk.gov.kw/en/images/epayment-chap2-152798_v120_tcm10-152798.pdf", "quote": "all observations in the assessment report must be addressed according to a clear plan compatible with the service provider’s risk management prior to launch of service.", "confidence": "verified" }, "regulator_role": { "code": "not_addressed", "detail": "The text does not send test results to CBK. CBK must be notified only if PCI DSS certification is revoked or not renewed (Control 3).", "cite": "No provision; full text reviewed (searched: CBK, report, submit, notify)", "url": "https://www.cbk.gov.kw/en/images/epayment-chap2-152798_v120_tcm10-152798.pdf", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "No provision in the instructions.", "cite": "No provision; full text reviewed (searched: automat, continuous, artificial intelligence, AI, machine learning)", "url": "https://www.cbk.gov.kw/en/images/epayment-chap2-152798_v120_tcm10-152798.pdf", "confidence": "verified" } } }, { "id": "om-cbo-csrf", "jurisdiction": "Oman", "region": "GCC", "sector": "financial", "name": "Cyber Security & Resilience Framework (CS&RF)", "short": "CBO CS&RF", "issuer": "Central Bank of Oman (CBO)", "version": "Version 1.0, enclosed with Circular BM 1194 dated July 31, 2023; full compliance due July 31, 2024. The PDF is byte-identical to the 2026-09-28 snapshot (SHA-256 dd1b482fabae9c8e7ef49a57c3ad899e8a57e6054e8d50ded75f26ba2e13966b).", "status": "In force as of 2026-09-28 as far as public sources show: still linked as 'Cybersecurity & Resilience Framework' from the CBO Policies page. No later version or amending circular found on cbo.gov.om or by web search.", "public": "full", "primary_url": "https://cbo.gov.om/sites/assets/FintechCompulsoryDocs/Cyber%20Security%20&%20Resilience%20Framework%20(CS&RF).pdf", "regulator_arabic": "البنك المركزي العُماني", "arabic_source_url": "https://cbo.gov.om/ar/pages/OpenBanking.aspx", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No cell changes. One metadata correction: September recorded no version or date. The covering circular BM 1194 of July 31, 2023 names the enclosure 'Cyber Security and Resilience Framework (CS&RF), Version. 1.0' (https://cbo.gov.om/sites/assets/Documents/English/Circulars/2023/2023-07-31%20%20BM%201194%20-%20Cyber%20Security%20%26%20Resilience%20Framework.pdf). The CBO Policies page still lists the framework as plain text. Two 2026 circulars sit beside it without amending it: BM 1225 (January 6, 2026) adds TLPT or red teaming of critical systems every three years for banks and finance and leasing companies, coded as om-cbo-bcm-framework; BM 1234 (October 11, 2026, in force January 1, 2027) replaces the 2011 outsourcing circular and sets no security testing duty. No Arabic title for the CS&RF was found on cbo.gov.om; the Arabic circulars list for 2023 shows three items and omits BM 1194. The Arabic regulator name is from the footer of CBO's Arabic pages." }, "notes": "The PDF is an 80-page image scan; text was OCR'd by Bendings and the quoted passages were checked against page images (for example PDF page 34, printed page 33, for §3.3.11). The document path is under 'FintechCompulsoryDocs' on cbo.gov.om and downloads without login. The external audit dates (2024) in §3.6.3 are one-off; the text sets no recurring audit cycle. Oman's Capital Market Authority (securities, insurance) was not reviewed.", "cells": { "legal_force": { "code": "mandatory", "detail": "Issued under Banking Law 114/2000 and National Payment Systems Law 8/2018. Implementation deadline July 31, 2024; controls not applied need a CBO waiver (§2.2). Controls use 'should', but the text calls them mandated.", "cite": "§1.1; §1.3; §2.2", "url": "https://cbo.gov.om/sites/assets/FintechCompulsoryDocs/Cyber%20Security%20&%20Resilience%20Framework%20(CS&RF).pdf", "quote": "All licensed institutions that are regulated by CBO will be required to adopt these minimum standards for addressing cyber risks/threats.", "confidence": "verified" }, "scope": { "code": "banks, FLCs, exchanges, PSPs", "detail": "All banks in Oman and their foreign branches, finance and leasing companies, money exchange companies and payment service providers. Foreign banks give CBO a letter of comfort.", "cite": "§1.4", "url": "https://cbo.gov.om/sites/assets/FintechCompulsoryDocs/Cyber%20Security%20&%20Resilience%20Framework%20(CS&RF).pdf", "quote": "All Banks operating in the Sultanate of Oman and their foreign branches.", "confidence": "verified" }, "frequency": { "code": "annual (internet-facing)", "detail": "Penetration test frequency is risk-based; internet-facing systems at least annually or on significant change. No red team requirement.", "cite": "§3.3.11 Controlling Measure 2", "url": "https://cbo.gov.om/sites/assets/FintechCompulsoryDocs/Cyber%20Security%20&%20Resilience%20Framework%20(CS&RF).pdf", "quote": "For the internet facing systems, penetration testing should be conducted at least annually or whenever there are significant changes to the systems or update.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "§3.3.12 requires a threat intelligence process that feeds risk management, but nothing links it to test design.", "cite": "No provision; full text reviewed (searched: threat intelligence, scenario, penetration, red team)", "url": "https://cbo.gov.om/sites/assets/FintechCompulsoryDocs/Cyber%20Security%20&%20Resilience%20Framework%20(CS&RF).pdf", "confidence": "verified" }, "provider_requirements": { "code": "recommended", "detail": "No tester qualification or accreditation. An annual third-party cyber security assessment is listed among project management controls that 'should be considered'.", "cite": "§3.1.6 Controlling Measure 5", "url": "https://cbo.gov.om/sites/assets/FintechCompulsoryDocs/Cyber%20Security%20&%20Resilience%20Framework%20(CS&RF).pdf", "quote": "Ensure a that a third-party cyber security assessment is conducted at least annually.", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "No rule on who performs penetration tests.", "cite": "No provision; full text reviewed (searched: internal, external, independent, tester, third-party assessment)", "url": "https://cbo.gov.om/sites/assets/FintechCompulsoryDocs/Cyber%20Security%20&%20Resilience%20Framework%20(CS&RF).pdf", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "A baseline phishing campaign is listed among steps the institution 'should consider' for its awareness program.", "cite": "§3.1.5 (a)", "url": "https://cbo.gov.om/sites/assets/FintechCompulsoryDocs/Cyber%20Security%20&%20Resilience%20Framework%20(CS&RF).pdf", "quote": "Understand the business context and conduct an initial baseline phishing campaign.", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "§3.3.3 sets physical security controls with no testing.", "cite": "No provision; full text reviewed (searched: physical, test, premises)", "url": "https://cbo.gov.om/sites/assets/FintechCompulsoryDocs/Cyber%20Security%20&%20Resilience%20Framework%20(CS&RF).pdf", "confidence": "verified" }, "third_party": { "code": "assurance_only", "detail": "Cloud agreements must give the institution audit, examination and review rights at the provider, including cyber security audits and access to the provider's VA&PT reports. Outsourcing agreements must allow audit by the institution and inspection by CBO (§3.4.3). No rule puts providers in the institution's own test scope.", "cite": "§3.4.2 Controlling Measure 12(k); §3.4.3", "url": "https://cbo.gov.om/sites/assets/FintechCompulsoryDocs/Cyber%20Security%20&%20Resilience%20Framework%20(CS&RF).pdf", "quote": "The audit, examination and review rights of the licensed institution at CPS including conducting cyber-security and/or forensic audits, access to reports of third-party audits and Vulnerability Assessment and Penetration Testing (VA&PT).", "confidence": "verified", "harmonized_from": "permitted", "harmonize_reason": "§ 3.4.2(12)(k), § 3.4.3 audit rights and access to the provider's own VA&PT reports." }, "ot": { "code": "not_addressed", "detail": "Scope includes ATMs, CDMs and POS devices (§1.3) but nothing on OT testing.", "cite": "No provision; full text reviewed (searched: operational technology, OT, industrial, SCADA)", "url": "https://cbo.gov.om/sites/assets/FintechCompulsoryDocs/Cyber%20Security%20&%20Resilience%20Framework%20(CS&RF).pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "§3.5.1 covers payment system controls (fraud monitoring, encryption) with no testing. §3.6.2 requires compliance with SWIFT CSP and PCI DSS where applicable.", "cite": "No provision; full text reviewed (searched: payment, SWIFT, card, PCI, test)", "url": "https://cbo.gov.om/sites/assets/FintechCompulsoryDocs/Cyber%20Security%20&%20Resilience%20Framework%20(CS&RF).pdf", "confidence": "verified" }, "cloud_saas": { "code": "assurance_only", "detail": "Due diligence on a cloud provider must confirm the efficacy of its vulnerability assessment and penetration testing, and agreements must give access to its VA&PT reports (12(k)). This covers the provider's own tests, not tests by the institution.", "cite": "§3.4.2 Controlling Measures 6 and 12(k)", "url": "https://cbo.gov.om/sites/assets/FintechCompulsoryDocs/Cyber%20Security%20&%20Resilience%20Framework%20(CS&RF).pdf", "quote": "robustness of information security processes including cyber-security framework and efficacy of Vulnerability Assessment/Penetration testing)", "confidence": "verified", "harmonized_from": "required", "harmonize_reason": "§ 3.4.2 Measures 6 and 12(k) cover the cloud provider's own tests, not tests by the institution." }, "cross_border": { "code": "addressed", "detail": "Foreign branches of Omani banks are in scope (§1.4), so the framework's testing duties reach them. Material arrangements with global cloud providers need prior CBO approval, including the data storage location (§3.4.2 Measure 8(f)), a data location rule that would not count alone. Nothing on multi-jurisdiction tests.", "cite": "§1.4; §3.4.2 Controlling Measure 8", "url": "https://cbo.gov.om/sites/assets/FintechCompulsoryDocs/Cyber%20Security%20&%20Resilience%20Framework%20(CS&RF).pdf", "quote": "All Banks operating in the Sultanate of Oman and their foreign branches.", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "§3.3.11 Measure 5 asks for regular scenario-based cyber simulation exercises. No purple teaming or replay.", "cite": "No provision; full text reviewed (searched: purple, red team, replay, simulation)", "url": "https://cbo.gov.om/sites/assets/FintechCompulsoryDocs/Cyber%20Security%20&%20Resilience%20Framework%20(CS&RF).pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Remediation processes and validation of fixes. VA&PT findings go to the IT and Risk Management committee (Measure 4). No deadline.", "cite": "§3.3.11 Controlling Measures 3 and 4", "url": "https://cbo.gov.om/sites/assets/FintechCompulsoryDocs/Cyber%20Security%20&%20Resilience%20Framework%20(CS&RF).pdf", "quote": "The licensed institutions should establish processes for vulnerabilities remediation that have been identified in the Vulnerability Assessment & Penetration Testing (VA&PT) and to conduct validation of the remediated vulnerabilities to assess and ensure that gaps are fully addressed.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "Test results stay internal. CBO received an external audit of CS&RF implementation by December 31, 2024 and has inspection rights over outsourced services (§3.4.3).", "cite": "§3.6.3 (Control Measures for External Audit); §3.4.3", "url": "https://cbo.gov.om/sites/assets/FintechCompulsoryDocs/Cyber%20Security%20&%20Resilience%20Framework%20(CS&RF).pdf", "quote": "The licensed institutions should ensure that the CS&RF implemented by the licensed institutions is subjected to external audit, on or before September 30, 2024, and the audit report and the action taken thereon are forwarded to CBO by December 31, 2024.", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "The maturity model mentions automation of cyber security processes in general. Nothing on automated or AI-driven testing or testing AI.", "cite": "No provision; full text reviewed (searched: automat, artificial intelligence, AI, machine learning)", "url": "https://cbo.gov.om/sites/assets/FintechCompulsoryDocs/Cyber%20Security%20&%20Resilience%20Framework%20(CS&RF).pdf", "confidence": "verified" } } }, { "id": "om-mtcit-gov-security-assessment", "jurisdiction": "Oman", "region": "GCC", "sector": "government", "name": "Ministerial Circular No. (11/2022) on security assessment of government websites, portals, service windows and electronic applications, with the Security Assessment Services Standard (GC_S1)", "short": "MTCIT gov sec assess", "issuer": "Ministry of Transport, Communications and Information Technology (MTCIT), Oman", "version": "Circular 11/2022 dated July 25, 2022; GC_S1 Version 1.0, August 2019. Both files are byte-identical to the 2026-09-28 snapshot (SHA-256 a2b242d5... and d8652fdb...).", "status": "Both listed in the MTCIT online library on 2026-09-28 (circular under Circulars, standard under Standards). No later circular on security assessment found in the MTCIT circulars list (latest items: 7/2025 managed services, 113/2025 data governance).", "public": "full", "primary_url": "https://mtcit.gov.om/web/content/mtcit.content/827/attachment?download=True", "arabic_title": "حول ضرورة التقيد بإجراء التقييم الامني للمواقع، البوابات، نوافذ الخدمات، و التطبيقات الالكترونية الحكومية", "regulator_arabic": "وزارة النقل والاتصالات وتقنية المعلومات", "arabic_source_url": "https://mtcit.gov.om/ar/3/7/66/827", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No cell changes. GC_S1's Arabic title is 'معيار خدمات التقييم الأمني' (https://mtcit.gov.om/ar/3/7/64/264). The MTCIT standards and guidelines lists match the September captures. The circulars list now shows 2026 items (1/2026, 4/2026, 5/2026, 10/2026, 16/2026); none sets a security testing duty. Two related MTCIT circulars are coded separately because they do not amend 11/2022 or GC_S1: 19/2023 (government mobile apps) requires the pre-launch security assessment to go through an accredited company, and 7/2025 (managed services) requires providers to run periodic assessments and penetration tests. For mobile apps, 19/2023 therefore rules out in-house assessment, while this row's internal_testers cell stays not_addressed because 11/2022 and GC_S1 alone are silent. Circular 4/2019 (Information Security Management Policy), cited by 19/2023, was not found on mtcit.gov.om." }, "notes": "Circular 11/2022 restates earlier circulars (3/2015 General Information Security Policy; 3/2016 and 1/2017 on security assessment; 2/2018 on security assessment; 9/2020 on the accreditation program for security assessment providers). Those earlier circulars and the MTC 'Basic Security Controls' guideline referenced in GC_S1 were not opened. GC_S1 names the ministry 'Ministry of Technology and Communications' (MTC), the pre-2020 name. The circular is an Arabic image scan; Bendings transcribed it.", "cells": { "legal_force": { "code": "mandatory", "detail": "Ministerial circular to all units of the State Administrative Apparatus, which it directs to comply. Translation by Bendings.", "cite": "Circular 11/2022, p. 1", "url": "https://mtcit.gov.om/web/content/mtcit.content/827/attachment?download=True", "quote": "تلفت هذه الوزارة عناية جميع وحدات الجهاز الإداري للدولة الإلتزام بما يلي", "confidence": "verified" }, "scope": { "code": "state admin units, internet-facing", "detail": "Government websites, portals, service windows, platforms and electronic applications connected to the internet. GC_S1 covers providers serving government units and CNI organizations.", "cite": "Circular 11/2022, p. 1, first bullet; GC_S1 'Audience'", "url": "https://mtcit.gov.om/web/content/mtcit.content/827/attachment?download=True", "quote": "القيام بإجراءات التقييم الأمني قبل تدشين المواقع، البوابات، النوافذ، المنصات، والتطبيقات (الأنظمة) الإلكترونية الحكومية المرتبطة بالإنترنت", "confidence": "verified" }, "frequency": { "code": "every 1 to 2 years", "detail": "Before launch, then every one or two years, and on any addition or change. 'Security assessment' covers penetration testing and technical assessments (GC_S1 §3). Translation by Bendings.", "cite": "Circular 11/2022, p. 1, second bullet", "url": "https://mtcit.gov.om/web/content/mtcit.content/827/attachment?download=True", "quote": "القيام بإجراءات التقييم الامني بشكل دوري (كل سنة أو سنتين) أو عند القيام بأي إضافة أو تعديل", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "No provision in the circular or GC_S1.", "cite": "No provision; full text reviewed (searched: threat intelligence, threat, scenario)", "url": "https://mtcit.gov.om/web/content/mtcit.content/264/attachment?download=True", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "GC_S1 sets the provider rules: ISO 27001, 12 months of service history, security clearance for the firm and team, lead assessor evidence, and a listed certification for each assessor (for example CREST, OSCP, GPEN, CEH), with accreditation for three years and an annual review (§8). From August 9, 2026 the Cyber Defence Centre runs this accreditation in place of MTCIT (Ministerial Circular No. (15/2026) of August 23, 2026). The circular does not say whether CDC keeps the GC_S1 criteria.", "cite": "GC_S1 §1, §2, §5.4 A, §8; Ministerial Circular No. (15/2026), para. 2 (https://mtcit.gov.om/web/content/62889?unique=1dcefe284fabea308f17a81383f6e2360165eaba)", "url": "https://mtcit.gov.om/web/content/mtcit.content/264/attachment?download=True", "quote": "The assessor(s) must possess at least one of the certifications in the table below for each level and area of assessment.", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Neither document says whether a government unit may test itself. GC_S1 Appendix A has the unit 'select an independent 3rd party assessor'.", "cite": "No provision; full text reviewed (searched: internal, in-house, independent, third party)", "url": "https://mtcit.gov.om/web/content/mtcit.content/264/attachment?download=True", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "GC_S1 covers penetration testing and technical assessments only (§3).", "cite": "No provision; full text reviewed (searched: social engineering, phishing)", "url": "https://mtcit.gov.om/web/content/mtcit.content/264/attachment?download=True", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "GC_S1 §5.1 lists physical security as a knowledge area for assessors but does not put physical testing in scope.", "cite": "No provision; full text reviewed (searched: physical, premises)", "url": "https://mtcit.gov.om/web/content/mtcit.content/264/attachment?download=True", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "No provision on testing suppliers.", "cite": "No provision; full text reviewed (searched: third party, supplier, vendor)", "url": "https://mtcit.gov.om/web/content/mtcit.content/827/attachment?download=True", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: OT, operational technology, industrial, SCADA)", "url": "https://mtcit.gov.om/web/content/mtcit.content/264/attachment?download=True", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: payment, card, SWIFT)", "url": "https://mtcit.gov.om/web/content/mtcit.content/264/attachment?download=True", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "The circular's third bullet requires units hosting systems with MTCIT-accredited cloud providers to request data protection. It does not address testing cloud-hosted systems.", "cite": "No provision; full text reviewed (searched: cloud, hosting)", "url": "https://mtcit.gov.om/web/content/mtcit.content/827/attachment?download=True", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "Assessors should be physically present at the government premises and should not use remote access unless asked. Providers and team members need national security clearance (§2). This limits offshore testing.", "cite": "GC_S1 §4.1; §2", "url": "https://mtcit.gov.om/web/content/mtcit.content/264/attachment?download=True", "quote": "Remote Access should not be used for conducting the security assessment unless specifically requested by the requesting organisation", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: purple, red team, replay, workshop)", "url": "https://mtcit.gov.om/web/content/mtcit.content/264/attachment?download=True", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Findings must be fixed before launch, and periodic assessments must confirm all vulnerabilities are remediated. No deadline or retest rule. Translation by Bendings.", "cite": "Circular 11/2022, p. 1, first and second bullets", "url": "https://mtcit.gov.om/web/content/mtcit.content/827/attachment?download=True", "quote": "ومعالجة الملاحظات الفنية (إن وجدت) قبل التدشين", "confidence": "verified" }, "regulator_role": { "code": "not_addressed", "detail": "Neither document requires results to go to MTCIT. MTCIT accredited providers and reviewed them yearly under GC_S1 §8; from August 9, 2026 the Cyber Defence Centre runs that accreditation (Ministerial Circular No. (15/2026)). No text sends test results to either body.", "cite": "No provision; full text reviewed (searched: report to, submit, Ministry, MTC); Ministerial Circular No. (15/2026) (https://mtcit.gov.om/web/content/62889?unique=1dcefe284fabea308f17a81383f6e2360165eaba)", "url": "https://mtcit.gov.om/web/content/mtcit.content/264/attachment?download=True", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Providers must not let automated tools cause missed vulnerabilities and must analyse automated tool findings (§6.1). Nothing on AI.", "cite": "GC_S1 §4.1; §6.1", "url": "https://mtcit.gov.om/web/content/mtcit.content/264/attachment?download=True", "quote": "The service providers are responsible to ensure that technical controls are thoroughly checked to ensure that existing vulnerabilities on the given scope are not overlooked, especially when using an automated tool.", "confidence": "verified" } } }, { "id": "om-cbo-bcm-framework", "jurisdiction": "Oman", "region": "GCC", "sector": "financial", "name": "Business Continuity Management Framework (Annexure to Circular BM 1225 of 6 January 2026)", "short": "CBO BCM framework", "issuer": "Central Bank of Oman (CBO)", "version": "2026-01-06", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2025/2026-01-06%20%20BM%201225%20-%20Annexure%20-%20Business%20Continuity%20Management%20Framework.pdf", "arabic_title": "ب.م 1225 - الإطار التنظيمي لإدارة استمرارية الأعمال", "regulator_arabic": "البنك المركزي العُماني", "arabic_source_url": "https://cbo.gov.om/ar/Pages/Circulars.aspx", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Sets a threat-led penetration testing or red team duty for critical systems at banks and finance and leasing companies, at least every three years. Issued January 6, 2026; not in the September coding. The framework cites the CS&RF as issued under Circular BM 1194.", "cells": { "legal_force": { "code": "mixed", "detail": "A CBO circular to all banks and finance and leasing companies, with a deadline of June 30, 2026 to finalize a BCM framework. The cover calls it supervisory guidance and expectations. The TLPT clause uses 'shall'; many other clauses use 'should'.", "cite": "Circular BM 1225, para. 6 and 7; Annexure §6.4.5(iii)(c)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2025/2026-01-06%20%20BM%201225%20-%20Annexure%20-%20Business%20Continuity%20Management%20Framework.pdf", "quote": "to provide supervisory guidance and set clear expectations regarding the establishment, implementation, and ongoing maintenance of effective business continuity capabilities in licensed institutions.", "confidence": "verified" }, "scope": { "code": "banks and FLCs, incl. foreign branches", "detail": "All licensed domestic banks and finance and leasing companies, with their subsidiaries, foreign branches and representative offices, plus foreign banks' overseas entities that serve their Oman branches. Payment service providers and money exchanges are not named.", "cite": "Annexure §2.1; §2.2", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2025/2026-01-06%20%20BM%201225%20-%20Annexure%20-%20Business%20Continuity%20Management%20Framework.pdf", "quote": "This framework is applicable to all licensed domestic banks and FLCs including their subsidiaries, foreign branches and representative offices.", "confidence": "verified" }, "frequency": { "code": "every 3 years (TLPT of critical systems)", "detail": "Critical systems need TLPT or an equivalent red team exercise at least once every three years. BCP and DR tests are annual (§9.3.1). The text does not define critical systems or say when the first TLPT is due.", "cite": "Annexure §6.4.5(iii)(c)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2025/2026-01-06%20%20BM%201225%20-%20Annexure%20-%20Business%20Continuity%20Management%20Framework.pdf", "quote": "Critical systems shall undergo Threat-Led Penetration Testing (TLPT) or equivalent red-team exercises at least once every three years.", "confidence": "verified" }, "threat_intel": { "code": "required", "detail": "The test is threat-led by name, and the glossary defines a red team exercise as intelligence-led. The text does not say who supplies the threat intelligence or how scenarios are chosen.", "cite": "Annexure §6.4.5(iii)(c); Glossary, 'Red-Team Exercise'", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2025/2026-01-06%20%20BM%201225%20-%20Annexure%20-%20Business%20Continuity%20Management%20Framework.pdf", "quote": "A controlled, intelligence-led simulation of sophisticated cyberattacks conducted by authorized testers to assess the institution’s ability to detect, respond to, and recover from real-world threats, in accordance with recognized standards.", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "No accreditation, certification or independence rule for TLPT or red team providers. The glossary says only 'authorized testers' working to 'recognized standards'.", "cite": "No provision; full text reviewed (searched: certif, accredit, qualif, independent, provider, tester)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2025/2026-01-06%20%20BM%201225%20-%20Annexure%20-%20Business%20Continuity%20Management%20Framework.pdf", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Silent on whether in-house teams may run the TLPT.", "cite": "No provision; full text reviewed (searched: internal, in-house, external, independent, tester)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2025/2026-01-06%20%20BM%201225%20-%20Annexure%20-%20Business%20Continuity%20Management%20Framework.pdf", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "Phishing appears only as a threat (§8.6.3). No social engineering testing.", "cite": "No provision; full text reviewed (searched: social engineering, social, phishing)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2025/2026-01-06%20%20BM%201225%20-%20Annexure%20-%20Business%20Continuity%20Management%20Framework.pdf", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Physical items concern alternate sites and redundancy for continuity, not intrusion testing.", "cite": "No provision; full text reviewed (searched: physical, premises, site)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2025/2026-01-06%20%20BM%201225%20-%20Annexure%20-%20Business%20Continuity%20Management%20Framework.pdf", "confidence": "verified" }, "third_party": { "code": "assurance_only", "detail": "The framework covers outsourced activities (§2.3). BCM strategy tests must include third-party service providers, and critical providers must have tested continuity plans (§8.11.5). The text does not say whether TLPT must cover supplier-run critical systems.", "cite": "Annexure §2.3; §6.4.5(iv)(a); §8.11.5", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2025/2026-01-06%20%20BM%201225%20-%20Annexure%20-%20Business%20Continuity%20Management%20Framework.pdf", "quote": "The effectiveness of the BCM Strategy shall be verified through integrated testing (business, IT, third-party service providers).", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: operational technology, OT, industrial, SCADA)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2025/2026-01-06%20%20BM%201225%20-%20Annexure%20-%20Business%20Continuity%20Management%20Framework.pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "BCP tests should use scenarios such as disruption of payment and settlement systems (§9.1.1(i)). That is a continuity test, not a security test. The TLPT clause does not name payment systems.", "cite": "No provision; full text reviewed (searched: payment, settlement, SWIFT, card)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2025/2026-01-06%20%20BM%201225%20-%20Annexure%20-%20Business%20Continuity%20Management%20Framework.pdf", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "§8.6.2 notes reliance on cloud providers. No cloud testing rule.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, hosting)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2025/2026-01-06%20%20BM%201225%20-%20Annexure%20-%20Business%20Continuity%20Management%20Framework.pdf", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "Foreign branches of Omani banks and foreign banks' overseas entities that serve Oman branches are in scope. Nothing on multi-jurisdiction or mutually recognized tests.", "cite": "Annexure §2.1; §2.2", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2025/2026-01-06%20%20BM%201225%20-%20Annexure%20-%20Business%20Continuity%20Management%20Framework.pdf", "quote": "Licensed foreign banks and their overseas entities who provide the services to the foreign branches operating in the Sultanate of Oman.", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "TLPT results must inform recovery architecture and incident response procedures (§6.4.5(iii)(d)). No purple teaming or replay.", "cite": "No provision; full text reviewed (searched: purple, replay, workshop, blue team)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2025/2026-01-06%20%20BM%201225%20-%20Annexure%20-%20Business%20Continuity%20Management%20Framework.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Gaps found in tests must be fixed within agreed timelines and retested. TLPT results must feed recovery architecture and incident response. Failed BCP tests are retested within three months (§9.2.2).", "cite": "Annexure §6.4.5(iii)(d); §6.4.5(iv)(b); §9.2.2", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2025/2026-01-06%20%20BM%201225%20-%20Annexure%20-%20Business%20Continuity%20Management%20Framework.pdf", "quote": "Gaps identified during tests shall be addressed within agreed remediation timelines and re-tested for closure.", "confidence": "verified" }, "regulator_role": { "code": "not_addressed", "detail": "Business continuity and disaster recovery test reports go to the CBO Surveillance Department within six weeks, and action plans within three months. These are not security test results. The text does not say whether TLPT reports go to CBO.", "cite": "No provision sending security test results to CBO; Annexure §6.4.5(iii)(c), §9.3.1 and §12.1.5 considered", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2025/2026-01-06%20%20BM%201225%20-%20Annexure%20-%20Business%20Continuity%20Management%20Framework.pdf", "confidence": "verified", "harmonized_from": "receives_results", "harmonize_reason": "R7: The reports CBO receives are business continuity and disaster recovery test reports, not security test results; R8 sets the same reading for continuity tests on payment systems." }, "automated_ai": { "code": "not_addressed", "detail": "§8.6.1 mentions automation only as a source of exposure. Nothing on automated testing or testing AI.", "cite": "No provision; full text reviewed (searched: automat, artificial intelligence, AI, machine learning)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2025/2026-01-06%20%20BM%201225%20-%20Annexure%20-%20Business%20Continuity%20Management%20Framework.pdf", "confidence": "verified" } } }, { "id": "om-cbo-open-banking", "jurisdiction": "Oman", "region": "GCC", "sector": "financial", "name": "Open Banking Regulatory Framework, with Annexure 3 Open Banking Data and Information Security Specification (issued with Circular BM 1219 of 4 June 2025)", "short": "CBO open banking framework", "issuer": "Central Bank of Oman (CBO)", "version": "2025-06-04", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Open%20Bank_Oman.pdf", "arabic_title": "الإطار التنظيمي للصيرفة المفتوحة", "regulator_arabic": "البنك المركزي العُماني", "arabic_source_url": "https://cbo.gov.om/ar/pages/OpenBanking.aspx", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Requires periodic penetration testing of the web applications and APIs behind open banking payment and account services, and a penetration test report at licensing. Issued with Circular BM 1219 of June 4, 2025; not in the September coding.", "cells": { "legal_force": { "code": "mandatory", "detail": "Applicants must meet Annexure 3 to get a license, and licensees must keep meeting it. Its vulnerability management bullets sit under 'Organizations are required to adopt the following practices'.", "cite": "§5; Annexure 3 §13.3.1(d)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Open%20Bank_Oman.pdf", "quote": "The provisions in Annexure [3] on [Open Banking Data and Information Security Specification] shall be complied with by the Applicant for obtaining of License.", "confidence": "verified" }, "scope": { "code": "open banking providers; Annexure 3 all participants", "detail": "Licensing covers account information and payment initiation service providers. Annexure 3 says its controls apply to all open banking participants, which include banks as API providers.", "cite": "§1.1.1; Annexure 3 §13.2", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Open%20Bank_Oman.pdf", "quote": "establish a standardized and a clear set of actionable security controls applicable to all participants involved within Oman's Open Banking ecosystem.", "confidence": "verified" }, "frequency": { "code": "periodic, before go-live and on change", "detail": "No interval. Security testing is periodic, on significant change, and before new deployments go live. A penetration test and vulnerability assessment report is part of the license application (§2.5.9(m)).", "cite": "Annexure 3 §13.3.1(d)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Open%20Bank_Oman.pdf", "quote": "Security assessment activities such as vulnerability assessment, baseline security configuration reviews, application security testing, penetration testing and source code reviews of network, systems and applications shall be conducted on periodic basis or whenever significant changes occur to the environment", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Penetration tests should consider 'methods and tools employed by attackers' (Annexure 3 §13.3.1(d)), and Annexure 3 recommends consulting threat intelligence among other sources for the latest security guidance (§13.1). Neither ties test scenarios or scope to threat intelligence about who targets the firm. Coded as FSA E/1/2022 ('replicate current attacks') and NCA CSCC-2.", "cite": "No provision tying tests to threat intelligence; Annexure 3 §13.1 and §13.3.1(d) considered", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Open%20Bank_Oman.pdf", "confidence": "verified", "harmonized_from": "recommended", "harmonize_reason": "R5: Annexure 3 §13.3.1(d) asks tests to consider attackers' methods in general and §13.1 points to threat intelligence for security guidance, not for tests; coded as FSA E/1/2022 'replicate current attacks'." }, "provider_requirements": { "code": "not_addressed", "detail": "No tester qualification rule. The license application needs a risk assessment by an independent third-party expert (§2.5.9(f)), which is not a security test.", "cite": "No provision; full text reviewed (searched: certif, accredit, qualif, independent, tester)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Open%20Bank_Oman.pdf", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Silent on who runs penetration tests.", "cite": "No provision; full text reviewed (searched: internal, in-house, external, independent)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Open%20Bank_Oman.pdf", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: social engineering, phishing)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Open%20Bank_Oman.pdf", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Physical items concern disaster recovery redundancy only.", "cite": "No provision; full text reviewed (searched: physical, premises)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Open%20Bank_Oman.pdf", "confidence": "verified" }, "third_party": { "code": "assurance_only", "detail": "Outsourcing agreements must give CBO, external auditors and internal audit unrestricted access to the provider's information on the outsourced activity. No rule puts providers in the licensee's test scope.", "cite": "§6.7.4", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Open%20Bank_Oman.pdf", "quote": "the SLA shall allow the Central Bank, external auditors, and the Licensee's internal audit and compliance officer unrestricted access to all relevant information and documents held by the outsourcing service provider concerning the outsourced activities.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: operational technology, OT, industrial, SCADA)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Open%20Bank_Oman.pdf", "confidence": "verified" }, "payment_systems": { "code": "required", "detail": "The tested systems are the web applications and APIs behind payment initiation and account information services. Open APIs must also go through penetration and security testing (Annexure 2 §12.4(b)(iv)).", "cite": "Annexure 3 §13.3.1(d); Annexure 2 §12.4(b)(iv)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Open%20Bank_Oman.pdf", "quote": "Regular Penetration testing should be conducted covering the critical web applications and API infrastructure serving the open banking services.", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "No cloud testing rule.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, hosting)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Open%20Bank_Oman.pdf", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "Customer data may leave Oman only with CBO approval (§3.9.1), outsourcing within or outside Oman must be notified (§6.7.2), and cross-border outsourcing must not impede CBO supervision (§6.7.5). These are data transfer and outsourcing conditions. A licensee must keep an operational office in Oman with at least two key personnel ordinarily residing there (§2.3.3), a local presence rule that does not limit where others with system access sit. Nothing reaches foreign entities, sets cross-border tests or limits where testers sit.", "cite": "No cross-border testing provision under R1; §2.3.3, §3.9.1, §6.7.2 and §6.7.5 considered", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Open%20Bank_Oman.pdf", "confidence": "verified", "harmonized_from": "addressed", "harmonize_reason": "R1: §3.9.1 (approval to move customer data abroad) and §6.7.5 (cross-border outsourcing must not impede supervision) are data transfer and outsourcing conditions, which R1 does not count." }, "purple_replay": { "code": "not_addressed", "detail": "Annual cyber incident drills test incident response (Annexure 3 §13.3.1(f)). No purple teaming or replay.", "cite": "No provision; full text reviewed (searched: purple, replay, red team, workshop)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Open%20Bank_Oman.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Vulnerability management must cover discovery, prioritization and remediation. APIs are fixed and retested before deployment (Annexure 2 §12.4(c)(i), Phase 5). No deadline.", "cite": "Annexure 3 §13.3.1(d); Annexure 2 §12.4(c)(i)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Open%20Bank_Oman.pdf", "quote": "The process shall include vulnerability discovery, prioritization, and remediation.", "confidence": "verified" }, "regulator_role": { "code": "receives_results", "detail": "The license application must include a penetration testing and vulnerability assessment report. After licensing, the text does not require test reports to go to CBO.", "cite": "§2.5.9(m)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Open%20Bank_Oman.pdf", "quote": "Information technology and information security policy document providing details of the proposed information technology, information security, penetration testing & vulnerability assessment report for the information technology systems", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Automated SAST, DAST and software composition analysis should run through the development lifecycle. API tests should be automated where possible (Annexure 2 §12.4(c)(i), Phase 4). Nothing on testing AI.", "cite": "Annexure 3 §13.3.1(b); Annexure 2 §12.4(c)(i)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Open%20Bank_Oman.pdf", "quote": "Automated security scanning and testing controls should be performed throughout the SDLC/DevOps", "confidence": "verified" } } }, { "id": "om-cbo-psp-licensing", "jurisdiction": "Oman", "region": "GCC", "sector": "financial", "name": "Licensing Policy for Payment Service Providers (PSPs) & Ancillary Payment Service Activities in the Sultanate of Oman (Version 1.01, June 2023), issued with Circular BM 1192", "short": "CBO PSP licensing policy", "issuer": "Central Bank of Oman (CBO)", "version": "2023-06-13", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2023/2023-06-13%20%20BM%20%201192%20-%20Licensing%20Policy%20for%20Payment%20Service%20Providers%20and%20Ancillary%20Payment%20Service%20Activities.pdf", "regulator_arabic": "البنك المركزي العُماني", "arabic_source_url": "https://cbo.gov.om/ar/pages/OpenBanking.aspx", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Sets a penetration test of a payment service provider's online services before licensing and every year after. Issued June 13, 2023; not in the September coding.", "cells": { "legal_force": { "code": "mandatory", "detail": "A CBO circular in effect from issue; existing licensees had until December 31, 2023 to comply. The penetration test must be done before a license is granted and then every year.", "cite": "Circular BM 1192, p. 2; Policy §9.3(a)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2023/2023-06-13%20%20BM%20%201192%20-%20Licensing%20Policy%20for%20Payment%20Service%20Providers%20and%20Ancillary%20Payment%20Service%20Activities.pdf", "quote": "All licensed institutions and other stakeholders shall take due note of this policy and ensure compliance accordingly.", "confidence": "verified" }, "scope": { "code": "PSP applicants and licensees", "detail": "Payment service providers and entities offering ancillary payment services. The test clause names the applicant; the annual repeat applies after licensing.", "cite": "Policy §3.1; §9.3(a)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2023/2023-06-13%20%20BM%20%201192%20-%20Licensing%20Policy%20for%20Payment%20Service%20Providers%20and%20Ancillary%20Payment%20Service%20Activities.pdf", "quote": "This Policy Document shall define the licensing and other related requirements for Payment Services Providers (PSPs) and entities offering Ancillary Payment Services, operating in the Sultanate of Oman.", "confidence": "verified" }, "frequency": { "code": "annual (online services)", "detail": "Before the license is granted, then every year. Vulnerability assessment frequency is risk-based (§9.3(b)).", "cite": "Policy §9.3(a)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2023/2023-06-13%20%20BM%20%201192%20-%20Licensing%20Policy%20for%20Payment%20Service%20Providers%20and%20Ancillary%20Payment%20Service%20Activities.pdf", "quote": "This does not need to be completed prior to application but must be completed prior to the grant of License and then on an annual basis.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: threat, intelligence, scenario, red team)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2023/2023-06-13%20%20BM%20%201192%20-%20Licensing%20Policy%20for%20Payment%20Service%20Providers%20and%20Ancillary%20Payment%20Service%20Activities.pdf", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "No qualification or accreditation rule for the tester. Only the validation of fixes must be independent (coded under remediation_retest).", "cite": "No provision; full text reviewed (searched: certif, accredit, qualif, independent, external)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2023/2023-06-13%20%20BM%20%201192%20-%20Licensing%20Policy%20for%20Payment%20Service%20Providers%20and%20Ancillary%20Payment%20Service%20Activities.pdf", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Silent on who runs the penetration test.", "cite": "No provision; full text reviewed (searched: internal, in-house, external, independent)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2023/2023-06-13%20%20BM%20%201192%20-%20Licensing%20Policy%20for%20Payment%20Service%20Providers%20and%20Ancillary%20Payment%20Service%20Activities.pdf", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: social engineering, phishing)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2023/2023-06-13%20%20BM%20%201192%20-%20Licensing%20Policy%20for%20Payment%20Service%20Providers%20and%20Ancillary%20Payment%20Service%20Activities.pdf", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: physical, premises)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2023/2023-06-13%20%20BM%20%201192%20-%20Licensing%20Policy%20for%20Payment%20Service%20Providers%20and%20Ancillary%20Payment%20Service%20Activities.pdf", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "Outsourcing needs prior CBO approval and is limited to non-core activities (§10.5). No supplier testing or audit rights tied to testing.", "cite": "No provision; full text reviewed (searched: outsourc, third party, vendor, service provider)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2023/2023-06-13%20%20BM%20%201192%20-%20Licensing%20Policy%20for%20Payment%20Service%20Providers%20and%20Ancillary%20Payment%20Service%20Activities.pdf", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: operational technology, OT, industrial, SCADA)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2023/2023-06-13%20%20BM%20%201192%20-%20Licensing%20Policy%20for%20Payment%20Service%20Providers%20and%20Ancillary%20Payment%20Service%20Activities.pdf", "confidence": "verified" }, "payment_systems": { "code": "required", "detail": "The regime governs payment services. The tested online services are the payment service provider's own.", "cite": "Policy §9.3(a)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2023/2023-06-13%20%20BM%20%201192%20-%20Licensing%20Policy%20for%20Payment%20Service%20Providers%20and%20Ancillary%20Payment%20Service%20Activities.pdf", "quote": "To manage the technology risk and risk of online financial services, the applicant performs a penetration test of its proposed online services, remediate all high-risk findings identified, and conduct independent validation on the effectiveness of the remediation actions.", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: cloud, hosting, SaaS)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2023/2023-06-13%20%20BM%20%201192%20-%20Licensing%20Policy%20for%20Payment%20Service%20Providers%20and%20Ancillary%20Payment%20Service%20Activities.pdf", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "'Cross border' appears only as a type of payment service (remittance). Nothing on testing across borders.", "cite": "No provision; full text reviewed (searched: foreign, outside, abroad, cross border)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2023/2023-06-13%20%20BM%20%201192%20-%20Licensing%20Policy%20for%20Payment%20Service%20Providers%20and%20Ancillary%20Payment%20Service%20Activities.pdf", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: purple, replay, red team, workshop)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2023/2023-06-13%20%20BM%20%201192%20-%20Licensing%20Policy%20for%20Payment%20Service%20Providers%20and%20Ancillary%20Payment%20Service%20Activities.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "High-risk findings must be fixed and the fixes validated independently. No deadline.", "cite": "Policy §9.3(a)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2023/2023-06-13%20%20BM%20%201192%20-%20Licensing%20Policy%20for%20Payment%20Service%20Providers%20and%20Ancillary%20Payment%20Service%20Activities.pdf", "quote": "remediate all high-risk findings identified, and conduct independent validation on the effectiveness of the remediation actions.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "CBO may examine licensees' books and records and order special examinations at the licensee's cost (§12.4). The text does not require test reports to be sent to CBO.", "cite": "Policy §12.1; §12.4", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2023/2023-06-13%20%20BM%20%201192%20-%20Licensing%20Policy%20for%20Payment%20Service%20Providers%20and%20Ancillary%20Payment%20Service%20Activities.pdf", "quote": "The Central Bank of Oman reserves the right to appoint examiners, who shall be its own employees or others appointed by the Central Bank to examine the books of accounts and records of the licensee", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: automat, artificial intelligence, AI, machine learning)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2023/2023-06-13%20%20BM%20%201192%20-%20Licensing%20Policy%20for%20Payment%20Service%20Providers%20and%20Ancillary%20Payment%20Service%20Activities.pdf", "confidence": "verified" } } }, { "id": "om-cbo-bnpl", "jurisdiction": "Oman", "region": "GCC", "sector": "financial", "name": "Licensing & Regulatory Framework for Buy Now Pay Later (BNPL) in the Sultanate of Oman", "short": "CBO BNPL framework", "issuer": "Central Bank of Oman (CBO)", "version": "2026-06", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/BNPL%20Framework%20EN%20Version.pdf", "arabic_title": "إطار التنظيم والترخيص لنشاط اشترِ الآن وادفع لاحقا", "regulator_arabic": "البنك المركزي العُماني", "arabic_source_url": "https://cbo.gov.om/ar/pages/BNPLFrameWork.aspx", "checked": "2026-10-30", "added": "2026-10-30", "notes": "CBO-licensed non-bank lender. The framework sets a penetration test of the provider's online services before licensing and every year after. Published June 2026 (PDF created 2026-06-10; PDF last modified on cbo.gov.om 2026-06-21).", "cells": { "legal_force": { "code": "mandatory", "detail": "Applies to any legal person providing BNPL in Oman, read with Regulation No. BM/2026/2/61, which CBO announced on February 22, 2026. The penetration test is a license condition and then annual.", "cite": "§1.6; §3.1; §8.4", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/BNPL%20Framework%20EN%20Version.pdf", "quote": "This instruction shall apply to any Legal person providing a BNPL service in the Sultanate of Oman.", "confidence": "verified" }, "scope": { "code": "BNPL providers (not banks or FLCs)", "detail": "Non-bank BNPL providers licensed by CBO. Banks and finance and leasing companies are excluded.", "cite": "§3.3", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/BNPL%20Framework%20EN%20Version.pdf", "quote": "This Licensing and Regulatory framework is applicable to BNPL Provider only and not applicable to licensed Banks and Finance & Leasing Companies in the Sultanate of Oman.", "confidence": "verified" }, "frequency": { "code": "annual (online services)", "detail": "Before the request for grant of license, then every year. Vulnerability assessment frequency is risk-based (§8.5).", "cite": "§8.4", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/BNPL%20Framework%20EN%20Version.pdf", "quote": "must be completed prior to submitting the request for grant of License and then on an annual basis.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: threat, intelligence, scenario, red team)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/BNPL%20Framework%20EN%20Version.pdf", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "No qualification or accreditation rule for the tester. Only the validation of fixes must be independent (coded under remediation_retest).", "cite": "No provision; full text reviewed (searched: certif, accredit, qualif, independent, external)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/BNPL%20Framework%20EN%20Version.pdf", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Silent on who runs the penetration test.", "cite": "No provision; full text reviewed (searched: internal, in-house, external, independent)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/BNPL%20Framework%20EN%20Version.pdf", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: social engineering, phishing)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/BNPL%20Framework%20EN%20Version.pdf", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: physical, premises)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/BNPL%20Framework%20EN%20Version.pdf", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "Internal audit may be outsourced with CBO approval (§9.2). No supplier testing.", "cite": "No provision; full text reviewed (searched: outsourc, third party, vendor, service provider)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/BNPL%20Framework%20EN%20Version.pdf", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: operational technology, OT, industrial, SCADA)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/BNPL%20Framework%20EN%20Version.pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "The tested online services are BNPL credit platforms. The text does not name payment systems, cards or SWIFT in test scope.", "cite": "No provision; full text reviewed (searched: payment system, card, SWIFT, PCI)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/BNPL%20Framework%20EN%20Version.pdf", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, hosting)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/BNPL%20Framework%20EN%20Version.pdf", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "Services to non-residents are banned (§5.3). Nothing on cross-border testing.", "cite": "No provision; full text reviewed (searched: foreign, outside, abroad, cross border)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/BNPL%20Framework%20EN%20Version.pdf", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: purple, replay, red team)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/BNPL%20Framework%20EN%20Version.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "High-risk findings must be fixed and the fixes validated independently. No deadline.", "cite": "§8.4", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/BNPL%20Framework%20EN%20Version.pdf", "quote": "remediate all high-risk findings identified, and conduct independent validation on the effectiveness of the remediation actions.", "confidence": "verified" }, "regulator_role": { "code": "receives_results", "detail": "Providers must tell CBO at once of any vulnerability they find. CBO examiners may review IT governance, cybersecurity and resilience (§16.1). The text does not require test reports as such.", "cite": "§8.6; §16.1", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/BNPL%20Framework%20EN%20Version.pdf", "quote": "The BNPL provider shall inform the Central Bank immediately about any vulnerabilities that comes to their attention during the conduct of business.", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "AI and machine learning are encouraged for credit assessment (§6.10). Nothing on automated testing or testing AI.", "cite": "No provision; full text reviewed (searched: automat, artificial intelligence, AI, machine learning)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/BNPL%20Framework%20EN%20Version.pdf", "confidence": "verified" } } }, { "id": "om-cbo-digital-banks", "jurisdiction": "Oman", "region": "GCC", "sector": "financial", "name": "Regulatory Framework for Digital Banks in the Sultanate of Oman", "short": "CBO digital bank framework", "issuer": "Central Bank of Oman (CBO)", "version": "2025-06-01", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Digital%20Bank_Oman.pdf", "arabic_title": "الإطار التنظيمي للمصارف الرقمية في سلطنة عمان", "regulator_arabic": "البنك المركزي العُماني", "arabic_source_url": "https://cbo.gov.om/ar/pages/DigitalBanking.aspx", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Lets CBO require a third-party vulnerability assessment and penetration test of a digital bank applicant or licensee. In effect June 1, 2025; not in the September coding.", "cells": { "legal_force": { "code": "mandatory", "detail": "Issued under Article 9 of the Banking Law and the CBO Statute; in effect from June 1, 2025. The only testing clause is a CBO power to require a third-party VAPT.", "cite": "§3.1; §4.1; §11.2; §11.3", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Digital%20Bank_Oman.pdf", "quote": "The applicant and/or licensed digital bank shall comply with any additional requirements as specified by the Central Bank", "confidence": "verified" }, "scope": { "code": "digital bank applicants and licensees", "detail": "Applicants for, and holders of, a digital bank license, including branches of foreign banks.", "cite": "§3.1; §5.1", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Digital%20Bank_Oman.pdf", "quote": "Pursuant to Article (9) of the Banking Law, and Articles (8) and (17) of CBO Statute, this framework is applicable to Digital Bank license in the Sultanate of Oman", "confidence": "verified" }, "frequency": { "code": "on CBO request", "detail": "No set cycle. CBO may require the assessment at licensing or at later stages.", "cite": "§11.3", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Digital%20Bank_Oman.pdf", "quote": "Such assessment can be performed at different stages of its operations.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: threat, intelligence, scenario)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Digital%20Bank_Oman.pdf", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "When CBO requires it, the test is run by a qualified and experienced third party at the applicant's cost. No named certification.", "cite": "§11.3", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Digital%20Bank_Oman.pdf", "quote": "The Central Bank may require the applicant to appoint a qualified and experienced third-party entity (“assessor”) to perform Vulnerability Assessment & Penetration Testing", "confidence": "verified" }, "internal_testers": { "code": "not_allowed", "detail": "The framework's only testing provision calls for a third-party assessor, so an in-house team cannot meet it. CS&RF duties still apply separately (§11.1(d)).", "cite": "§11.3", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Digital%20Bank_Oman.pdf", "quote": "The Central Bank may require the applicant to appoint a qualified and experienced third-party entity (“assessor”) to perform Vulnerability Assessment & Penetration Testing", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: social engineering, phishing)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Digital%20Bank_Oman.pdf", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: physical, premises)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Digital%20Bank_Oman.pdf", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "Digital banks must comply with the outsourcing guidelines and cloud rules (§11.1(g)). No supplier testing.", "cite": "No provision; full text reviewed (searched: outsourc, third party, vendor, service provider)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Digital%20Bank_Oman.pdf", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: operational technology, OT, industrial, SCADA)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Digital%20Bank_Oman.pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: payment, card, SWIFT, PCI)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Digital%20Bank_Oman.pdf", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "§11.1(g) points to the CBO cloud rules (BM 1185), which give audit rights over providers. No cloud testing here.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, hosting)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Digital%20Bank_Oman.pdf", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "Foreign bank branches may hold a digital bank license with home supervisor approval (§5.1; §5.4.5). Nothing on cross-border testing.", "cite": "No provision; full text reviewed (searched: foreign, outside, abroad, cross-border)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Digital%20Bank_Oman.pdf", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: purple, replay, red team)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Digital%20Bank_Oman.pdf", "confidence": "verified" }, "remediation_retest": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: remediat, retest, validation, findings)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Digital%20Bank_Oman.pdf", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "CBO may order a third-party VAPT as part of licensing and ongoing supervision. The text does not say the report goes to CBO or that CBO oversees the test.", "cite": "§11.2; §11.3", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Digital%20Bank_Oman.pdf", "quote": "after having regard to specific risk profile or business model of a licensed digital bank and the Central Bank’s ongoing supervisory monitoring and assessments of the licensed digital bank.", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "The business plan must describe the strategy for technologies such as artificial intelligence (§6.1(n)). Nothing on automated testing or testing AI.", "cite": "No provision; full text reviewed (searched: automat, artificial intelligence, AI, machine learning)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Digital%20Bank_Oman.pdf", "confidence": "verified" } } }, { "id": "om-fsa-infosec-guidelines", "jurisdiction": "Oman", "region": "GCC", "sector": "financial", "name": "Circular No. E/1/2022 Issuing Information Security Guidelines for Public Joint Stock Companies", "short": "FSA listed-company infosec guidelines", "issuer": "Financial Services Authority (FSA); issued by its predecessor, the Capital Market Authority", "version": "2022-01-05", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://e.fsa.gov.om/LegislationEncyclopedia/DisplayLegislationDetails?isHome=True&id=52&type=4&searchType=1§or=&isExactMatch=False&searchWord=", "arabic_title": "دليل أمن المعلومات للشركات المساهمة العامة", "regulator_arabic": "هيئة الخدمات المالية", "arabic_source_url": "https://e.fsa.gov.om/LegislationEncyclopedia/DisplayLegislationDetails?isHome=True&id=52&type=4&searchType=1§or=&isExactMatch=False&searchWord=", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Requires annual security testing, regular penetration tests including an independent third party, and penetration tests of every website and mobile app at listed companies, which include listed banks and insurers. Issued January 5, 2022 by the Capital Market Authority, now the FSA. September did not review Oman capital market rules. The FSA numbers it E/1/2022 in English and خ/١/٢٠٢٢ in Arabic.", "cells": { "legal_force": { "code": "mandatory", "detail": "Listed companies had three months to align their policies (Article 2). The circular took effect on issue. It is still listed in the FSA legislation index.", "cite": "Articles 2 and 3; §2.1", "url": "https://e.fsa.gov.om/LegislationEncyclopedia/DisplayLegislationDetails?isHome=True&id=52&type=4&searchType=1§or=&isExactMatch=False&searchWord=", "quote": "SAOG companies that are listed on Muscat Securities Exchange (MSX) (Listed Companies for short) must implement this guideline as minimum requirements.", "confidence": "verified" }, "scope": { "code": "MSX-listed public joint stock companies", "detail": "All listed SAOG companies, which include listed banks and insurers. Where a sector regulator such as CBO sets conflicting rules, the sector rules prevail.", "cite": "§2.1", "url": "https://e.fsa.gov.om/LegislationEncyclopedia/DisplayLegislationDetails?isHome=True&id=52&type=4&searchType=1§or=&isExactMatch=False&searchWord=", "quote": "If however, the requirements are in conflict with each other, the requirements specified by its sector regulator or any other competent authority shall be implemented", "confidence": "verified" }, "frequency": { "code": "annual", "detail": "Assessments and testing at least yearly and on change or perceived threats. Every website and mobile app must also have a penetration test (§13; §14), with no interval.", "cite": "§10.2; §13; §14", "url": "https://e.fsa.gov.om/LegislationEncyclopedia/DisplayLegislationDetails?isHome=True&id=52&type=4&searchType=1§or=&isExactMatch=False&searchWord=", "quote": "Information security assessments and testing shall, at a minimum, be carried out annually or more frequently whenever changes are made that could have an impact on the business or perceived threats.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Penetration tests must 'replicate current attacks' (§10.2), but the text does not mention threat intelligence.", "cite": "No provision; full text reviewed (searched: threat intelligence, intelligence, scenario)", "url": "https://e.fsa.gov.om/LegislationEncyclopedia/DisplayLegislationDetails?isHome=True&id=52&type=4&searchType=1§or=&isExactMatch=False&searchWord=", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Regular VAPT must involve an independent third-party provider. Websites must clear a security audit by a 'certificate agency' (§13), which the text does not define.", "cite": "§10.2(c); §13", "url": "https://e.fsa.gov.om/LegislationEncyclopedia/DisplayLegislationDetails?isHome=True&id=52&type=4&searchType=1§or=&isExactMatch=False&searchWord=", "quote": "Regular Vulnerability Assessment and Penetration Testing (VAPT) with an independent third-party provider", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "Scans and network boundary penetration tests (§10.2(a) to (b)) have no rule on who tests, so in-house teams can run them. Regular VAPT must also involve an independent third party.", "cite": "§10.2(a) to (c)", "url": "https://e.fsa.gov.om/LegislationEncyclopedia/DisplayLegislationDetails?isHome=True&id=52&type=4&searchType=1§or=&isExactMatch=False&searchWord=", "quote": "Regular Vulnerability Assessment and Penetration Testing (VAPT) with an independent third-party provider", "confidence": "verified" }, "social_engineering": { "code": "controls_test", "detail": "Periodic assessments must cover people and processes. No phishing or social engineering method is named. Regular cyber drills are required (§9).", "cite": "§10.2", "url": "https://e.fsa.gov.om/LegislationEncyclopedia/DisplayLegislationDetails?isHome=True&id=52&type=4&searchType=1§or=&isExactMatch=False&searchWord=", "quote": "Listed Companies shall conduct a periodic information security assessment of all systems, applications, networks, electronic websites, databases, and physical security systems, people, and processes to identify and address security vulnerabilities and sources of information security threats on a timely basis.", "confidence": "verified" }, "physical": { "code": "controls_test", "detail": "Physical security systems are in the assessment scope. No physical intrusion test is named.", "cite": "§10.2", "url": "https://e.fsa.gov.om/LegislationEncyclopedia/DisplayLegislationDetails?isHome=True&id=52&type=4&searchType=1§or=&isExactMatch=False&searchWord=", "quote": "Listed Companies shall conduct a periodic information security assessment of all systems, applications, networks, electronic websites, databases, and physical security systems, people, and processes to identify and address security vulnerabilities and sources of information security threats on a timely basis.", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "Contracts must carry security terms (non-disclosure, incident communication, policy compliance) but no audit or test rights (§7.7).", "cite": "No provision; full text reviewed (searched: third part, contractor, service provider, outsourc)", "url": "https://e.fsa.gov.om/LegislationEncyclopedia/DisplayLegislationDetails?isHome=True&id=52&type=4&searchType=1§or=&isExactMatch=False&searchWord=", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "Companies must follow ICS and SCADA requirements and an ISMS that can cover OT (§6.2; §7). No OT testing rule.", "cite": "No provision; full text reviewed (searched: operational technology, OT, ICS, SCADA)", "url": "https://e.fsa.gov.om/LegislationEncyclopedia/DisplayLegislationDetails?isHome=True&id=52&type=4&searchType=1§or=&isExactMatch=False&searchWord=", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "SWIFT CSP and PCI DSS compliance is required where relevant (§6.2). No payment system testing.", "cite": "No provision; full text reviewed (searched: payment, SWIFT, PCI, card)", "url": "https://e.fsa.gov.om/LegislationEncyclopedia/DisplayLegislationDetails?isHome=True&id=52&type=4&searchType=1§or=&isExactMatch=False&searchWord=", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "Data hosting must follow Omani rules (§7.6). No cloud testing.", "cite": "No provision; full text reviewed (searched: cloud, hosting, SaaS)", "url": "https://e.fsa.gov.om/LegislationEncyclopedia/DisplayLegislationDetails?isHome=True&id=52&type=4&searchType=1§or=&isExactMatch=False&searchWord=", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "Only the data hosting rule (§7.6). Nothing on testing across borders.", "cite": "No provision; full text reviewed (searched: foreign, outside, abroad, hosting)", "url": "https://e.fsa.gov.om/LegislationEncyclopedia/DisplayLegislationDetails?isHome=True&id=52&type=4&searchType=1§or=&isExactMatch=False&searchWord=", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "Regular cyber drills (§9). No purple teaming or replay.", "cite": "No provision; full text reviewed (searched: purple, replay, red team, drill)", "url": "https://e.fsa.gov.om/LegislationEncyclopedia/DisplayLegislationDetails?isHome=True&id=52&type=4&searchType=1§or=&isExactMatch=False&searchWord=", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Assessments must identify and address vulnerabilities on a timely basis. No deadline or retest rule.", "cite": "§10.2", "url": "https://e.fsa.gov.om/LegislationEncyclopedia/DisplayLegislationDetails?isHome=True&id=52&type=4&searchType=1§or=&isExactMatch=False&searchWord=", "quote": "to identify and address security vulnerabilities and sources of information security threats on a timely basis.", "confidence": "verified" }, "regulator_role": { "code": "not_addressed", "detail": "The audit or risk committee checks implementation each quarter and the annual report confirms compliance (§2). Nothing requires test results to go to the FSA.", "cite": "No provision; full text reviewed (searched: Authority, CMA, report, submit)", "url": "https://e.fsa.gov.om/LegislationEncyclopedia/DisplayLegislationDetails?isHome=True&id=52&type=4&searchType=1§or=&isExactMatch=False&searchWord=", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: automat, artificial intelligence, AI, machine learning)", "url": "https://e.fsa.gov.om/LegislationEncyclopedia/DisplayLegislationDetails?isHome=True&id=52&type=4&searchType=1§or=&isExactMatch=False&searchWord=", "confidence": "verified" } } }, { "id": "om-cdc-external-cloud", "jurisdiction": "Oman", "region": "GCC", "sector": "government", "name": "Policy and controls for using external cloud computing services, with Annex 1, minimum security and technical requirements (Version 1, 27 March 2025)", "short": "CDC external cloud policy", "issuer": "Cyber Defence Centre (CDC)", "version": "2025-03-27", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://cdc.gov.om/files/CloudPolicy.pdf", "arabic_title": "سياسة وضوابط استخدام خدمات الحوسبة السحابية الخارجية", "regulator_arabic": "مركز الدفاع الإلكتروني", "arabic_source_url": "https://cdc.gov.om/ar/library/", "arabic_note": "Arabic only; English title by Bendings.", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Sets a penetration test duty, with six-monthly technical audit reports to the national cyber authority, for government units and firms with sensitive data that use cloud services outside Oman. Issued March 27, 2025; not in the September coding.", "cells": { "legal_force": { "code": "mandatory", "detail": "CDC sets these as conditions for using cloud services outside Oman. Approval lasts two years and can be revoked for non-compliance (Art. 3(12); 3(16)). The document does not state its legal basis. Translation by Bendings.", "cite": "Art. 3", "url": "https://cdc.gov.om/files/CloudPolicy.pdf", "quote": "السياسات والضوابط التي يجب الالتزام بها من قبل الوحدة المستفيدة للاستفادة من الخدمات السحابية خارج سلطنة عُمان", "confidence": "verified" }, "scope": { "code": "state units and firms with sensitive data using offshore cloud", "detail": "State administrative units and institutions or companies that handle classified or sensitive data. Sensitive data includes financial information. Translation by Bendings.", "cite": "Art. 1, 'beneficiary unit'", "url": "https://cdc.gov.om/files/CloudPolicy.pdf", "quote": "الوحدة المستفيدة: وحدات الجهاز الإداري للدولة أو المؤسسات أو الشركات التي تتعامل مع البيانات أو المعلومات المصنفة أو الحساسة.", "confidence": "verified" }, "frequency": { "code": "not specified", "detail": "Annex 1 requires a penetration test with no interval. Technical audit reports go to CDC every six months (Art. 3(6)).", "cite": "Annex 1, item 5 (https://cdc.gov.om/files/MinimumReqCloud.pdf); Art. 3(6)", "url": "https://cdc.gov.om/files/CloudPolicy.pdf", "quote": "إجراء الفحص الفني (Penetration Testing) وتحليل المخاطر (Risk Assessment).", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: threat intelligence, intelligence, scenario)", "url": "https://cdc.gov.om/files/CloudPolicy.pdf", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "No rule on who tests. The certification rules in Chapter 4 apply to the cloud provider, not to testers.", "cite": "No provision; full text reviewed (searched: certification, accredited, qualified, tester)", "url": "https://cdc.gov.om/files/CloudPolicy.pdf", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Silent on who runs the test.", "cite": "No provision; full text reviewed (searched: internal, external, independent, tester)", "url": "https://cdc.gov.om/files/CloudPolicy.pdf", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: social engineering, phishing)", "url": "https://cdc.gov.om/files/CloudPolicy.pdf", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: physical, premises)", "url": "https://cdc.gov.om/files/CloudPolicy.pdf", "confidence": "verified" }, "third_party": { "code": "assurance_only", "detail": "Cloud providers must prove valid certifications such as ISO 27001 and SOC 2, give the unit an audit log platform, and report security incidents to CDC. No rule on testing the provider's own systems. Translation by Bendings.", "cite": "Chapter 4, items 6, 7 and 10", "url": "https://cdc.gov.om/files/CloudPolicy.pdf", "quote": "على مقدم الخدمة إثبات حصوله على الشهادات ومعايير الجودة العالمية سارية المفعول، على سبيل المثال لا الحصر:", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: operational technology, OT, industrial, SCADA)", "url": "https://cdc.gov.om/files/CloudPolicy.pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: payment, card, SWIFT)", "url": "https://cdc.gov.om/files/CloudPolicy.pdf", "confidence": "verified" }, "cloud_saas": { "code": "required", "detail": "A penetration test is a minimum requirement for using cloud services hosted outside Oman. Article 3(6) makes Annex 1 binding. The checklist does not define the test scope.", "cite": "Annex 1, item 5; Art. 3(6)", "url": "https://cdc.gov.om/files/CloudPolicy.pdf", "quote": "إجراء الفحص الفني (Penetration Testing) وتحليل المخاطر (Risk Assessment).", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "The policy sets the conditions for state units and firms with sensitive data that use cloud services hosted outside Oman, and a penetration test is one of its minimum requirements (Art. 3(6); Annex 1, item 5). The testing duty therefore reaches systems hosted abroad. CDC must approve hosting in locations it has not approved (Art. 3(4)), a data location rule that would not count alone. Nothing on where testers sit. Translation by Bendings.", "cite": "Art. 3 (chapeau); Art. 3(4); Art. 3(6); Annex 1, item 5 (https://cdc.gov.om/files/MinimumReqCloud.pdf)", "url": "https://cdc.gov.om/files/CloudPolicy.pdf", "quote": "السياسات والضوابط التي يجب الالتزام بها من قبل الوحدة المستفيدة للاستفادة من الخدمات السحابية خارج سلطنة عُمان", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: purple, replay, red team)", "url": "https://cdc.gov.om/files/CloudPolicy.pdf", "confidence": "verified" }, "remediation_retest": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: remediation, retest, findings)", "url": "https://cdc.gov.om/files/CloudPolicy.pdf", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "Units send CDC technical audit reports every six months; their content is not defined, and the text does not say they must include penetration test results.", "cite": "Art. 3(6)", "url": "https://cdc.gov.om/files/CloudPolicy.pdf", "quote": "يتولى القسم المعني بأمن المعلومات في الوحدة المستفيدة مهمة التأكد من تطبيق أفضل الممارسات والضوابط الأمنية والفنية وتزويد المركز بتقارير التدقيق الفنية بشكل دوري كل ستة أشهر إلكترونيا.", "confidence": "verified", "harmonized_from": "receives_results", "harmonize_reason": "R7: The six-monthly reports are technical audit reports with no defined content, not test results; R7 does not count audits as security tests." }, "automated_ai": { "code": "not_addressed", "detail": "AI appears only as a permitted cloud use (Art. 3(8)) and a ban on providers feeding unit data to AI (Chapter 4, item 8). No testing of AI.", "cite": "No provision; full text reviewed (searched: automated, artificial intelligence, AI)", "url": "https://cdc.gov.om/files/CloudPolicy.pdf", "confidence": "verified" } } }, { "id": "om-mtcit-managed-services", "jurisdiction": "Oman", "region": "GCC", "sector": "government", "name": "Ministerial Circular No. (7/2025) on Administrative Standards for Managed Services (Technical Support, Infrastructure, Information Systems)", "short": "MTCIT managed services standards", "issuer": "Ministry of Transport, Communications and Information Technology (MTCIT)", "version": "2025-03-09", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://mtcit.gov.om/web/content/mtcit.content/755/attachment?download=True", "arabic_title": "المعايير الإدارية للخدمات المدارة (الدعم الفني، البنى الأساسية، نظم المعلومات)", "regulator_arabic": "وزارة النقل والاتصالات وتقنية المعلومات", "arabic_source_url": "https://mtcit.gov.om/ar/3/7/66/755", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Requires managed IT service providers to state administrative units to run periodic assessments and penetration tests of the infrastructure they manage. Issued March 9, 2025; the September notes named this circular but did not code it.", "cells": { "legal_force": { "code": "mandatory", "detail": "Ministerial circular directing state administrative units to hold their IT service providers to the standards, including the minimum technical standards in Annex 1. Translation by Bendings.", "cite": "Circular 7/2025, p. 1 to 2", "url": "https://mtcit.gov.om/web/content/mtcit.content/755/attachment?download=True", "quote": "وعلى وحدات الجهاز الإداري للدولة التأكد من التزام مزودي خدمات تقنية المعلومات عند التعاقد معهم لتقديم خدمات البنى الأساسية، الدعم الفني، ونظم المعلومات بالمعايير التالية:", "confidence": "verified" }, "scope": { "code": "managed IT providers to state units", "detail": "IT service providers that run infrastructure, technical support or information systems for state administrative units. Translation by Bendings.", "cite": "Circular 7/2025, p. 1", "url": "https://mtcit.gov.om/web/content/mtcit.content/755/attachment?download=True", "quote": "وعلى وحدات الجهاز الإداري للدولة التأكد من التزام مزودي خدمات تقنية المعلومات عند التعاقد معهم لتقديم خدمات البنى الأساسية، الدعم الفني، ونظم المعلومات بالمعايير التالية:", "confidence": "verified" }, "frequency": { "code": "periodic (not specified)", "detail": "Periodic assessments and penetration tests, with no interval. Translation by Bendings.", "cite": "Annex 1, §3 (Security and compliance)", "url": "https://mtcit.gov.om/web/content/mtcit.content/755/attachment?download=True", "quote": "إدارة وتقييم الثغرات الأمنية (Vulnerability Management and Assessment): تنفيذ تقييمات دورية واختبارات اختراق لتحديد ومعالجة الثغرات الأمنية المحتملة في البنى الأساسية.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: threat intelligence, intelligence, scenario)", "url": "https://mtcit.gov.om/web/content/mtcit.content/755/attachment?download=True", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "Providers must be registered and licensed in Oman and employ qualified staff, but these are general managed service rules, not tester rules.", "cite": "No provision; full text reviewed (searched: certification, accredited, qualified, tester)", "url": "https://mtcit.gov.om/web/content/mtcit.content/755/attachment?download=True", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Silent on whether the provider's own staff or a separate firm runs the tests.", "cite": "No provision; full text reviewed (searched: internal, external, independent, tester)", "url": "https://mtcit.gov.om/web/content/mtcit.content/755/attachment?download=True", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: social engineering, phishing)", "url": "https://mtcit.gov.om/web/content/mtcit.content/755/attachment?download=True", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: physical, premises)", "url": "https://mtcit.gov.om/web/content/mtcit.content/755/attachment?download=True", "confidence": "verified" }, "third_party": { "code": "required", "detail": "The duty falls on the supplier: managed service providers must test the government infrastructure they run. This puts supplier-operated systems in test scope. Translation by Bendings.", "cite": "Annex 1, §3", "url": "https://mtcit.gov.om/web/content/mtcit.content/755/attachment?download=True", "quote": "إدارة وتقييم الثغرات الأمنية (Vulnerability Management and Assessment): تنفيذ تقييمات دورية واختبارات اختراق لتحديد ومعالجة الثغرات الأمنية المحتملة في البنى الأساسية.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: operational technology, OT, industrial, SCADA)", "url": "https://mtcit.gov.om/web/content/mtcit.content/755/attachment?download=True", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: payment, card, SWIFT)", "url": "https://mtcit.gov.om/web/content/mtcit.content/755/attachment?download=True", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, hosting)", "url": "https://mtcit.gov.om/web/content/mtcit.content/755/attachment?download=True", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "Providers must be registered and licensed in Oman, which limits offshore providers. Nothing on where testers sit. Translation by Bendings.", "cite": "Circular 7/2025, p. 1, first bullet", "url": "https://mtcit.gov.om/web/content/mtcit.content/755/attachment?download=True", "quote": "يجب على مزودي خدمات تقنية المعلومات أن يكونوا مسجلين رسمياً لدى الجهات المختصة في سلطنة عُمان، ويجب أن يمتلكوا التراخيص اللازمة التي تسمح لهم بتقديم هذه الخدمات بشكل قانوني في سلطنة عُمان.", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: purple, replay, red team)", "url": "https://mtcit.gov.om/web/content/mtcit.content/755/attachment?download=True", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Tests are to identify and remediate vulnerabilities. No deadline or retest rule. Translation by Bendings.", "cite": "Annex 1, §3", "url": "https://mtcit.gov.om/web/content/mtcit.content/755/attachment?download=True", "quote": "إدارة وتقييم الثغرات الأمنية (Vulnerability Management and Assessment): تنفيذ تقييمات دورية واختبارات اختراق لتحديد ومعالجة الثغرات الأمنية المحتملة في البنى الأساسية.", "confidence": "verified" }, "regulator_role": { "code": "not_addressed", "detail": "Providers report to the government unit (Annex 1, §8). MTCIT has no stated role in tests.", "cite": "No provision; full text reviewed (searched: report, submit, Ministry)", "url": "https://mtcit.gov.om/web/content/mtcit.content/755/attachment?download=True", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: automated, artificial intelligence, AI)", "url": "https://mtcit.gov.om/web/content/mtcit.content/755/attachment?download=True", "confidence": "verified" } } }, { "id": "om-mtcit-gov-mobile-apps", "jurisdiction": "Oman", "region": "GCC", "sector": "government", "name": "Ministerial Circular No. (19/2023) on Basic Standards for Developing Government Applications on Mobile and Smart Devices 2023", "short": "MTCIT gov mobile app standards", "issuer": "Ministry of Transport, Communications and Information Technology (MTCIT)", "version": "2023-11-28", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://mtcit.gov.om/web/content/mtcit.content/396/attachment?download=True", "arabic_title": "المعايير الأساسية لتطوير التطبيقات الحكومية في الاجهزة المحمولة و الذكية", "regulator_arabic": "وزارة النقل والاتصالات وتقنية المعلومات", "arabic_source_url": "https://mtcit.gov.om/ar/3/7/64/396", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Requires a security assessment by an accredited company before any government mobile app launches. Issued November 28, 2023; not in the September coding.", "cells": { "legal_force": { "code": "mandatory", "detail": "Ministerial circular with standards that units must follow; MTCIT monitors compliance. Translation by Bendings.", "cite": "Standards, 'Compliance' section", "url": "https://mtcit.gov.om/web/content/mtcit.content/396/attachment?download=True", "quote": "تتولى وزارة النقل والاتصالات وتقنية المعلومات مراقبة التزام وحدات الجهاز الإداري للدولة بالمعايير الواردة في هذه الوثيقة.", "confidence": "verified" }, "scope": { "code": "state admin units, mobile apps", "detail": "Mobile and smart device applications of state administrative units. Translation by Bendings.", "cite": "Standards, 'Scope' section", "url": "https://mtcit.gov.om/web/content/mtcit.content/396/attachment?download=True", "quote": "تطبق هذه المعايير على وحدات الجهاز الإداري للدولة.", "confidence": "verified" }, "frequency": { "code": "before launch", "detail": "A security assessment before any app launches. Later assessments fall under Circular 11/2022. Translation by Bendings.", "cite": "Standards, 'Security requirements', item 6", "url": "https://mtcit.gov.om/web/content/mtcit.content/396/attachment?download=True", "quote": "قبل تدشين أي تطبيق، على الوحدة التأكد من استيفاء المتطلبات الأمنية التالية: • الامتثال الى إنهاء إجراءات التقييم الأمني عن طريق إحدى الشركات المعتمدة", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: threat intelligence, intelligence, scenario)", "url": "https://mtcit.gov.om/web/content/mtcit.content/396/attachment?download=True", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "The assessment must go through an accredited company. The standard lists Circular 11/2022 among related documents but does not name the accrediting body. Translation by Bendings.", "cite": "Standards, 'Security requirements', item 6", "url": "https://mtcit.gov.om/web/content/mtcit.content/396/attachment?download=True", "quote": "قبل تدشين أي تطبيق، على الوحدة التأكد من استيفاء المتطلبات الأمنية التالية: • الامتثال الى إنهاء إجراءات التقييم الأمني عن طريق إحدى الشركات المعتمدة", "confidence": "verified" }, "internal_testers": { "code": "not_allowed", "detail": "The assessment must go through an accredited company. The text gives no in-house route.", "cite": "Standards, 'Security requirements', item 6", "url": "https://mtcit.gov.om/web/content/mtcit.content/396/attachment?download=True", "quote": "قبل تدشين أي تطبيق، على الوحدة التأكد من استيفاء المتطلبات الأمنية التالية: • الامتثال الى إنهاء إجراءات التقييم الأمني عن طريق إحدى الشركات المعتمدة", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: social engineering, phishing)", "url": "https://mtcit.gov.om/web/content/mtcit.content/396/attachment?download=True", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: physical, premises)", "url": "https://mtcit.gov.om/web/content/mtcit.content/396/attachment?download=True", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: third party, supplier, vendor, developer)", "url": "https://mtcit.gov.om/web/content/mtcit.content/396/attachment?download=True", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: operational technology, OT, industrial, SCADA)", "url": "https://mtcit.gov.om/web/content/mtcit.content/396/attachment?download=True", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "Apps must use Oman's approved e-payment gateway (item 10). No payment testing.", "cite": "No provision; full text reviewed (searched: payment, card, SWIFT)", "url": "https://mtcit.gov.om/web/content/mtcit.content/396/attachment?download=True", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, hosting)", "url": "https://mtcit.gov.om/web/content/mtcit.content/396/attachment?download=True", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: foreign, outside, abroad)", "url": "https://mtcit.gov.om/web/content/mtcit.content/396/attachment?download=True", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: purple, replay, red team)", "url": "https://mtcit.gov.om/web/content/mtcit.content/396/attachment?download=True", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Security vulnerabilities must be fixed on a continuing basis. No deadline or retest rule. Translation by Bendings.", "cite": "Standards, 'Security requirements', item 8", "url": "https://mtcit.gov.om/web/content/mtcit.content/396/attachment?download=True", "quote": "إصلاح الثغرات الأمنية واستكشاف الأخطاء وإصلاحها باستمرار.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "MTCIT monitors units' compliance with the standards. The text does not say test results go to MTCIT. Translation by Bendings.", "cite": "Standards, 'Compliance' section", "url": "https://mtcit.gov.om/web/content/mtcit.content/396/attachment?download=True", "quote": "تتولى وزارة النقل والاتصالات وتقنية المعلومات مراقبة التزام وحدات الجهاز الإداري للدولة بالمعايير الواردة في هذه الوثيقة.", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: automated, artificial intelligence, AI)", "url": "https://mtcit.gov.om/web/content/mtcit.content/396/attachment?download=True", "confidence": "verified" } } }, { "id": "qa-qcb-technology-risks-banks", "jurisdiction": "Qatar", "region": "GCC", "sector": "financial", "name": "Technology Risks (QCB cyber security circular for banks)", "short": "QCB banks tech risk", "issuer": "Qatar Central Bank (QCB)", "version": "January 2018 as printed on the cover. No circular number printed. PDF byte-identical to the 2026-09-28 copy (SHA-256 1d94b340...2226; server Last-Modified March 31, 2024).", "status": "In force as of 2026-09-28 as far as the public record shows. The PDF is still served on the QCB Information Security documents path (HTTP 200 on 2026-09-28). No replacement was found in web searches for 2023 to 2026 QCB cyber circulars. The 2024 Cloud Computing Regulation (Art. 24.1.1) and 2025 Data Handling and Protection Regulation (Art. 18.1, definition 18) require continued compliance with the \"Sector-Specific Security Regulation\", defined as QCB information security regulations for each subsector.", "public": "full", "primary_url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risks%20Regulation%20Banks.pdf", "arabic_title": "تعليمات مخاطر التكنولوجيا الحديثة", "regulator_arabic": "مصرف قطر المركزي", "arabic_source_url": "https://www.qcb.gov.qa/ar/Pages/Information-Security.aspx", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No cell changes. The QCB Information Security library still holds the same 6 files; none was added after February 16, 2025. Circular 8/2026 (August 2, 2026) replaced the business continuity section of the Instructions to Banks, not this circular, and sets business continuity and disaster recovery tests only (see left_out). Digital banks fall under this row: the Regulatory Framework for Digital Banks (Circular 7/2024, § 18.1.3) says a digital bank 'must comply with the provisions of the sector-specific Information & Cyber Security Regulations issued by QCB'. The 2025 sector-wide exercise, recorded in September from a press report, is now confirmed by QCB's Financial Stability Review 2025 (§ 4.1.4, PDF page 44, printed page 86): 'The exercise was structured in two parts, a management-level table top exercise and a technical scenario-based simulation.' It is a QCB-run exercise, not a testing rule, and is not coded. The Arabic title comes from QCB's InformationSecurity list, which feeds the Arabic Information Security page." }, "notes": "The circular states it was built from NIAP v2.0, the NIST cyber security framework and ISO 27001:2013 (§ III). QCB's 2025 review (reported by The Peninsula on August 3, 2026, secondary) says QCB ran the country's first sector-wide Cyber Resilience Exercise with MOI, NCSA and QFCRA. No QCB threat-led penetration testing framework (CBEST or TIBER style) was found in searches.", "cells": { "legal_force": { "code": "mandatory", "detail": "The circular binds every bank in Qatar. Exceptions to mandatory items need a board-approved business justification (§ 7.2.1).", "cite": "II. Purpose and applicability", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risks%20Regulation%20Banks.pdf", "quote": "Banks in the State of Qatar are required to comply with the requirements of the circular.", "confidence": "verified" }, "scope": { "code": "all banks in Qatar", "detail": "Applies to all banks in the State of Qatar. Banks must self-assess compliance at least once a year.", "cite": "II. Purpose and applicability", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risks%20Regulation%20Banks.pdf", "quote": "Banks are expected to perform, at a minimum, an annual assessment for compliance to the requirements of this circular.", "confidence": "verified" }, "frequency": { "code": "every 6 months", "detail": "Two penetration tests a year across the application infrastructure, semi-annual testing of infrastructure and network devices, and quarterly penetration tests of wireless infrastructure.", "cite": "§ 9.4.3.3; § 9.1.1.5; § 9.1.8.5", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risks%20Regulation%20Banks.pdf", "quote": "The bank shall conduct two penetration testing exercises, or more frequently as needed, on an annual basis.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "No provision ties threat intelligence to test design. § 5.3.4 requires banks to use internal and external threat intelligence feeds for risk mitigation only.", "cite": "No provision; full text reviewed (searched: threat intelligence, threat-led, scenario, red team)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risks%20Regulation%20Banks.pdf", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "The circular does not say who may perform penetration tests or what credentials they need. § 1.3.2 requires qualified professionals only for compliance checks and audits of preparedness indicators.", "cite": "No provision; full text reviewed (searched: certified, CREST, external, independent, tester, provider, qualified)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risks%20Regulation%20Banks.pdf", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Silent on whether bank staff may run the required penetration tests.", "cite": "No provision; full text reviewed (searched: internal, in-house, tester, independent, external)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risks%20Regulation%20Banks.pdf", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "Staff must be trained to recognize social engineering (§ 2.2.6), but no social engineering testing is required or mentioned.", "cite": "No provision; full text reviewed (searched: social engineering, phishing simulation, test, exercise)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risks%20Regulation%20Banks.pdf", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Physical and data center controls are required (§ 9.5, § 9.9.2), but physical intrusion testing is not mentioned.", "cite": "No provision; full text reviewed (searched: physical penetration, physical test, intrusion test, red team)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risks%20Regulation%20Banks.pdf", "confidence": "verified" }, "third_party": { "code": "assurance_only", "detail": "Banks must run joint resilience testing with vendors and partners, and must perform regular security reviews of payment processing service providers (§ 10.12.5). Neither clause requires penetration testing of suppliers.", "cite": "§ 6.1.12; § 10.12.5", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risks%20Regulation%20Banks.pdf", "quote": "Additionally, collaborative and coordinated resilience testing must be performed with vendors and partners to ensure the readiness of such capabilities in all interconnected systems and networks.", "confidence": "verified", "harmonized_from": "required", "harmonize_reason": "§ 6.1.12 joint resilience testing with vendors; § 10.12.5 security reviews of payment processors. No supplier penetration testing." }, "ot": { "code": "not_addressed", "detail": "No mention of operational technology or industrial control systems.", "cite": "No provision; full text reviewed (searched: operational technology, OT, ICS, SCADA, industrial)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risks%20Regulation%20Banks.pdf", "confidence": "verified" }, "payment_systems": { "code": "required", "detail": "Online banking must undergo vulnerability assessment and penetration testing. Applications linked to core banking must be tested (§ 10.15.3). Card operations must comply with PCI DSS and report compliance to QCB each year (§ 10.12.1 to 10.12.2). SWIFT is not mentioned.", "cite": "§ 10.10.8; § 10.15.3; § 10.12.1 to 10.12.2", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risks%20Regulation%20Banks.pdf", "quote": "The bank shall undertake a vulnerability assessment and penetration testing of its online banking system to minimize exposure to other forms of cyber attacks", "confidence": "verified" }, "cloud_saas": { "code": "permitted", "detail": "The 2018 circular gives banks a contractual right to penetration test cloud VM images, application instances and the provider's L3 switch (§ 8.9.11, § 8.9.13). The 2024 QCB Cloud Computing Regulation, which applies to all QCB-regulated entities, lists penetration testing for IaaS, PaaS and SaaS in its test table, uses \"should\" for performing it, lets entities hire a reputable third party, and requires the provider to supply a third-party report where the entity may not test.", "cite": "Cloud Computing Regulation 2024 Art. 22.1 to 22.3; Technology Risks § 8.9.11, § 8.9.13", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Cloud%20Computing%20Regulation.pdf", "quote": "An Entity should regularly perform the relevant test depending on the cloud service model used in a Cloud Computing Arrangement", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "Where the bank operates abroad through group intermediaries, or has representative offices, intermediaries or representatives, those individuals will not have access to its IT systems in Qatar (§ 9.10.1.15). That limits where people with access to the systems in scope may be located. Hosting must be in Qatar (§ 9.10.2.2), a data location rule R1 does not count alone. Nothing on multi-jurisdiction tests or where testers sit.", "cite": "§ 9.10.1.15; § 9.10.2.2 considered", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risks%20Regulation%20Banks.pdf", "confidence": "verified", "quote": "When the bank operates abroad through professional intermediary services (which are part of the group to which the establishment belongs), or when there are representative offices, intermediaries or representatives of these offices, these individuals will not have access to its IT systems in Qatar.", "history": [ { "date": "2026-10-30", "from": "not_addressed", "to": "addressed", "why": "§ 9.10.1.15 bars people in the bank's operations abroad from its IT systems in Qatar, a limit on where people with access to in-scope systems may sit, coded as IRS Pub 1075 Sec. 2.C.7 and CBB SIO-9.4.3(c)." } ], "harmonized_from": "not_addressed", "harmonize_reason": "R1: § 9.10.1.15 bars people in the bank's operations abroad from its IT systems in Qatar, a limit on where people with access to in-scope systems may sit, coded as IRS Pub 1075 Sec. 2.C.7 and CBB SIO-9.4.3(c)." }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming or replay provision.", "cite": "No provision; full text reviewed (searched: purple, replay, workshop, blue team, lessons)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risks%20Regulation%20Banks.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Each vulnerability exercise must compare results with the previous scans to confirm fixes, and an action plan must go to senior management. Accepted risks must be reviewed every six months (§ 9.4.3.4).", "cite": "§ 9.4.3.1 to 9.4.3.2", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risks%20Regulation%20Banks.pdf", "quote": "At a minimum, the bank must compare the results from previous vulnerability scans to verify that these vulnerabilities were addressed and mitigated.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "Banks send QCB an annual board-signed compliance report. QCB may audit at any time. Test reports are not sent to QCB and QCB does not lead tests.", "cite": "§ 7.1.1; § 7.1.3", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risks%20Regulation%20Banks.pdf", "quote": "QCB reserves the right to audit the bank to ensure compliance to this circular at any point in time.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Vulnerability assessments must combine automated tools and manual techniques. The circular does not mention AI. The separate QCB AI Guideline 2024 (§ 17.4, in force September 4, 2024) requires every QCB-regulated entity to examine an AI model's attack surface before deployment.", "cite": "§ 9.4.3.1", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risks%20Regulation%20Banks.pdf", "quote": "The bank shall deploy a combination of automated tools and manual techniques to perform a comprehensive Vulnerability Assessment (VA) exercise", "confidence": "verified" } } }, { "id": "qa-qcb-insurance-cyber", "jurisdiction": "Qatar", "region": "GCC", "sector": "financial", "name": "Insurance Sector Cyber Security Regulation", "short": "QCB insurance cyber", "issuer": "Qatar Central Bank (QCB)", "version": "FCSG001-REG-0004, V1.0, 09/05/2019. Effective and issue date fields blank. PDF byte-identical to the 2026-09-28 copy (SHA-256 06314404...afa7).", "status": "In force as of 2026-09-28 as far as the public record shows. PDF still served by QCB (HTTP 200 on 2026-09-28). No replacement found.", "public": "full", "primary_url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Insurance%20Sector%20Cyber%20Security%20Regulation.pdf", "arabic_title": "تعليمات الأمن السيبراني لقطاع التأمين", "regulator_arabic": "مصرف قطر المركزي", "arabic_source_url": "https://www.qcb.gov.qa/ar/Pages/Information-Security.aspx", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No cell changes. The QCB Digital Insurer Regulation (image-only PDF; file modified November 16, 2025; read by OCR) sets no testing duty of its own. It lists 'Related Instructions for Information & Cyber Security issued by QCB' and the 'Technology Risks circular issued by QCB in 2018' among the rules a digital insurer must follow. That reference to the bank circular for insurers was not resolved; it is recorded, not coded." }, "notes": "Text closely mirrors the 2018 bank circular, with the same testing cadence.", "cells": { "legal_force": { "code": "mandatory", "detail": "The insurance sector must comply and self-assess at least once a year.", "cite": "II. Purpose and applicability", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Insurance%20Sector%20Cyber%20Security%20Regulation.pdf", "quote": "The Insurance Sector in the State of Qatar is required to comply with the requirements set forth in this document.", "confidence": "verified" }, "scope": { "code": "insurers and brokers", "detail": "Covers insurance companies, insurers, carriers, underwriters, brokers and related parties.", "cite": "II. Purpose and applicability", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Insurance%20Sector%20Cyber%20Security%20Regulation.pdf", "quote": "the term “insurance companies” is used to refer to insurance companies, insurers, insurance carriers or underwriters as well as brokers and all related parties.", "confidence": "verified" }, "frequency": { "code": "every 6 months", "detail": "Two penetration tests a year, semi-annual testing of infrastructure and network devices, and quarterly penetration tests of wireless infrastructure.", "cite": "§ 9.4.3.3; § 9.1.1.5; § 9.1.8.5", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Insurance%20Sector%20Cyber%20Security%20Regulation.pdf", "quote": "The Insurance Company shall conduct two penetration testing exercises, or more frequently as needed, on an annual basis.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "§ 5.3.4 requires threat intelligence feeds for risk mitigation, not for test design.", "cite": "No provision; full text reviewed (searched: threat intelligence, threat-led, scenario, red team)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Insurance%20Sector%20Cyber%20Security%20Regulation.pdf", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "Silent on who performs tests and on tester credentials.", "cite": "No provision; full text reviewed (searched: certified, CREST, external, independent, tester, provider)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Insurance%20Sector%20Cyber%20Security%20Regulation.pdf", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Silent on internal testers.", "cite": "No provision; full text reviewed (searched: internal, in-house, tester, independent)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Insurance%20Sector%20Cyber%20Security%20Regulation.pdf", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "Training to recognize social engineering is required (§ 2.2.6). Testing is not mentioned.", "cite": "No provision; full text reviewed (searched: social engineering, phishing simulation, test)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Insurance%20Sector%20Cyber%20Security%20Regulation.pdf", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Physical controls are required but physical testing is not mentioned.", "cite": "No provision; full text reviewed (searched: physical penetration, physical test, red team)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Insurance%20Sector%20Cyber%20Security%20Regulation.pdf", "confidence": "verified" }, "third_party": { "code": "assurance_only", "detail": "Joint resilience testing with vendors and partners is mandatory. It is not a penetration test requirement for suppliers.", "cite": "§ 6.1.12", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Insurance%20Sector%20Cyber%20Security%20Regulation.pdf", "quote": "Additionally, collaborative and coordinated resilience testing must be performed with vendors and partners to ensure the readiness of such capabilities in all interconnected systems and networks.", "confidence": "verified", "harmonized_from": "required", "harmonize_reason": "§ 6.1.12 joint resilience testing with vendors; not a security test of suppliers." }, "ot": { "code": "not_addressed", "detail": "No mention of OT or ICS.", "cite": "No provision; full text reviewed (searched: operational technology, OT, ICS, SCADA)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Insurance%20Sector%20Cyber%20Security%20Regulation.pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "The insurer must run a vulnerability assessment and penetration test of its online system (§ 10.8.6). Card data must be handled under PCI DSS (§ 10.10.1), and an online payment platform's provider must be PCI DSS and PA-DSS certified (§ 10.10.3). R8 does not count PCI DSS duties without the regulator's own testing clause, and insurers are not payment firms. Coded as the CBUAE e-insurance regulation, whose website test also sits beside premium payments.", "cite": "No security testing provision naming payment systems; § 10.8.6, § 10.10.1 and § 10.10.3 considered", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Insurance%20Sector%20Cyber%20Security%20Regulation.pdf", "confidence": "verified", "history": [ { "date": "2026-10-30", "from": "required", "to": "not_addressed", "why": "The test clause (§ 10.8.6) names the insurer's online system, not a payment system, and the payment card clauses are PCI DSS and PA-DSS duties without a QCB testing clause; coded as the CBUAE e-insurance regulation." } ], "harmonized_from": "required", "harmonize_reason": "R8: The test clause (§ 10.8.6) names the insurer's online system, not a payment system, and the payment card clauses are PCI DSS and PA-DSS duties without a QCB testing clause; coded as the CBUAE e-insurance regulation." }, "cloud_saas": { "code": "permitted", "detail": "Contractual right to penetration test cloud VM images, application instances and the provider's L3 switch (§ 8.9.11, § 8.9.13). The 2024 QCB Cloud Computing Regulation Art. 22 applies on top and lists penetration testing for IaaS, PaaS and SaaS with \"should\" language.", "cite": "§ 8.9.11; § 8.9.13; Cloud Computing Regulation 2024 Art. 22.3", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Insurance%20Sector%20Cyber%20Security%20Regulation.pdf", "quote": "The Insurance Company shall have contractual power to conduct a penetration test on the Virtual Machine (VM) image/infrastructure and application instance provided to the company by the cloud provider, if feasible.", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "Where the insurer operates abroad through group intermediaries, or has representative offices, intermediaries or representatives, those individuals will not have access to its IT systems in Qatar (§ 9.10.1.16). That limits where people with access to the systems in scope may be located. Hosting must be in Qatar or in countries that meet QCB outsourcing rules (§ 9.10.2.2), and multi-location outsourcing risk must be assessed (§ 9.10.2.4); R1 does not count those alone. Nothing on multi-jurisdiction tests or where testers sit.", "cite": "§ 9.10.1.16; § 9.10.2.2 and § 9.10.2.4 considered", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Insurance%20Sector%20Cyber%20Security%20Regulation.pdf", "confidence": "verified", "quote": "When the Insurance Company operates abroad through professional intermediary services (which are part of the group to which the establishment belongs), or when there are representative offices, intermediaries or representatives of these offices, these individuals will not have access to its IT systems in Qatar.", "history": [ { "date": "2026-10-30", "from": "not_addressed", "to": "addressed", "why": "§ 9.10.1.16 bars people in the insurer's operations abroad from its IT systems in Qatar, the same limit as the QCB bank regulation § 9.10.1.15." } ], "harmonized_from": "not_addressed", "harmonize_reason": "R1: § 9.10.1.16 bars people in the insurer's operations abroad from its IT systems in Qatar, the same limit as the QCB bank regulation § 9.10.1.15." }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming or replay provision.", "cite": "No provision; full text reviewed (searched: purple, replay, workshop, blue team)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Insurance%20Sector%20Cyber%20Security%20Regulation.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Results must be compared with earlier scans to confirm fixes, and an action plan must go to senior management.", "cite": "§ 9.4.3.1 to 9.4.3.2", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Insurance%20Sector%20Cyber%20Security%20Regulation.pdf", "quote": "An action plan to address identified vulnerabilities shall be prepared and shared with the senior management.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "Annual compliance report to QCB. QCB may audit at any time.", "cite": "§ 7.1.1; § 7.1.3", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Insurance%20Sector%20Cyber%20Security%20Regulation.pdf", "quote": "QCB reserves the right to audit the Insurance Company to ensure compliance to this circular at any point in time.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Vulnerability assessments must combine automated tools and manual techniques. AI is not mentioned. The QCB AI Guideline 2024 § 17.4 applies separately.", "cite": "§ 9.4.3.1", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Insurance%20Sector%20Cyber%20Security%20Regulation.pdf", "quote": "The Insurance Company shall deploy a combination of automated tools and manual techniques to perform a comprehensive Vulnerability Assessment (VA) exercise", "confidence": "verified" } } }, { "id": "qa-qcb-psp-cyber-2022", "jurisdiction": "Qatar", "region": "GCC", "sector": "financial", "name": "Information and Cyber Security Regulation for Payment Service Providers", "short": "QCB PSP cyber", "issuer": "Qatar Central Bank (QCB)", "version": "V1.2 For Release, April 2022. PDF byte-identical to the 2026-09-28 copy (SHA-256 629ca277...e08e).", "status": "In force as of 2026-09-28 as far as the public record shows. PDF still served by QCB (HTTP 200 on 2026-09-28). No replacement found.", "public": "full", "primary_url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Information%20and%20Cyber%20Security%20Regulation%20for%20PSPs.pdf", "arabic_title": "تعليمات الأمن المعلوماتي والسيبراني لمقدمي خدمات الدفع", "regulator_arabic": "مصرف قطر المركزي", "arabic_source_url": "https://www.qcb.gov.qa/ar/Pages/Information-Security.aspx", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No cell changes. The QCB Payment Services Regulation (licensing) sends licensees back to this text: § 12.8 requires compliance with 'the regulation on Information and Cyber Security for Fintech' and PCI-DSS. No circular number for this regulation was found in the QCB supervision circulars library (653 items)." }, "notes": "The strictest Qatari financial testing text found: external certified testers with a regional presence, twice-yearly tests, and threat-intelligence-scoped attack simulation (§ 15.6). It does not describe a red team framework, a control team, or regulator involvement.", "cells": { "legal_force": { "code": "mandatory", "detail": "Any applicant for payment services must follow it. Breach can lead to penalties under Art. 216 of QCB Law No. 13 of 2012 (Part D).", "cite": "Purpose; Part D", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Information%20and%20Cyber%20Security%20Regulation%20for%20PSPs.pdf", "quote": "any applicant intending to provide payment services within the financial sector in the State of Qatar shall abide by it.", "confidence": "verified" }, "scope": { "code": "licensed PSPs, incl. sandbox", "detail": "All payment service providers under the QCB Payment Services Regulation, including while in the sandbox, and as the baseline after it.", "cite": "Scope", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Information%20and%20Cyber%20Security%20Regulation%20for%20PSPs.pdf", "quote": "This regulation applies to all Payment Service Providers as defined in the QCB Payment Services Regulation", "confidence": "verified" }, "frequency": { "code": "every 6 months", "detail": "Vulnerability assessments, code reviews and penetration tests at least twice a year. Vulnerability assessment is continuous (§ 14.4). Cyberattack simulation testing is periodic (§ 15.6).", "cite": "§ 14.3", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Information%20and%20Cyber%20Security%20Regulation%20for%20PSPs.pdf", "quote": "The Payment Service Provider shall perform vulnerability assessments, code reviews and penetration testing at least twice a year, or more frequently as needed, for the entire application infrastructure.", "confidence": "verified" }, "threat_intel": { "code": "required", "detail": "PSPs must run periodic cyberattack simulation testing whose coverage and scope are based on their risk profile and available threat intelligence. This is the only Qatari financial text found that ties test scope to threat intelligence.", "cite": "§ 15.6", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Information%20and%20Cyber%20Security%20Regulation%20for%20PSPs.pdf", "quote": "The Payment Service Provider shall periodically conduct cyberattack simulation testing on their systems. The coverage and scope of testing shall be based on the cyber security risk profile and threat intelligence available.", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Tests must be done by an external, reputable provider that holds \"the required certificates\" and has regional offices. The certificates are not named.", "cite": "§ 14.3", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Information%20and%20Cyber%20Security%20Regulation%20for%20PSPs.pdf", "quote": "They shall ensure that these exercises are performed by an external, reputable penetration testing provider that has the required certificates, with regional offices.", "confidence": "verified" }, "internal_testers": { "code": "not_allowed", "detail": "The twice-yearly tests must be performed by an external provider, so internal teams cannot satisfy the rule. Internal teams are not otherwise mentioned.", "cite": "§ 14.3", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Information%20and%20Cyber%20Security%20Regulation%20for%20PSPs.pdf", "quote": "They shall ensure that these exercises are performed by an external, reputable penetration testing provider", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "No social engineering training or testing provision.", "cite": "No provision; full text reviewed (searched: social engineering, phishing, awareness test)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Information%20and%20Cyber%20Security%20Regulation%20for%20PSPs.pdf", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Physical controls are required (§ 16) but physical testing is not mentioned.", "cite": "No provision; full text reviewed (searched: physical penetration, physical test, red team)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Information%20and%20Cyber%20Security%20Regulation%20for%20PSPs.pdf", "confidence": "verified" }, "third_party": { "code": "permitted", "detail": "The only supplier testing provision is the contractual right to penetration test the cloud provider's hosting infrastructure. Other outsourcing clauses (§ 20) cover due diligence and contracts, not testing.", "cite": "§ 6.12", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Information%20and%20Cyber%20Security%20Regulation%20for%20PSPs.pdf", "quote": "The Payment Service Provider shall have contractual power to conduct a penetration test on the hosting infrastructure and application instances provided to the PSP by the cloud service provider.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No mention of OT or ICS.", "cite": "No provision; full text reviewed (searched: operational technology, OT, ICS, SCADA)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Information%20and%20Cyber%20Security%20Regulation%20for%20PSPs.pdf", "confidence": "verified" }, "payment_systems": { "code": "required", "detail": "Online payment applications must get vulnerability assessment and penetration testing on the § 14.3 cadence. Card acceptance must meet PCI DSS (§ 23.2).", "cite": "§ 22.2; § 23.2", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Information%20and%20Cyber%20Security%20Regulation%20for%20PSPs.pdf", "quote": "The Payment Service Provider shall undertake a vulnerability assessment and penetration testing of its online application(s) as indicated in A 14.3", "confidence": "verified" }, "cloud_saas": { "code": "permitted", "detail": "Contractual right to penetration test cloud hosting infrastructure and application instances. Cloud providers must have data centers in Qatar unless QCB approves (§ 6.2). The 2024 QCB Cloud Computing Regulation Art. 22 applies on top.", "cite": "§ 6.12", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Information%20and%20Cyber%20Security%20Regulation%20for%20PSPs.pdf", "quote": "The Payment Service Provider shall have contractual power to conduct a penetration test on the hosting infrastructure and application instances provided to the PSP by the cloud service provider.", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "The testing provider must have regional offices, a location condition on who may test. Cloud processing of client and transaction data must stay in Qatar (§ 6.2 to 6.3).", "cite": "§ 14.3", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Information%20and%20Cyber%20Security%20Regulation%20for%20PSPs.pdf", "quote": "performed by an external, reputable penetration testing provider that has the required certificates, with regional offices.", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming or replay provision.", "cite": "No provision; full text reviewed (searched: purple, replay, workshop, blue team)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Information%20and%20Cyber%20Security%20Regulation%20for%20PSPs.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Scan results must be compared with earlier scans to confirm fixes, an action plan must go to senior management (§ 14.5), and simulation findings must be fixed in a timely manner (§ 15.6).", "cite": "§ 14.4; § 14.5; § 15.6", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Information%20and%20Cyber%20Security%20Regulation%20for%20PSPs.pdf", "quote": "At a minimum, the Payment Service Provider must compare the results from previous vulnerability scans to verify that these vulnerabilities were addressed and mitigated.", "confidence": "verified" }, "regulator_role": { "code": "not_addressed", "detail": "No provision on submitting test results to QCB or on QCB overseeing tests. Part D only refers to penalties for non-compliance.", "cite": "No provision; full text reviewed (searched: QCB, report, submit, audit, results, supervisor)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Information%20and%20Cyber%20Security%20Regulation%20for%20PSPs.pdf", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Continuous vulnerability assessment must combine automated tools and manual techniques. DevSecOps must automate vulnerability scanning (§ 17.7). § 24 sets AI controls, including testing processes under a strict SDLC (§ 24.8).", "cite": "§ 14.4; § 17.7; § 24.8", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Information%20and%20Cyber%20Security%20Regulation%20for%20PSPs.pdf", "quote": "The Payment Service Provider shall deploy a combination of automated tools and manual techniques to perform a comprehensive Vulnerability Assessment (VA) exercise in a continuous basis.", "confidence": "verified" } } }, { "id": "qa-qcb-fso-tech-risk-2022", "jurisdiction": "Qatar", "region": "GCC", "sector": "financial", "name": "Technology Risk Instructions for Financial Services Operators", "short": "QCB FSO tech risk", "issuer": "Qatar Central Bank (QCB)", "version": "V1.2 Revised, 9/6/2022. Issued by QCB Circulars 5/2022 (finance companies, September 15, 2022), 3/2022 (investment companies, September 16, 2022) and 6/2022 (exchange houses, September 16, 2022). PDF byte-identical to the 2026-09-28 copy (SHA-256 71d6c40d...c33cfc).", "status": "In force as of 2026-09-28 as far as the public record shows. PDF still served by QCB (HTTP 200 on 2026-09-28). No replacement found.", "public": "full", "primary_url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risk%20Instructions%20for%20Financial%20Services%20Operators.pdf", "arabic_title": "تعليمات مخاطر التكنولوجيا لمقدمي الخدمات المالية", "regulator_arabic": "مصرف قطر المركزي", "arabic_source_url": "https://www.qcb.gov.qa/ar/Pages/Information-Security.aspx", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No cell changes. Resolves part of a September open item: QCB's supervision library holds the issuing circulars. Each says: 'These instructions are effective from the date of this circular, and compliance adjustments must be completed within six months.' Circular 6/2022 adds that 'these instructions shall replace the Technology Risk Guidelines for Exchange Houses No. (31/2015)'. The appendix filed with Circular 5/2022 (https://www.qcb.gov.qa/PublicationFilesSupervision/052022%20-%20FC%20-A1.pdf, image-only, read by OCR) is QCB-ISR-FSO V1.2 itself. The circulars are English translations. QCB's Arabic circular title differs from the Arabic document title used here: 'تعليمات مخاطر التكنولوجيا الحديثة الخاصة بالمؤسسات المقدمة للخدمات المالية' (Circular 5/2022 listing). Circular 1/2026 (February 1, 2026) adds an annual business continuity test for these firms; it is not a security test (see left_out)." }, "notes": "The only QCB text found that requires social engineering tests of staff.", "cells": { "legal_force": { "code": "mandatory", "detail": "FSOs must comply and treat the instructions as minimum requirements.", "cite": "§ 3.1.1", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risk%20Instructions%20for%20Financial%20Services%20Operators.pdf", "quote": "Financial Service Operators are required to comply with the requirements defined in this instructions document.", "confidence": "verified" }, "scope": { "code": "exchange houses, investment cos, finance houses", "detail": "All QCB-regulated exchange houses, investment companies, finance houses and their brokers operating in Qatar.", "cite": "Scope", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risk%20Instructions%20for%20Financial%20Services%20Operators.pdf", "quote": "Technology risk instructions shall apply to all Financial Service Operators including exchange houses, investment companies, finance houses and their relevant brokers", "confidence": "verified" }, "frequency": { "code": "regularly (not specified)", "detail": "Testing must be regular. No interval is given. Social engineering tests of staff are also \"regular\" (§ 1.5.3).", "cite": "§ 2.1.4", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risk%20Instructions%20for%20Financial%20Services%20Operators.pdf", "quote": "Financial Service Operators shall regularly perform vulnerability assessments, code reviews and penetration testing for their network, systems and applications.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "§ 1.2.5 requires monitoring exposure to threat actors, but not threat-intelligence-driven tests.", "cite": "No provision; full text reviewed (searched: threat intelligence, threat-led, scenario, simulation)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risk%20Instructions%20for%20Financial%20Services%20Operators.pdf", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "External, reputable provider with \"the required certificates\" and regional offices. Certificates not named.", "cite": "§ 2.1.4", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risk%20Instructions%20for%20Financial%20Services%20Operators.pdf", "quote": "They shall ensure that these exercises are performed by an external, reputable penetration testing provider that has the required certificates, with regional offices.", "confidence": "verified" }, "internal_testers": { "code": "not_allowed", "detail": "The required tests must be performed by an external provider.", "cite": "§ 2.1.4", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risk%20Instructions%20for%20Financial%20Services%20Operators.pdf", "quote": "these exercises are performed by an external, reputable penetration testing provider", "confidence": "verified" }, "social_engineering": { "code": "required", "detail": "The awareness program must include regular social engineering testing of employees.", "cite": "§ 1.5.3", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risk%20Instructions%20for%20Financial%20Services%20Operators.pdf", "quote": "The security awareness program shall include the regular testing of the employees via social engineering techniques, amongst other techniques.", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Physical controls are required (§ 2.12) but physical testing is not mentioned.", "cite": "No provision; full text reviewed (searched: physical penetration, physical test, red team)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risk%20Instructions%20for%20Financial%20Services%20Operators.pdf", "confidence": "verified" }, "third_party": { "code": "permitted", "detail": "Only the cloud provider testing right. Third-party clauses (§ 1.7) require due diligence, contracts and posture reporting, not testing.", "cite": "§ 1.8.12", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risk%20Instructions%20for%20Financial%20Services%20Operators.pdf", "quote": "Financial Service Operators shall have contractual power to conduct a penetration test on the hosting infrastructure and application instances provided to the FSO by the cloud service provider.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No mention of OT or ICS.", "cite": "No provision; full text reviewed (searched: operational technology, OT, ICS, SCADA)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risk%20Instructions%20for%20Financial%20Services%20Operators.pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "PCI DSS appears only as a contract standard for third parties when payment acquiring is involved (§ 1.7.3). No payment system testing provision.", "cite": "No provision; full text reviewed (searched: payment, PCI, SWIFT, card, market infrastructure)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risk%20Instructions%20for%20Financial%20Services%20Operators.pdf", "confidence": "verified" }, "cloud_saas": { "code": "permitted", "detail": "Contractual right to penetration test cloud hosting infrastructure. Cloud data centers must be in Qatar unless QCB approves (§ 1.8.2). The 2024 QCB Cloud Computing Regulation Art. 22 applies on top.", "cite": "§ 1.8.12", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risk%20Instructions%20for%20Financial%20Services%20Operators.pdf", "quote": "Financial Service Operators shall have contractual power to conduct a penetration test on the hosting infrastructure and application instances provided to the FSO by the cloud service provider.", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "The testing provider must have regional offices, a location condition on testers.", "cite": "§ 2.1.4", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risk%20Instructions%20for%20Financial%20Services%20Operators.pdf", "quote": "performed by an external, reputable penetration testing provider that has the required certificates, with regional offices.", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming or replay provision.", "cite": "No provision; full text reviewed (searched: purple, replay, workshop, blue team)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risk%20Instructions%20for%20Financial%20Services%20Operators.pdf", "confidence": "verified" }, "remediation_retest": { "code": "not_addressed", "detail": "No rule on fixing or retesting test findings. § 3.1.3 requires the annual compliance report to list control gaps and remedial action in general terms.", "cite": "No provision; full text reviewed (searched: remediation, retest, action plan, fix, track)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risk%20Instructions%20for%20Financial%20Services%20Operators.pdf", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "FSOs report compliance to QCB at least annually and on request. QCB may audit at any time.", "cite": "§ 3.1.2; § 3.1.4", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risk%20Instructions%20for%20Financial%20Services%20Operators.pdf", "quote": "Financial Service Operators shall report their compliance to the requirements of this document, at least on annual basis and upon QCB’s request.", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "Automation appears only for log monitoring (§ 2.10.7) and backups, not testing. No AI provision. The QCB AI Guideline 2024 § 17.4 applies separately.", "cite": "No provision; full text reviewed (searched: automated, continuous, artificial intelligence, AI, machine learning)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risk%20Instructions%20for%20Financial%20Services%20Operators.pdf", "confidence": "verified" } } }, { "id": "qa-qfcra-ctrl-ict-risk", "jurisdiction": "Qatar", "region": "GCC", "sector": "financial", "name": "Governance and Controlled Functions Rules 2020 (CTRL), Part 8.5 ICT and information security risks (with Parts 8.3 and 8.4)", "short": "QFCRA CTRL 8.5", "issuer": "Qatar Financial Centre Regulatory Authority (QFCRA)", "version": "Parts 8.3 to 8.5 as from October 1, 2025 (RM/2024-4; 8.5.3 guidance amended by RM/2025-1); pages byte-identical to the 2026-09-28 copies. CTRL 1.1.4 (application) amended by QFCRA RM/2026-1 as from May 1, 2026.", "status": "In force from October 1, 2025 (rulebook notes read on 2026-09-28).", "public": "full", "primary_url": "https://qfcra-en.thomsonreuters.com/entiresection/15237", "arabic_title": "قواعد الحوكمة والمهام المحدّدة (أو الوظائف الخاضعة للرقابة) لعام 2020", "regulator_arabic": "هيئة تنظيم مركز قطر للمال", "arabic_source_url": "https://qfcra-en.thomsonreuters.com/sites/default/files/net_file_store/QFCRA_9107_VER3_ARABIC.docx", "arabic_note": "QFCRA states that the Arabic translation is not authoritative and that the English text prevails. The Arabic version predates the RM/2026-1 change to rule 1.1.4.", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "amended", "note": "Other 2026 QFCRA instruments leave Part 8 alone. RM/2026-3 (dated October 5, 2026) only inserts a note after CTRL 6.2.1, from November 1, 2026. RM/2026-2 (from May 1, 2026) does not amend CTRL. Consultation Paper 2026/01 (October 6, 2026; comments by November 19, 2026; proposed start April 1, 2027) would add risk data aggregation and opaque-structure duties to CTRL Chapters 3 and 7, not Part 8. The Arabic title is from QFCRA's Arabic Word version of CTRL (version 3, effective October 1, 2025), linked as 'Current Word Version - Arabic' on the English rulebook page. QFCRA states that the Arabic translation is not authoritative and that the English text prevails. The QFCRA Arabic name appears on its Arabic rules page and in that translation." }, "notes": "QFCRA regulates firms inside the Qatar Financial Centre, a separate jurisdiction from onshore QCB supervision. Red team exercises are named only as a guidance example. Parts 8.3 (operational resilience) and 8.4 (outsourcing) were read in full for third-party and remediation cells.", "cells": { "legal_force": { "code": "mixed", "detail": "Rules (\"must\") require mitigation of ICT and information security risks. Penetration tests and red team exercises appear only in Guidance as examples of review, assessment and testing.", "cite": "CTRL 8.5.5(3) and Guidance 1(e)", "url": "https://qfcra-en.thomsonreuters.com/entiresection/15237", "quote": "Examples of review, assessment and testing • gap analysis against information security standards • compliance reviews • internal and external audits of information systems • physical security reviews • source code reviews • vulnerability assessments • penetration tests • red team exercises", "confidence": "verified" }, "scope": { "code": "QFC authorised firms except wholesale advisory firms", "detail": "RM/2026-1 (commenced May 1, 2026) took wholesale advisory firms out of CTRL, and so out of Part 8.5. A wholesale advisory firm is an advisory firm that is a branch and whose customers are only high-asset companies, state-owned enterprises, governments, state investment bodies, public debt bodies, central banks or supranational organizations (INMA 9C.1.2(1)). The new INMA Chapter 9C that now governs them has no ICT testing provision (searched: ICT, cyber, information security, penetration). The change predates the September snapshot; September read only Parts 8.3 to 8.5, where rule 1.1.4 does not appear.", "cite": "CTRL 1.1.4(1) and (3), amended by QFCRA RM/2026-1 (as from May 1, 2026); INMA 9C.1.2(1)", "url": "https://qfcra-en.thomsonreuters.com/entiresection/13000", "quote": "(1) These rules apply in relation to: (a) an authorised firm other than a wholesale advisory firm; and (b) to the extent the firm carries on a regulated activity in or from the QFC.", "confidence": "verified", "history": [ { "date": "2026-10-30", "from": "QFC authorised firms", "to": "QFC authorised firms except wholesale advisory firms", "why": "RM/2026-1 (commenced May 1, 2026) took wholesale advisory firms out of CTRL, and so out of Part 8.5. A wholesale advisory firm is an advisory firm that is a branch and whose customers are only high-asset companies, state-owned enterprises, governments, state investment bodies, public debt bodies, central banks or supranational organizations (INMA 9C.1.2(1)). The new INMA Chapter 9C that now governs them has no ICT testing provision (searched: ICT, cyber, information security, penetration). The change predates the September snapshot; September read only Parts 8.3 to 8.5, where rule 1.1.4 does not appear." } ] }, "frequency": { "code": "risk-based", "detail": "Firms must monitor mitigation effectiveness \"including through regular testing\". Scenario testing of impact tolerances is periodic (CTRL 8.3.7(1)). No interval is set.", "cite": "CTRL 8.5.2(1)(e)", "url": "https://qfcra-en.thomsonreuters.com/entiresection/15237", "quote": "monitor the effectiveness of mitigation measures (including through regular testing), as well as the number of reported incidents, and take action to correct the measures where necessary", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Scenario design should consider past breaches and near misses in the firm, the sector and other jurisdictions (CTRL 8.3.7 Guidance 1). Threat intelligence is not mentioned.", "cite": "No provision; full text reviewed (searched: threat intelligence, threat-led, intelligence)", "url": "https://qfcra-en.thomsonreuters.com/entiresection/15237", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "No tester qualification rules. CTRL 8.5.2 Guidance 6 suggests audit assurance by internal audit or independent experts, which concerns governance audits, not testing.", "cite": "No provision; full text reviewed (searched: accredited, certified, qualified, independent, tester, provider)", "url": "https://qfcra-en.thomsonreuters.com/entiresection/15237", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Silent on who performs security tests.", "cite": "No provision; full text reviewed (searched: internal, in-house, tester, independent)", "url": "https://qfcra-en.thomsonreuters.com/entiresection/15237", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "Red team exercises are listed, but social engineering is not.", "cite": "No provision; full text reviewed (searched: social engineering, phishing)", "url": "https://qfcra-en.thomsonreuters.com/entiresection/15237", "confidence": "verified" }, "physical": { "code": "controls_test", "detail": "\"Physical security reviews\" are listed as an example of review, assessment and testing in guidance.", "cite": "CTRL 8.5.5 Guidance 1(e)", "url": "https://qfcra-en.thomsonreuters.com/entiresection/15237", "quote": "Examples of review, assessment and testing • gap analysis against information security standards • compliance reviews • internal and external audits of information systems • physical security reviews", "confidence": "verified", "harmonized_from": "permitted", "harmonize_reason": "CTRL 8.5.5 Guidance 1(e) lists physical security reviews as a form of review and testing." }, "third_party": { "code": "assurance_only", "detail": "Before and during outsourcing, firms should gain comfort through control testing and independent assurance, and should show providers' security is at least as strong as their own. Scenario tests should identify reliance on third parties (CTRL 8.3.7 Guidance 4).", "cite": "CTRL 8.4.5 Guidance 2 to 3", "url": "https://qfcra-en.thomsonreuters.com/entiresection/15223", "quote": "This could be achieved through a combination of interviews, service reporting, control testing, certifications, attestations, referrals and independent assurance assessments.", "confidence": "verified", "harmonized_from": "permitted", "harmonize_reason": "CTRL 8.4.5 Guidance 2 to 3: comfort through control testing and independent assurance of providers." }, "ot": { "code": "not_addressed", "detail": "No mention of OT or ICS.", "cite": "No provision; full text reviewed (searched: operational technology, OT, ICS, SCADA, industrial)", "url": "https://qfcra-en.thomsonreuters.com/entiresection/15237", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "Payments are listed as an example of a critical operation for resilience (CTRL 8.3.2 guidance), but no payment system security testing provision exists.", "cite": "No provision; full text reviewed (searched: payment, SWIFT, card, market infrastructure)", "url": "https://qfcra-en.thomsonreuters.com/entiresection/15237", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "No cloud or SaaS testing provision in Parts 8.3 to 8.5.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, hosting)", "url": "https://qfcra-en.thomsonreuters.com/entiresection/15237", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "Correction, not a new rule. CTRL, including the Part 8.5 testing duty, reaches a firm's governance outside the QFC and any function performed outside the QFC by or for the firm, to the extent it relates to regulated activity in or from the QFC. The quoted wording dates from RM/2026-1 (May 1, 2026). The rule it replaced, CTRL 1.1.4(2)(b) in versions 1 to 3 (July 1, 2021 to April 30, 2026), already covered 'every function exercised by or on behalf of an authorised firm outside the QFC (including any outsourced function)'. September missed it because only Parts 8.3 to 8.5 were read. Coded the same way as other rules that extend to foreign branches or functions (for example CBB OM-5.5.6, CBO § 1.4). Nothing on multi-jurisdiction tests or recognition of tests run abroad.", "cite": "CTRL 1.1.4(2)", "url": "https://qfcra-en.thomsonreuters.com/entiresection/13000", "confidence": "verified", "history": [ { "date": "2026-10-30", "from": "not_addressed", "to": "addressed", "why": "Correction, not a new rule. CTRL, including the Part 8.5 testing duty, reaches a firm's governance outside the QFC and any function performed outside the QFC by or for the firm, to the extent it relates to regulated activity in or from the QFC. The quoted wording dates from RM/2026-1 (May 1, 2026). The rule it replaced, CTRL 1.1.4(2)(b) in versions 1 to 3 (July 1, 2021 to April 30, 2026), already covered 'every function exercised by or on behalf of an authorised firm outside the QFC (including any outsourced function)'. September missed it because only Parts 8.3 to 8.5 were read. Coded the same way as other rules that extend to foreign branches or functions (for example CBB OM-5.5.6, CBO § 1.4). Nothing on multi-jurisdiction tests or recognition of tests run abroad." } ], "quote": "these rules also apply in relation to: (a) an authorised firm’s governance outside the QFC, including: (i) the firm’s risk management framework; and (ii) the firm’s governance policies and procedures; and (b) any function performed outside the QFC by, or on behalf of, an authorised firm." }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming or replay provision.", "cite": "No provision; full text reviewed (searched: purple, replay, workshop, blue team)", "url": "https://qfcra-en.thomsonreuters.com/entiresection/15237", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "If a scenario test shows impact tolerances may be breached, the firm must assess weaknesses and build a remediation plan approved and tracked by the governing body. CTRL 8.5.2(1)(e) also requires corrective action.", "cite": "CTRL 8.3.7(3)", "url": "https://qfcra-en.thomsonreuters.com/entiresection/15210", "quote": "the firm must assess whether the test has identified weaknesses or vulnerabilities that require the firm to develop and implement a remediation plan", "confidence": "verified" }, "regulator_role": { "code": "not_addressed", "detail": "No rule on sending test results to QFCRA. Guidance says firms tolerating a breached impact tolerance must be able to explain their reasoning to the Authority (CTRL 8.3.7 Guidance 5).", "cite": "No provision; full text reviewed (searched: Regulatory Authority, report, submit, notify, results)", "url": "https://qfcra-en.thomsonreuters.com/entiresection/15237", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "No automated testing or AI provision in Parts 8.3 to 8.5.", "cite": "No provision; full text reviewed (searched: automated, continuous, artificial intelligence, AI)", "url": "https://qfcra-en.thomsonreuters.com/entiresection/15237", "confidence": "verified" } } }, { "id": "qa-ncsa-nia-standard", "jurisdiction": "Qatar", "region": "GCC", "sector": "cross-sector", "name": "National Information Assurance Standard [IAS-NAT-INFA]", "short": "NCSA NIA Standard v2.1", "issuer": "National Cyber Security Agency (NCSA), National Cyber Governance and Assurance Affairs", "version": "V2.1, May 2023 (listed on the NCSA publications page 2025-12-09). PDF byte-identical to the 2026-09-28 copy (SHA-256 4d5dad70...3743).", "status": "In force as of 2026-09-28. Effective on publication in May 2023 (§ 6.2.2). NCSA stopped accepting certification applications against NIAP V2.0 after December 31, 2023 (§ 6.2.1). No V2.2 or V3 was found on the NCSA publications list (134 records, read 2026-09-28).", "public": "full", "primary_url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/9727/1.0~c6f84b60-72b0-40cc-b6cd-052aefab50e1?mimetype=application%2Fpdf&filename=NCSA_CSGA_%20National_Information_Assurance_Standard_En_V2.1%20%283%29.pdf", "arabic_title": "معيار تأمين المعلومات الوطنية", "regulator_arabic": "الوكالة الوطنية للأمن السيبراني", "arabic_source_url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/9728/1.0~6bf9e2d6-b1f6-481d-8921-53f803c9b65e?mimetype=application/pdf&filename=NCSA_CSGA_%20National_Information_Assurance_Standard_Ar_V2.1%20(1).pdf", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No cell changes. No V2.2 or V3 on the NCSA publications list (136 records, 2026-10-30). The NCSA compliance register now lists 27 organizations: 20 certified, 6 under audit, 1 terminated (26 on 2026-09-28: 17, 8, 1). NCSA published the National and Enterprise Information Security Risk Management Frameworks on 2026-09-29; they add risk reporting duties, not testing duties (see left_out). The Arabic title and NCSA name are read from the cover of NCSA's Arabic V2.1 PDF." }, "notes": "NIA v2.1 replaces the NIAP v2.0 cited in the 2018 QCB bank circular. NCSA's Vulnerability Management Guidelines V1.0 (2026) cover critical infrastructure operators: at least daily scans of agent-capable assets (§ 6.2 e), active scanning of 100% of critical assets (§ 6.8 b), and penetration testing as one way to validate fixes (§ 6.4 f). Its cover marks it \"Currently Confidential to be made Public after approval\" although NCSA publishes it. The Qatar Cybersecurity Framework on the NCSA publications list is the 2018 Qatar 2022 World Cup framework (Supreme Committee, V1.0, August 5, 2018), not a new national standard.", "cells": { "legal_force": { "code": "mixed", "detail": "Baseline controls marked * are mandatory for assets rated above the lowest level. The penetration testing reference (IM 9) is not a baseline control and uses \"may\". NCSA's NISCF booklet says all critical organizations must hold NIA certification.", "cite": "§ 2.3 Usage; IM 9", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/9727/1.0~c6f84b60-72b0-40cc-b6cd-052aefab50e1?mimetype=application%2Fpdf&filename=NCSA_CSGA_%20National_Information_Assurance_Standard_En_V2.1%20%283%29.pdf", "quote": "Within this standard, baseline controls (indicated by ‘*’) are mandatory and must be implemented", "confidence": "verified" }, "scope": { "code": "all Qatar orgs; certification for critical orgs", "detail": "Applies to all organizations and their information assets, including outsourced processes. The NISCF booklet (p. 4) says critical organizations must obtain NIA certification. On 2026-09-28 the NCSA compliance register listed 26 organizations: 17 certified (14 on v2.1, 3 on v2.0), 8 under audit, 1 terminated.", "cite": "§ 2.2 Scope", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/9727/1.0~c6f84b60-72b0-40cc-b6cd-052aefab50e1?mimetype=application%2Fpdf&filename=NCSA_CSGA_%20National_Information_Assurance_Standard_En_V2.1%20%283%29.pdf", "quote": "This standard applies to all Organizations and their corresponding information assets.", "confidence": "verified" }, "frequency": { "code": "annual (pentest optional)", "detail": "The incident management coordinator must run an annual Security Assurance Plan that \"may include\" penetration testing. The information system audit is annual (AC 4, baseline).", "cite": "IM 9; AC 4", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/9727/1.0~c6f84b60-72b0-40cc-b6cd-052aefab50e1?mimetype=application%2Fpdf&filename=NCSA_CSGA_%20National_Information_Assurance_Standard_En_V2.1%20%283%29.pdf", "quote": "The Incident Management coordinator is responsible for developing and executing an annual Security Assurance Plan. This may include activities such as penetration testing, audit of security procedures, and incident scenario testing.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Risk assessment must identify threats and vulnerabilities (RM 1), but threat intelligence is not mentioned.", "cite": "No provision; full text reviewed (searched: threat intelligence, threat-led, intelligence, scenario)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/9727/1.0~c6f84b60-72b0-40cc-b6cd-052aefab50e1?mimetype=application%2Fpdf&filename=NCSA_CSGA_%20National_Information_Assurance_Standard_En_V2.1%20%283%29.pdf", "confidence": "verified" }, "provider_requirements": { "code": "recommended", "detail": "Software should be tested by an independent party, not the developer. For certification, the audit must be done by an NCSA-accredited audit organization (AC 3). No rule requires NCSA-accredited penetration testers.", "cite": "SS 7; AC 3", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/9727/1.0~c6f84b60-72b0-40cc-b6cd-052aefab50e1?mimetype=application%2Fpdf&filename=NCSA_CSGA_%20National_Information_Assurance_Standard_En_V2.1%20%283%29.pdf", "quote": "Software SHOULD be reviewed and/or tested by an independent party and not by the developer.", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "Only software testing is covered: it should be done by someone independent of the developer. Internal teams are not barred. Silent for penetration tests.", "cite": "SS 7", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/9727/1.0~c6f84b60-72b0-40cc-b6cd-052aefab50e1?mimetype=application%2Fpdf&filename=NCSA_CSGA_%20National_Information_Assurance_Standard_En_V2.1%20%283%29.pdf", "quote": "Software should be reviewed and/or tested for vulnerabilities before it is used in a production environment. Software SHOULD be reviewed and/or tested by an independent party and not by the developer.", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "Staff should be trained to recognize social engineering (SA 4). No testing.", "cite": "No provision; full text reviewed (searched: social engineering, phishing, test, exercise)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/9727/1.0~c6f84b60-72b0-40cc-b6cd-052aefab50e1?mimetype=application%2Fpdf&filename=NCSA_CSGA_%20National_Information_Assurance_Standard_En_V2.1%20%283%29.pdf", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Appendix A sets normative physical controls. No physical testing.", "cite": "No provision; full text reviewed (searched: physical penetration, physical test, red team, intrusion test)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/9727/1.0~c6f84b60-72b0-40cc-b6cd-052aefab50e1?mimetype=application%2Fpdf&filename=NCSA_CSGA_%20National_Information_Assurance_Standard_En_V2.1%20%283%29.pdf", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "NIA controls must flow into outsourcing contracts (TM 3) and third parties should be audited periodically (TM 5). No security testing of suppliers.", "cite": "No provision; full text reviewed (searched: third party, supplier, vendor, penetration, test)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/9727/1.0~c6f84b60-72b0-40cc-b6cd-052aefab50e1?mimetype=application%2Fpdf&filename=NCSA_CSGA_%20National_Information_Assurance_Standard_En_V2.1%20%283%29.pdf", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No OT or ICS provision.", "cite": "No provision; full text reviewed (searched: operational technology, OT, ICS, SCADA, industrial)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/9727/1.0~c6f84b60-72b0-40cc-b6cd-052aefab50e1?mimetype=application%2Fpdf&filename=NCSA_CSGA_%20National_Information_Assurance_Standard_En_V2.1%20%283%29.pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No payment system provision.", "cite": "No provision; full text reviewed (searched: payment, SWIFT, card, financial market)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/9727/1.0~c6f84b60-72b0-40cc-b6cd-052aefab50e1?mimetype=application%2Fpdf&filename=NCSA_CSGA_%20National_Information_Assurance_Standard_En_V2.1%20%283%29.pdf", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "For virtual environments hosted by third parties, the standard points to a separate NCSA Cloud Security Policy (§ 13 Virtualization), which was not reviewed. No cloud testing provision in the standard.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, hosted, virtual)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/9727/1.0~c6f84b60-72b0-40cc-b6cd-052aefab50e1?mimetype=application%2Fpdf&filename=NCSA_CSGA_%20National_Information_Assurance_Standard_En_V2.1%20%283%29.pdf", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "No provision on cross-border testing.", "cite": "No provision; full text reviewed (searched: cross-border, foreign, jurisdiction, outside, abroad)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/9727/1.0~c6f84b60-72b0-40cc-b6cd-052aefab50e1?mimetype=application%2Fpdf&filename=NCSA_CSGA_%20National_Information_Assurance_Standard_En_V2.1%20%283%29.pdf", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming or replay provision.", "cite": "No provision; full text reviewed (searched: purple, replay, workshop, blue team)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/9727/1.0~c6f84b60-72b0-40cc-b6cd-052aefab50e1?mimetype=application%2Fpdf&filename=NCSA_CSGA_%20National_Information_Assurance_Standard_En_V2.1%20%283%29.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Audit non-conformities must be fixed within a defined timeline (AC 7, baseline). Risk treatment plans must address identified vulnerabilities (RM 2). These apply to audit findings and risk treatment, not specifically to penetration test findings.", "cite": "AC 7; RM 2", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/9727/1.0~c6f84b60-72b0-40cc-b6cd-052aefab50e1?mimetype=application%2Fpdf&filename=NCSA_CSGA_%20National_Information_Assurance_Standard_En_V2.1%20%283%29.pdf", "quote": "*Ensure that all non-conformance is fixed in a defined timeline.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "Organizations are audited by an NCSA-designated accredited auditor, NCSA approves the audit scope and issues the certificate. NCSA does not receive or run penetration tests under this standard.", "cite": "AC 3; AC 5", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/9727/1.0~c6f84b60-72b0-40cc-b6cd-052aefab50e1?mimetype=application%2Fpdf&filename=NCSA_CSGA_%20National_Information_Assurance_Standard_En_V2.1%20%283%29.pdf", "quote": "*Be audited by the Accredited audit organization, designated by NCSA.", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "No automated testing or AI provision. NCSA's separate Guidelines for Secure Adoption and Usage of AI (V1.0, February 2024) § 6.3.1 recommends adversarial testing of AI products.", "cite": "No provision; full text reviewed (searched: automated, continuous, artificial intelligence, AI, machine learning)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/9727/1.0~c6f84b60-72b0-40cc-b6cd-052aefab50e1?mimetype=application%2Fpdf&filename=NCSA_CSGA_%20National_Information_Assurance_Standard_En_V2.1%20%283%29.pdf", "confidence": "verified" } } }, { "id": "qa-ncsa-niscf-pentest-accreditation", "jurisdiction": "Qatar", "region": "GCC", "sector": "cross-sector", "name": "National Information Security Compliance Framework (NISCF) Accreditation Penetration Testing Standard [NCSA-NISCF-ACCR-PNT-STND]", "short": "NCSA pentest accred.", "issuer": "National Cyber Security Agency (NCSA), National Cyber Governance and Assurance Affairs", "version": "V1.1, February 8, 2024, effective February 10, 2024. PDF byte-identical to the 2026-09-28 copy (SHA-256 d9050913...2215).", "status": "In force as of 2026-09-28; V1.1 is still the version on the NCSA publications list. Applications opened February 14, 2024 (QNA). On 2026-09-28 the NCSA register showed 6 accredited penetration testing providers. All 6 scopes list internal and/or external penetration testing; none lists Red Teaming. Separately, a Cybersecurity Services business activity (MoCI code 620201) needs NCSA approval before permit renewal or new branches (Qatar Investor single window), and NCSA issued a request form for it in September 2026.", "public": "full", "primary_url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/3861/1.0~1fca5e63-9fff-4172-82c5-422b356ef221?mimetype=application/pdf&filename=SD.pdf", "arabic_title": "معيار اختبار الاختراق", "regulator_arabic": "الوكالة الوطنية للأمن السيبراني", "arabic_source_url": "https://ncsa.gov.qa/ar/publications", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No cell changes. The NCSA register on 2026-10-30 lists 19 providers, 18 accredited and 1 suspended (an advisory provider): 6 for penetration testing, 11 advisory, 2 NIA audit. None of the 6 penetration testing scopes lists Red Teaming, as in September. The accreditation pages' text is unchanged. On October 5, 2026 NCSA and CREST International signed a memorandum to 'support mutual recognition of requirements for accredited penetration testing service providers' (NCSA English news item). The Arabic version of the same news item does not mention it. No amended standard or recognition procedure is published, so the cross_border and provider_requirements cells stand (see watch). The Arabic title is NCSA's Arabic publications-list title for the V1.1 record; NCSA links the English PDF there and no Arabic PDF of the standard was found." }, "notes": "This is a provider-side regime. No Qatari regulator text found requires regulated entities to hire NCSA-accredited testers. An NCSA official said in May 2024 (The Peninsula, secondary) that NCSA \"seeks to make it mandatory for private companies to get accredited\". The public record reviewed does not show that accreditation became mandatory. The September 2026 NCSA form has a 5-year roadmap to certification or accreditation \"based on national standards\" and requires subcontractors to hold valid NCSA approval.", "cells": { "legal_force": { "code": "mixed", "detail": "Accreditation is voluntary for providers that want to show conformance. Firms adding the Cybersecurity Services activity (620201, including penetration testing, red teaming and purple teaming) need NCSA approval, per the MoCI single window and the September 2026 NCSA request form. The approval criteria are not public beyond that form.", "cite": "§ 1 Introduction", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/3861/1.0~1fca5e63-9fff-4172-82c5-422b356ef221?mimetype=application/pdf&filename=SD.pdf", "quote": "NCSA offers Penetration Testing Service Accreditation for Service Providers that offer Penetration Testing for their clients and are interested in showing to their clients, potential clients and other stakeholders that they demonstrated conformance with best practices", "confidence": "verified" }, "scope": { "code": "Qatar-based pentest providers", "detail": "Covers applicants and accredited providers and the tests they deliver under NISCF services. The NCSA page limits certification to providers located in Qatar.", "cite": "§ 2.2 Scope", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/3861/1.0~1fca5e63-9fff-4172-82c5-422b356ef221?mimetype=application/pdf&filename=SD.pdf", "quote": "This document applies to all applicants to NISCF’s Penetration Testing Accreditation Services, Accredited Penetration Testing Service Providers, and the Penetration Tests they deliver related to the NISCF’s Services.", "confidence": "verified" }, "frequency": { "code": "not_addressed", "detail": "Sets how tests are delivered, not how often. Accreditation certificates last 3 years with annual maintenance (NCSA Accreditation page).", "cite": "No provision; full text reviewed (searched: frequency, annual, periodic, every)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/3861/1.0~1fca5e63-9fff-4172-82c5-422b356ef221?mimetype=application/pdf&filename=SD.pdf", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Providers must keep an Intelligence Gathering Plan (S.3.3.1) and a Threat Modeling Plan (S.3.3.2) per engagement unless the client excludes them. Threat intelligence services are outside the accreditation scope (§ 2.2).", "cite": "No provision; full text reviewed (searched: threat intelligence, threat-led, threat modeling, scenario)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/3861/1.0~1fca5e63-9fff-4172-82c5-422b356ef221?mimetype=application/pdf&filename=SD.pdf", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Providers need a Qatar company registration (G.1.1.1), audited accounts, professional indemnity and cyber insurance (G.1.3.1), vetted staff with background and criminal checks (G.3.3.1), at least one Engagement Lead who may not be outsourced (G.3.3.2), annual competency reviews, 3-year evidence retention (M.1.1.4) and NIA certification.", "cite": "M.1.1.2; G.1.1.1; G.3.3.1 to G.3.3.2", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/3861/1.0~1fca5e63-9fff-4172-82c5-422b356ef221?mimetype=application/pdf&filename=SD.pdf", "quote": "The Service Provider shall have a valid National Information Assurance (NIA) Certification covering the Penetration Testing Accreditation Service activities.", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Covers external service providers only. In-house teams are not mentioned.", "cite": "No provision; full text reviewed (searched: internal team, in-house, employee tester)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/3861/1.0~1fca5e63-9fff-4172-82c5-422b356ef221?mimetype=application/pdf&filename=SD.pdf", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "Red Teaming is one of three accreditable service types and is defined to include social engineering. The 2023 NCSA workshop slides listed Social Engineering as a separate type; V1.1 folds it into Red Teaming.", "cite": "S.1.1.1 (Red Teaming)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/3861/1.0~1fca5e63-9fff-4172-82c5-422b356ef221?mimetype=application/pdf&filename=SD.pdf", "quote": "It employs strategies and techniques used by real-world attackers, including social engineering, physical security breaches, and advanced persistent threats, to identify vulnerabilities across people, processes, and technology.", "confidence": "verified" }, "physical": { "code": "permitted", "detail": "Physical security breaches are part of the Red Teaming definition. On-site and remote delivery models are both accreditable (S.1.2.1).", "cite": "S.1.1.1 (Red Teaming)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/3861/1.0~1fca5e63-9fff-4172-82c5-422b356ef221?mimetype=application/pdf&filename=SD.pdf", "quote": "Red Teaming: A comprehensive and multi-layered attack simulation aimed at assessing the effectiveness of an organization’s security posture. It employs strategies and techniques used by real-world attackers, including social engineering, physical security breaches", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "Covers the provider's own outsourcing of testers (G.2.2), not testing of clients' suppliers.", "cite": "No provision; full text reviewed (searched: third party, supplier, vendor, outsourc)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/3861/1.0~1fca5e63-9fff-4172-82c5-422b356ef221?mimetype=application/pdf&filename=SD.pdf", "confidence": "verified" }, "ot": { "code": "excluded", "detail": "ICS and OT testing are explicitly outside the accreditation scope.", "cite": "§ 1; § 2.2", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/3861/1.0~1fca5e63-9fff-4172-82c5-422b356ef221?mimetype=application/pdf&filename=SD.pdf", "quote": "Penetration Testing Accreditation scope excludes following activities: Industrial Control Systems (ICS) or Operational technology (OT) Testing, Automated Vulnerability Assessment Scans, Threat Intelligence/Detection/Hunting, Crowd sourced Testing (Bug Bounty), Source Code Audit, Incident Response and Security Operations Center (SOC).", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No payment system provision.", "cite": "No provision; full text reviewed (searched: payment, SWIFT, card, financial)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/3861/1.0~1fca5e63-9fff-4172-82c5-422b356ef221?mimetype=application/pdf&filename=SD.pdf", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "No cloud or SaaS provision. The September 2026 activity catalog lists cloud security assessment as a separate service (CS.ASMT.1).", "cite": "No provision; full text reviewed (searched: cloud, SaaS, hosting)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/3861/1.0~1fca5e63-9fff-4172-82c5-422b356ef221?mimetype=application/pdf&filename=SD.pdf", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "Providers must be registered in Qatar, contracts must name Qatari governing law (S.3.1.2), and the NCSA page says certification is only for providers located in Qatar. Remote testing is an accreditable delivery model.", "cite": "G.1.1.1; S.3.1.2", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/3861/1.0~1fca5e63-9fff-4172-82c5-422b356ef221?mimetype=application/pdf&filename=SD.pdf", "quote": "The Service Provider shall provide a valid company registration certificate, in accordance with applicable laws in the State of Qatar.", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming or replay provision. Purple teaming appears only as a service line (ST.ASMT.2) in the September 2026 business activity catalog.", "cite": "No provision; full text reviewed (searched: purple, replay, workshop, blue team)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/3861/1.0~1fca5e63-9fff-4172-82c5-422b356ef221?mimetype=application/pdf&filename=SD.pdf", "confidence": "verified" }, "remediation_retest": { "code": "recommended", "detail": "Each report must give the client remediation guidance, and a closure meeting is required (S.3.5.4). Retests are optional; if done, the report must say whether it was a full retest or a check of earlier findings.", "cite": "S.3.5.1; S.3.5.2", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/3861/1.0~1fca5e63-9fff-4172-82c5-422b356ef221?mimetype=application/pdf&filename=SD.pdf", "quote": "In case of a retest is performed, the PTR shall specify if the test was a complete retest or if it was limited to a validation of previous findings.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "NCSA assesses and monitors providers, can suspend or withdraw accreditation (§ 5.4.3), and requires sample reports at application (S.3.5.5). Client contracts must let the provider share non-sensitive engagement information with NCSA (S.3.1.2). NCSA does not lead tests.", "cite": "§ 5.2; S.3.1.2", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/3861/1.0~1fca5e63-9fff-4172-82c5-422b356ef221?mimetype=application/pdf&filename=SD.pdf", "quote": "National Cyber Governance and Assurance Affairs (NCGAA) is responsible for enforcing and monitoring conformance to this standard.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Automated vulnerability assessment scans are excluded from accreditation. Testers need knowledge of automated tool suites (K.PNT.SD.9). AI is not mentioned.", "cite": "§ 2.2; Annex 6.2 K.PNT.SD.9", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/3861/1.0~1fca5e63-9fff-4172-82c5-422b356ef221?mimetype=application/pdf&filename=SD.pdf", "quote": "Penetration Testing Accreditation scope excludes following activities: Industrial Control Systems (ICS) or Operational technology (OT) Testing, Automated Vulnerability Assessment Scans", "confidence": "verified" } } }, { "id": "qa-qfma-ncsa-nia-fmp", "jurisdiction": "Qatar", "region": "GCC", "sector": "financial", "name": "Compliance Controls of the National Information Assurance (NIA) for Financial Market Participants [IAS-FIN-NFMP]", "short": "QFMA/NCSA NIA markets", "issuer": "Qatar Financial Markets Authority (QFMA) and National Cyber Security Agency (NCSA)", "version": "V1.0, March 2026 (listed on the NCSA publications page 2026-09-22). English PDF byte-identical to the 2026-09-28 copy (SHA-256 095e3222...1641). Arabic V1.0 cover marked public.", "status": "Published by 2026-09-22. Effective from official publication with a 12-month transition to show a compliance roadmap (§ 6.2). The approval table and revision history hold placeholders, and the hidden text layer contains \"Currently Secret to be made Public after approval\"; the visible cover says Public.", "public": "full", "primary_url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/11056/1.0~b491aafc-6973-4ae1-b879-6c9ff6cf0fea?mimetype=application%2Fpdf&filename=NCSA_QFMA_EN.pdf", "arabic_title": "ضوابط الامتثال لمعيار تأمين المعلومات الوطنية للمشاركين في الأسواق المالية", "regulator_arabic": "هيئة قطر للأسواق المالية؛ الوكالة الوطنية للأمن السيبراني", "arabic_source_url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/11057/1.0~a6c3f32a-b6ee-4ca6-bb0f-1f7ec3300298?mimetype=application/pdf&filename=NCSA_QFMA_AR.pdf", "arabic_note": "Both names appear on the Arabic cover. The semicolon joining them is ours.", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No cell changes. In September the text said QFMA 'proposes to adopt' it (§ 1.1). NCSA's October 5, 2026 news item now reports QFMA's adoption. The English version speaks of 'the adoption of supplementary controls to the National Cybersecurity Standards'. The Arabic version says QFMA adopted the controls formally ('وتبنيها بشكل رسمي'). NCSA and QFMA ran a certification workshop for market participants on September 23, 2026. No QFMA board decision adopting the standard was found in QFMA's decisions library; its 2026 entries are Decisions 3 and 4 of 2026 and passporting rules. The legal_force cell already reads mandatory, so it stands. The Arabic title and both Arabic names are read from the Arabic V1.0 cover." }, "notes": "The newest Qatari financial-sector cyber standard found (March 2026). It adds to NIA v2.1 for capital market firms but does not require penetration testing or red teaming. § 1.1 says QFMA \"proposes to adopt\" the NIA policy and standard with this complement.", "cells": { "legal_force": { "code": "mandatory", "detail": "Section 5 controls and Appendix 7.2 are mandatory. QFMA-regulated firms must implement and certify, and QFMA enforces. The document uses \"should\" for the monthly scan interval.", "cite": "§ 2.3 Usage; § 6.3.1", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/11056/1.0~b491aafc-6973-4ae1-b879-6c9ff6cf0fea?mimetype=application%2Fpdf&filename=NCSA_QFMA_EN.pdf", "quote": "The requirements mentioned in this standard (Section 5), along with those mentioned in Appendix 7.2 are mandatory.", "confidence": "verified" }, "scope": { "code": "QFMA-regulated market participants", "detail": "Participants in the Qatari financial market regulated by QFMA, and people, processes and systems for market trading, monitoring and client applications.", "cite": "§ 2.2 Scope", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/11056/1.0~b491aafc-6973-4ae1-b879-6c9ff6cf0fea?mimetype=application%2Fpdf&filename=NCSA_QFMA_EN.pdf", "quote": "The scope of this standard cover’s participants in the Qatari financial market regulated by QFMA.", "confidence": "verified" }, "frequency": { "code": "monthly scans; no pentest", "detail": "Market trading environments must be scanned for vulnerabilities, \"on a minimum monthly basis\" (should). Risk assessments and third-party audits are annual (CCMP-RM 01, CCMP-TM 01). Penetration testing is not mentioned.", "cite": "CCMP-SM 01(a)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/11056/1.0~b491aafc-6973-4ae1-b879-6c9ff6cf0fea?mimetype=application%2Fpdf&filename=NCSA_QFMA_EN.pdf", "quote": "Monitor and secure market trading environments, by pro-actively conducting vulnerability scans. a. Such vulnerability scans should be conducted on a minimum monthly basis.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Firms must join bodies such as FS-ISAC and feed external threat data into monitoring (CCMP-SM 04, SM 06). Threat intelligence is not tied to testing.", "cite": "No provision; full text reviewed (searched: threat intelligence, threat-led, scenario, red team)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/11056/1.0~b491aafc-6973-4ae1-b879-6c9ff6cf0fea?mimetype=application%2Fpdf&filename=NCSA_QFMA_EN.pdf", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "No tester requirements.", "cite": "No provision; full text reviewed (searched: accredited, certified, external, independent, provider, tester)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/11056/1.0~b491aafc-6973-4ae1-b879-6c9ff6cf0fea?mimetype=application%2Fpdf&filename=NCSA_QFMA_EN.pdf", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Silent.", "cite": "No provision; full text reviewed (searched: internal, in-house, tester)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/11056/1.0~b491aafc-6973-4ae1-b879-6c9ff6cf0fea?mimetype=application%2Fpdf&filename=NCSA_QFMA_EN.pdf", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "No social engineering testing.", "cite": "No provision; full text reviewed (searched: social engineering, phishing)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/11056/1.0~b491aafc-6973-4ae1-b879-6c9ff6cf0fea?mimetype=application%2Fpdf&filename=NCSA_QFMA_EN.pdf", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "No physical testing.", "cite": "No provision; full text reviewed (searched: physical, red team)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/11056/1.0~b491aafc-6973-4ae1-b879-6c9ff6cf0fea?mimetype=application%2Fpdf&filename=NCSA_QFMA_EN.pdf", "confidence": "verified" }, "third_party": { "code": "assurance_only", "detail": "NIA control TM 5 is extended to an annual third-party security audit for trading, monitoring and customer-facing API systems. This is an audit, not a penetration test.", "cite": "CCMP-TM 01", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/11056/1.0~b491aafc-6973-4ae1-b879-6c9ff6cf0fea?mimetype=application%2Fpdf&filename=NCSA_QFMA_EN.pdf", "quote": "shall be extended to include a Third-Party Security audit on a minimum annual basis for all systems related to market trading, monitoring, and customer facing APIs.", "confidence": "verified", "harmonized_from": "required", "harmonize_reason": "CCMP-TM 01 annual third-party security audit; not a penetration test." }, "ot": { "code": "not_addressed", "detail": "No OT provision.", "cite": "No provision; full text reviewed (searched: operational technology, OT, ICS, SCADA)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/11056/1.0~b491aafc-6973-4ae1-b879-6c9ff6cf0fea?mimetype=application%2Fpdf&filename=NCSA_QFMA_EN.pdf", "confidence": "verified" }, "payment_systems": { "code": "required", "detail": "Market infrastructure is covered: monthly vulnerability scans of trading environments and stress tests of trading systems, with significant entities at 8 to 10 times peak volume and other brokers at 2 to 3 times peak (CCMP-SS 02). No security penetration testing of market infrastructure.", "cite": "CCMP-SS 02; CCMP-SM 01", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/11056/1.0~b491aafc-6973-4ae1-b879-6c9ff6cf0fea?mimetype=application%2Fpdf&filename=NCSA_QFMA_EN.pdf", "quote": "significant entities (e.g. exchanges, CCP=connected brokers) shall stress test critical market infrastructure up to 8 - 10x of their peak trading volumes, while other brokers may apply stress testing to at least 2-3x of their documented peak load.", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "Cloud appears only in the supply chain risk description (§ 4.1 c).", "cite": "No provision; full text reviewed (searched: cloud, SaaS, hosting)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/11056/1.0~b491aafc-6973-4ae1-b879-6c9ff6cf0fea?mimetype=application%2Fpdf&filename=NCSA_QFMA_EN.pdf", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "A unified compliance framework must cover \"applicable global regulations\" (CCMP-AC-01). Nothing addresses testing across borders.", "cite": "No provision; full text reviewed (searched: cross-border, jurisdiction, foreign, group)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/11056/1.0~b491aafc-6973-4ae1-b879-6c9ff6cf0fea?mimetype=application%2Fpdf&filename=NCSA_QFMA_EN.pdf", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming or replay provision.", "cite": "No provision; full text reviewed (searched: purple, replay, workshop, blue team)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/11056/1.0~b491aafc-6973-4ae1-b879-6c9ff6cf0fea?mimetype=application%2Fpdf&filename=NCSA_QFMA_EN.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Findings need a mitigation plan. Critical vulnerabilities must be fixed within a risk-defined timeframe, with a 72-hour target for internet-facing or actively exploited ones.", "cite": "CCMP-SM 01(b), (d)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/11056/1.0~b491aafc-6973-4ae1-b879-6c9ff6cf0fea?mimetype=application%2Fpdf&filename=NCSA_QFMA_EN.pdf", "quote": "Critical vulnerabilities shall be addressed within a risk-defined timeframe, with 72 hours as the target for internet-facing or actively exploited vulnerabilities.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "NCSA and QFMA enforce. Firms show compliance through NCSA certification. Deviations go to QFMA for approval.", "cite": "§ 6.1.2", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/11056/1.0~b491aafc-6973-4ae1-b879-6c9ff6cf0fea?mimetype=application%2Fpdf&filename=NCSA_QFMA_EN.pdf", "quote": "NCSA and QFMA are responsible for enforcing and monitoring compliance to this standard.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "The standard says its certification does not assure AI models or AI-enabled systems and points to ISO/IEC 42001 until QFMA or NCSA issue their own standard. Automated kill switches are required for rogue algorithms (CCMP-SM-03).", "cite": "§ 2.3 Usage", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/11056/1.0~b491aafc-6973-4ae1-b879-6c9ff6cf0fea?mimetype=application%2Fpdf&filename=NCSA_QFMA_EN.pdf", "quote": "Lastly, this compliance does not constitute assurance of any artificial intelligence (AI) models or AI enabled systems in use.", "confidence": "verified" } } }, { "id": "qa-ncsa-vuln-mgmt-guidelines", "jurisdiction": "Qatar", "region": "GCC", "sector": "cross-sector", "name": "Qatar National Vulnerability Management Guidelines [IAG-NAT-VMG] V1.0", "short": "NCSA vuln. mgmt guidelines", "issuer": "National Cyber Security Agency (NCSA)", "version": "2026-02-15 (NCSA publications list); review and approval table dated January 2026", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/10183/1.0~68c3bc7d-d9ba-4db6-a840-e6c7fd400481?mimetype=application%2Fpdf&filename=NCSA_CS_Guidelines_for_Vulnerability_Management_EN_V1.0%20%281%29.pdf", "arabic_title": "المبادئ التوجيهية لإدارة الثغرات", "regulator_arabic": "الوكالة الوطنية للأمن السيبراني", "arabic_source_url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/10185/1.0~74c8a0a1-3abf-42a5-88ca-7997b6f60017?mimetype=application/pdf&filename=NCSA_CS_Guidelines_for_Vulnerability_Management_AR_V1.0.pdf", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Issued in 2026. It sets vulnerability scanning cycles, a 100% active-scan expectation for critical assets and fix validation (penetration testing named as one method) for public and private operators of critical infrastructure and national systems, which include government bodies. September saved and read it but cited it only in the NIA row notes. The Arabic title is read from the cover of NCSA's Arabic PDF; NCSA's Arabic publications list shows the same title as 'المبادئ التوجيهية إلدارة الثغرات', a text-extraction form of the cover title.", "cells": { "legal_force": { "code": "mixed", "detail": "A guideline whose adoption is 'strongly encouraged' (§ 8), with adoption left to each organization (Legal mandate). Two items use mandatory words: NCSA 'mandates' active scanning of 100% of critical assets and 90% of all assets (§ 6.8(b)), and agent-based scans are 'mandatory for agent capable assets' (§ 6.2(a)(ii)). The control table still reads 'Currently Confidential to be made Public after approval' although NCSA publishes it.", "cite": "§ 8 Compliance and Enforcement; § 6.8(b); § 6.2(a)(ii)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/10183/1.0~68c3bc7d-d9ba-4db6-a840-e6c7fd400481?mimetype=application%2Fpdf&filename=NCSA_CS_Guidelines_for_Vulnerability_Management_EN_V1.0%20%281%29.pdf", "quote": "Adoption of this guideline is strongly encouraged for all entities within Qatar’s national cybersecurity ecosystem to enhance their vulnerability management practices.", "confidence": "verified" }, "scope": { "code": "CNI and national-system operators, public and private", "detail": "Also organizations 'involved in sectors deemed essential for national security, economic stability, and public welfare'. Entity is defined as 'Organizations/Private/Government' (§ 3). No sector, including finance, is named.", "cite": "§ 2.2 Scope; § 3", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/10183/1.0~68c3bc7d-d9ba-4db6-a840-e6c7fd400481?mimetype=application%2Fpdf&filename=NCSA_CS_Guidelines_for_Vulnerability_Management_EN_V1.0%20%281%29.pdf", "quote": "All organizations, both public and private, that are responsible for the operation, maintenance, or management of critical infrastructure or national systems within the State of Qatar.", "confidence": "verified" }, "frequency": { "code": "daily scans (agent assets); no pentest cycle", "detail": "Agent-capable assets at least daily, other assets 'weekly or bi-weekly', less critical infrastructure monthly, plus ad hoc scans for new assets and newly announced vulnerabilities (§ 6.2(e)(iv)). Penetration testing appears only as one way to validate a fix (§ 6.4(f)). No penetration test cycle is set.", "cite": "§ 6.2(e)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/10183/1.0~68c3bc7d-d9ba-4db6-a840-e6c7fd400481?mimetype=application%2Fpdf&filename=NCSA_CS_Guidelines_for_Vulnerability_Management_EN_V1.0%20%281%29.pdf", "quote": "Scanning Frequency – i. Agent based assets – At least daily ii. Non-agent capable assets – Weekly or bi-weekly iii. Low/Less critical infrastructure – Monthly", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Threat intelligence feeds the automated prioritization of vulnerabilities already found, not the design or scope of tests.", "cite": "No provision ties threat intelligence to test scope; § 6.3(d) uses it to rank found vulnerabilities (searched: threat intelligence, threat-led, scenario, red team)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/10183/1.0~68c3bc7d-d9ba-4db6-a840-e6c7fd400481?mimetype=application%2Fpdf&filename=NCSA_CS_Guidelines_for_Vulnerability_Management_EN_V1.0%20%281%29.pdf", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "No rule on who runs scans or penetration tests. § 7.1 describes a penetration tester role but sets no qualification.", "cite": "No provision; full text reviewed (searched: accredited, certified, qualified, independent, external, provider)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/10183/1.0~68c3bc7d-d9ba-4db6-a840-e6c7fd400481?mimetype=application%2Fpdf&filename=NCSA_CS_Guidelines_for_Vulnerability_Management_EN_V1.0%20%281%29.pdf", "confidence": "verified" }, "internal_testers": { "code": "allowed", "detail": "§ 7.1 lists a penetration tester among the teams an organization 'can' set up for vulnerability management, next to its SOC and application teams. The role table makes the entity responsible for running the program (§ 4.1). No independence condition.", "cite": "§ 7 (introduction); § 7.1(2), (7); § 4.1", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/10183/1.0~68c3bc7d-d9ba-4db6-a840-e6c7fd400481?mimetype=application%2Fpdf&filename=NCSA_CS_Guidelines_for_Vulnerability_Management_EN_V1.0%20%281%29.pdf", "quote": "However, every organization is different and handles business as per their organizational hierarchy, the following teams can be structured for efficient vulnerability management practices", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "Not mentioned.", "cite": "No provision; full text reviewed (searched: social engineering, phishing, awareness test)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/10183/1.0~68c3bc7d-d9ba-4db6-a840-e6c7fd400481?mimetype=application%2Fpdf&filename=NCSA_CS_Guidelines_for_Vulnerability_Management_EN_V1.0%20%281%29.pdf", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "'Physical assets' appears only in the definition of critical national infrastructure (§ 3).", "cite": "No provision; full text reviewed (searched: physical penetration, physical test, red team)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/10183/1.0~68c3bc7d-d9ba-4db6-a840-e6c7fd400481?mimetype=application%2Fpdf&filename=NCSA_CS_Guidelines_for_Vulnerability_Management_EN_V1.0%20%281%29.pdf", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "Vendors appear only as a cause of patch delay and as a source of recommendations (§ 6.4, § 6.6(d)).", "cite": "No provision; full text reviewed (searched: third party, supplier, vendor, outsourc)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/10183/1.0~68c3bc7d-d9ba-4db6-a840-e6c7fd400481?mimetype=application%2Fpdf&filename=NCSA_CS_Guidelines_for_Vulnerability_Management_EN_V1.0%20%281%29.pdf", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "The scope covers critical infrastructure and the inventory lists IoT infrastructure (§ 6.1(c)(i)), but OT and industrial control systems are not named. Exclusions from scanning, for example legacy or critical production systems, must be documented and reviewed (§ 3; § 6.7).", "cite": "No provision; full text reviewed (searched: operational technology, OT, ICS, SCADA, industrial)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/10183/1.0~68c3bc7d-d9ba-4db6-a840-e6c7fd400481?mimetype=application%2Fpdf&filename=NCSA_CS_Guidelines_for_Vulnerability_Management_EN_V1.0%20%281%29.pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "Not mentioned.", "cite": "No provision; full text reviewed (searched: payment, SWIFT, card, financial)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/10183/1.0~68c3bc7d-d9ba-4db6-a840-e6c7fd400481?mimetype=application%2Fpdf&filename=NCSA_CS_Guidelines_for_Vulnerability_Management_EN_V1.0%20%281%29.pdf", "confidence": "verified" }, "cloud_saas": { "code": "permitted", "detail": "Cloud instances are listed among the assets to inventory, and 'Identified assets should be part of vulnerability scanning process' (§ 6.2(a)). SaaS is not mentioned.", "cite": "§ 6.1(c)(i); § 6.2(a)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/10183/1.0~68c3bc7d-d9ba-4db6-a840-e6c7fd400481?mimetype=application%2Fpdf&filename=NCSA_CS_Guidelines_for_Vulnerability_Management_EN_V1.0%20%281%29.pdf", "quote": "Comprehensive coverage to all operational information assets such as (servers, endpoints, network devices, applications, databases, cloud instances, virtual and IoT infrastructure. etc.)", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "Not mentioned.", "cite": "No provision; full text reviewed (searched: cross-border, foreign, jurisdiction, outside Qatar, remote)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/10183/1.0~68c3bc7d-d9ba-4db6-a840-e6c7fd400481?mimetype=application%2Fpdf&filename=NCSA_CS_Guidelines_for_Vulnerability_Management_EN_V1.0%20%281%29.pdf", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "Not mentioned.", "cite": "No provision; full text reviewed (searched: purple, replay, workshop, blue team)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/10183/1.0~68c3bc7d-d9ba-4db6-a840-e6c7fd400481?mimetype=application%2Fpdf&filename=NCSA_CS_Guidelines_for_Vulnerability_Management_EN_V1.0%20%281%29.pdf", "confidence": "verified" }, "remediation_retest": { "code": "recommended", "detail": "The guideline lists validation of each treatment, by rescanning, penetration testing, configuration checks, log review or manual investigation, as a step (§ 6.4(f)), and gives a reference SLA table of treatment windows that organizations 'can refer to' (§ 6.5). Both sit in a guideline whose adoption is 'strongly encouraged' (§ 8). Coded recommended under R3; the mandatory words in § 6.2 and § 6.8 concern scanning, not remediation.", "cite": "§ 6.4(f); § 6.5; § 8", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/10183/1.0~68c3bc7d-d9ba-4db6-a840-e6c7fd400481?mimetype=application%2Fpdf&filename=NCSA_CS_Guidelines_for_Vulnerability_Management_EN_V1.0%20%281%29.pdf", "quote": "Conduct treatment activity validation. Methods varies such as rescan the system, penetration testing, validate settings with configuration and patch management tools, log review or manual investigation.", "confidence": "verified", "harmonized_from": "required", "harmonize_reason": "R3: The validation step (§ 6.4(f)) is an imperative in a guideline whose adoption is 'strongly encouraged' (§ 8), and the remediation timetable is a reference (§ 6.5). Neither uses 'must', 'shall', 'required' or an expectation word, so R3 gives recommended." }, "regulator_role": { "code": "examines", "detail": "NCSA's role table makes it accountable and responsible to 'Oversee compliance to guidelines' (§ 4.1). NCSA sends risk reports that entities are advised to act on (§ 6.8(c)). No duty to send scan or test results to NCSA.", "cite": "§ 4; § 4.1; § 6.8(c)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/10183/1.0~68c3bc7d-d9ba-4db6-a840-e6c7fd400481?mimetype=application%2Fpdf&filename=NCSA_CS_Guidelines_for_Vulnerability_Management_EN_V1.0%20%281%29.pdf", "quote": "the National Cyber Security Agency (NCSA) is mandated to assess the security posture of the Country, with the goal of identifying the risk proactively.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Automated asset inventory (§ 6.1(b)), automated scanning and automated risk ranking (§ 6.3(c) to (d)). Nothing on AI-driven testing or on testing AI systems.", "cite": "§ 6.3(d); § 6.1(b)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/10183/1.0~68c3bc7d-d9ba-4db6-a840-e6c7fd400481?mimetype=application%2Fpdf&filename=NCSA_CS_Guidelines_for_Vulnerability_Management_EN_V1.0%20%281%29.pdf", "quote": "Vulnerability risk assessment and prioritization should be automated based on combination of criticality, threat intelligence, risk calculation scoring and asset’s business context.", "confidence": "verified" } } }, { "id": "ae-cbuae-oprisk-2026", "jurisdiction": "United Arab Emirates", "region": "GCC", "sector": "financial", "name": "Operational Risk Management Regulation (Circular C 1/2026)", "short": "CBUAE OpRisk Reg 2026", "issuer": "Central Bank of the UAE (CBUAE)", "version": "C 1/2026, Effective from 14/9/2026, Status: In-Force", "status": "In force from September 14, 2026, per the CBUAE Rulebook page retrieved 2026-09-28. Art. 19.1 cancels Circular No. 163/2018 (Operational Risk Regulation and Standards of August 29, 2018). Issued under Federal Decree-Law No. (6) of 2025. Searched the Rulebook for 'penetration', 'cyber', 'red teaming', 'threat-led', 'cyber-attack simulation' and 'artificial intelligence': no separate CBUAE cyber testing or threat-led testing regulation was found.", "public": "full", "primary_url": "https://rulebook.centralbank.ae/en/rulebook/operational-risk-management-regulation", "arabic_title": "نظام إدارة المخاطر التشغيلية", "regulator_arabic": "مصرف الإمارات العربية المتحدة المركزي", "arabic_source_url": "https://rulebook.centralbank.ae/ar/rulebook/%D9%86%D8%B8%D8%A7%D9%85-%D8%A5%D8%AF%D8%A7%D8%B1%D8%A9-%D8%A7%D9%84%D9%85%D8%AE%D8%A7%D8%B7%D8%B1-%D8%A7%D9%84%D8%AA%D8%B4%D8%BA%D9%8A%D9%84%D9%8A%D8%A9", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "Both Rulebook pages (entire section 7267 and the landing page) were byte-identical to the 2026-09-28 copies when fetched on 2026-10-30. The regulation says the CBUAE may issue standards that elaborate on it; none were listed in the Rulebook on 2026-10-30. The Arabic name of the CBUAE is taken from Art. 1 of the Arabic text (definition of Central Bank). A separate CBUAE guidance note on AI and machine learning, issued February 11, 2026, is coded as a new instrument (ae-cbuae-ai-ml-guidance-2026)." }, "notes": "New in 2026: C 1/2026 took effect September 14, 2026 and replaced Circular 163/2018. Among the CBUAE Rulebook texts returned by a search for 'penetration', it is the only one that requires penetration testing by an independent third party (for Critical Functions) and names physical and people controls as test scope. Art. 8.10 requires compliance with UAE ICT and cyber regulations from other authorities. Other CBUAE Rulebook texts with testing provisions: Retail Payment Services and Card Schemes Regulation Art. 13 (coded separately as ae-cbuae-retail-payments); Stored Value Facilities Regulation C 6/2020 Art. 12 (SVF licensees must regularly assess the need for penetration and cyber-attack simulation testing covering social engineering); Payment Token Services Regulation C 2/2024 Art. 35(17), with Art. 34 requiring audits to cover penetration test results; Standards for Exchange Business N 35/2018, 14.9.1 (annual internal and external vulnerability scanning and penetration tests, mandatory). The CBUAE Cyber-Security Centre of Excellence page describes a sector cyber war-gaming exercise with the UAE Banks Federation on January 13, 2021; it is an exercise, not a testing rule.", "cells": { "legal_force": { "code": "mandatory", "detail": "A regulation issued under the Central Bank Law. Breaches can lead to supervisory action, fines and removal of managers.", "cite": "Introduction; Art. 17.1", "url": "https://rulebook.centralbank.ae/en/entiresection/7267", "quote": "Violation of any provision of this regulation and any accompanying Standards may be subject to supervisory action and administrative & financial sanctions as deemed appropriate by the Central Bank.", "confidence": "verified" }, "scope": { "code": "all LFIs that are juridical persons", "detail": "Every Licensed Financial Institution with legal personality, not only banks. Art. 1.1 defines Bank as one type of LFI.", "cite": "Scope", "url": "https://rulebook.centralbank.ae/en/entiresection/7267", "quote": "This regulation applies to all Licensed Financial Institutions that are juridical persons.", "confidence": "verified" }, "frequency": { "code": "periodic, interval not set", "detail": "Control-challenging tests, including penetration tests, must be 'periodic' but no interval is set. By contrast, business continuity and disaster recovery plans for Critical Operations must be tested at least annually.", "cite": "Art. 7.13; Art. 11.10", "url": "https://rulebook.centralbank.ae/en/entiresection/7267", "quote": "An LFI must periodically conduct stress-tests related to Operational Risk, including through exercises that challenge the LFI’s control environment, for example through penetration testing.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Nothing ties threat intelligence to test design or scenarios. Art. 8.7.3 does require ICT and cyber risk management to use actionable intelligence in general.", "cite": "No provision linking threat intelligence to testing; full text reviewed (searched: intelligence, threat, scenario, red team). General duty in Art. 8.7.3.", "url": "https://rulebook.centralbank.ae/en/entiresection/7267", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "For Critical Functions, the periodic testing must include a penetration test by an independent third party. No accreditation or certification (for example CREST) is named.", "cite": "Art. 7.14", "url": "https://rulebook.centralbank.ae/en/entiresection/7267", "quote": "At least for Critical Functions, the periodic testing referred to in Article 7.13 above must include penetration testing by an independent third party. The results must be presented to the Board.", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "Art. 7.13 sets no rule on who tests, so internal teams can run the periodic control tests. For Critical Functions, Art. 7.14 adds a penetration test by an independent third party.", "cite": "Art. 7.13; Art. 7.14", "url": "https://rulebook.centralbank.ae/en/entiresection/7267", "quote": "At least for Critical Functions, the periodic testing referred to in Article 7.13 above must include penetration testing by an independent third party.", "confidence": "verified" }, "social_engineering": { "code": "controls_test", "detail": "The control-challenging tests must cover 'controls relying on people' as well as ICT and physical controls. The text does not use the words social engineering or phishing.", "cite": "Art. 7.13", "url": "https://rulebook.centralbank.ae/en/entiresection/7267", "quote": "This includes but is not limited to ICT systems, physical controls, controls relying on people, and any other risk vectors.", "confidence": "verified", "harmonized_from": "required", "harmonize_reason": "Art. 7.13 tests must cover 'controls relying on people'; social engineering is not named." }, "physical": { "code": "controls_test", "detail": "Physical controls are named in the scope of the required control-challenging tests. The method, for example physical intrusion testing, is not specified.", "cite": "Art. 7.13", "url": "https://rulebook.centralbank.ae/en/entiresection/7267", "quote": "This includes but is not limited to ICT systems, physical controls, controls relying on people, and any other risk vectors.", "confidence": "verified", "harmonized_from": "required", "harmonize_reason": "Art. 7.13 control-challenging tests must cover physical controls; method not specified." }, "third_party": { "code": "assurance_only", "detail": "The penetration testing articles do not mention third parties. Continuity testing should include key Third-Party Service Providers where relevant, and the internal control system must cover activities that rely on them (Art. 7.3).", "cite": "Art. 11.10; Art. 7.3", "url": "https://rulebook.centralbank.ae/en/entiresection/7267", "quote": "Where relevant, testing should include key Third-Party Service Providers. The results must be reported to the Board and Senior Management.", "confidence": "verified", "harmonized_from": "permitted", "harmonize_reason": "Art. 11.10 continuity testing with key providers; penetration testing articles do not mention third parties." }, "ot": { "code": "not_addressed", "detail": "No mention of operational technology or industrial control systems.", "cite": "No provision; full text reviewed (searched: operational technology, industrial, ICS, SCADA)", "url": "https://rulebook.centralbank.ae/en/entiresection/7267", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "Payment systems and payment services are a minimum Critical Operation (Art. 3.5.1), but the tests tied to Critical Operations are continuity and recovery tests (Art. 11.10). The third-party penetration test in Art. 7.14 is keyed to Critical Functions, a separate term the text does not link to payment systems, and the Art. 7.13 tests name no payment system. Continuity tests do not count under R8. Coded as CBO BM 1225 and CBB CRA-5.1.4.", "cite": "No security testing provision naming payment systems; Art. 3.5.1, 7.13, 7.14 and 11.10 considered", "url": "https://rulebook.centralbank.ae/en/entiresection/7267", "confidence": "verified", "history": [ { "date": "2026-10-30", "from": "required", "to": "not_addressed", "why": "Payment systems enter C 1/2026 only as Critical Operations whose continuity plans are tested (Art. 11.10); continuity tests do not count, as for CBO BM 1225 and CBB CRA-5.1.4." } ], "harmonized_from": "required", "harmonize_reason": "R8: Payment systems enter C 1/2026 only as Critical Operations whose continuity plans are tested (Art. 11.10); continuity tests do not count, as for CBO BM 1225 and CBB CRA-5.1.4." }, "cloud_saas": { "code": "not_addressed", "detail": "The regulation does not mention cloud or SaaS. Art. 8.8 covers ICT systems 'operated or made available by Third-Party Service Providers' without naming cloud.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, software as a service, hosting)", "url": "https://rulebook.centralbank.ae/en/entiresection/7267", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "Nothing on testing across borders or of foreign group entities. Art. 8.9 requires the Master System of Record to be kept in the UAE, a data residency rule that does not mention testing.", "cite": "No provision on testing; full text reviewed (searched: foreign, cross-border, jurisdiction, group, intragroup). Data residency in Art. 8.9.", "url": "https://rulebook.centralbank.ae/en/entiresection/7267", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming, replay or joint attacker and defender review.", "cite": "No provision; full text reviewed (searched: purple, replay, blue team, workshop, lessons)", "url": "https://rulebook.centralbank.ae/en/entiresection/7267", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "ICT and cyber risk management must be tested to find gaps and then reviewed and improved. Test results go to the Board (Art. 7.14) and weaknesses found in testing must be reported to Board and senior management (Art. 8.4). No remediation deadline or retest rule.", "cite": "Art. 8.7.2; Art. 8.4; Art. 7.14", "url": "https://rulebook.centralbank.ae/en/entiresection/7267", "quote": "Be regularly tested to identify gaps against its Risk Tolerance and to review and improve ICT and cybersecurity risk identification, protection, detection and event management", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "The CBUAE does not run or approve tests and results are not filed with it by default. It can demand any operational risk information and sanction breaches (Art. 17).", "cite": "Art. 15.4; Art. 17.1", "url": "https://rulebook.centralbank.ae/en/entiresection/7267", "quote": "An LFI must provide, upon request, any specific information with respect to Operational Risk that the Central Bank may require.", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "No mention of automated, continuous or AI-driven testing, or of testing AI systems. Art. 7.7 requires periodic assessment of the accuracy of automated controls, which is control automation, not automated testing.", "cite": "No provision on automated or AI testing; full text reviewed (searched: artificial intelligence, AI, automated, continuous, machine learning)", "url": "https://rulebook.centralbank.ae/en/entiresection/7267", "confidence": "verified" } } }, { "id": "ae-cbuae-retail-payments", "jurisdiction": "United Arab Emirates", "region": "GCC", "sector": "financial", "name": "Retail Payment Services and Card Schemes Regulation, Article (13) Technology Risk and Information Security", "short": "CBUAE Retail Payments", "issuer": "Central Bank of the UAE (CBUAE)", "version": "C 15/2021, Effective from 6/6/2021, Status: In-Force", "status": "In force per the CBUAE Rulebook page retrieved 2026-09-28. No amendment to Art. 13 shown. The general C 1/2026 operational risk regulation now also applies to licensed payment firms that are juridical persons.", "public": "full", "primary_url": "https://rulebook.centralbank.ae/en/rulebook/article-13-technology-risk-and-information-security", "arabic_title": "نظام خدمات الدفع للتجزئة ومنظومات البطاقات", "regulator_arabic": "مصرف الإمارات العربية المتحدة المركزي", "arabic_source_url": "https://rulebook.centralbank.ae/ar/rulebook/%D8%A7%D9%84%D9%85%D8%A7%D8%AF%D8%A9-13-%D9%85%D8%AE%D8%A7%D8%B7%D8%B1-%D8%A7%D9%84%D8%AA%D9%83%D9%86%D9%88%D9%84%D9%88%D8%AC%D9%8A%D8%A7-%D9%88%D8%A3%D9%85%D9%86-%D8%A7%D9%84%D9%85%D8%B9%D9%84%D9%88%D9%85%D8%A7%D8%AA", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "Article 13 and Annex II pages were byte-identical to the 2026-09-28 copies. The Arabic title is the regulation title; the Arabic heading of the article on the same page is \"المادة (13): مخاطر التكنولوجيا وأمن المعلومات\". The CBUAE AI and machine learning guidance note of February 11, 2026 does not amend Article 13 and sets no penetration testing duty; it is coded separately. The Retail Payment Systems Regulation (C 10/2020), which covers designated payment systems rather than payment service providers, was not in the September coding and is coded as a new row (ae-cbuae-retail-payment-systems)." }, "notes": "Almost the same testing paragraph appears in the Stored Value Facilities Regulation C 6/2020, Art. 12 ('A Licensee must regularly assess the necessity to perform penetration and cyber-attack simulation testing', with scope that 'should' cover social engineering) and in the Payment Token Services Regulation C 2/2024, Art. 35(17), which adds a risk-based trigger and uses 'shall'. Art. 13(17) here and PTS Art. 35(17) are the only binding UAE financial texts reviewed that use 'shall' to put social engineering in test scope. Art. 13(6) also requires PSPs to meet the UAE Information Assurance Standards at a minimum.", "cells": { "legal_force": { "code": "mandatory", "detail": "Article 13 of a CBUAE regulation uses 'shall'. Annex II is non-binding best-practice guidance.", "cite": "Art. 13(1)", "url": "https://rulebook.centralbank.ae/en/rulebook/article-13-technology-risk-and-information-security", "quote": "Payment Service Providers shall comply with this Article (13) and are encouraged to consult Annex II for the Guidance on the best practices for technology risk and information security.", "confidence": "verified" }, "scope": { "code": "PSPs with monthly payments of AED 10m or more", "detail": "The testing paragraph applies to licensed Payment Service Providers whose monthly average value of Payment Transactions is ten million dirhams or more.", "cite": "Art. 13(17)", "url": "https://rulebook.centralbank.ae/en/rulebook/article-13-technology-risk-and-information-security", "quote": "Payment Service Providers whose monthly average value of Payment Transactions amounts to ten (10) million Dirhams or above shall regularly assess the necessity to perform penetration and cyber-attack simulation testing.", "confidence": "verified" }, "frequency": { "code": "risk-based", "detail": "The provider must 'regularly assess the necessity' of testing. No test interval is set.", "cite": "Art. 13(17)", "url": "https://rulebook.centralbank.ae/en/rulebook/article-13-technology-risk-and-information-security", "quote": "shall regularly assess the necessity to perform penetration and cyber-attack simulation testing.", "confidence": "verified" }, "threat_intel": { "code": "required", "detail": "Test coverage and scope must be based on the cyber risk profile and the cyber intelligence available. Annex II adds guidance on subscribing to threat intelligence services.", "cite": "Art. 13(17); Annex II (Cyber Security Risk)", "url": "https://rulebook.centralbank.ae/en/rulebook/article-13-technology-risk-and-information-security", "quote": "Coverage and scope of testing shall be based on the cyber security risk profile, cyber intelligence information available", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "No rule on who performs the tests. Art. 13(7) requires an independent technology audit function, which is not tied to testing.", "cite": "No provision; Art. 13 and Annex II reviewed (searched: independent, external, qualified, certified, accredited)", "url": "https://rulebook.centralbank.ae/en/rulebook/article-13-technology-risk-and-information-security", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Silent on internal versus external testers.", "cite": "No provision; Art. 13 and Annex II reviewed (searched: internal, in-house, independent, third party)", "url": "https://rulebook.centralbank.ae/en/rulebook/article-13-technology-risk-and-information-security", "confidence": "verified" }, "social_engineering": { "code": "required", "detail": "Where testing is done, its scope must cover social engineering as well as internal and external networks and applications. The duty to test at all is a duty to assess the need.", "cite": "Art. 13(17)", "url": "https://rulebook.centralbank.ae/en/rulebook/article-13-technology-risk-and-information-security", "quote": "covering not only networks (both external and internal) and application systems but also social engineering and emerging cyber threats.", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Physical access controls appear only for alternate recovery sites. No physical testing.", "cite": "No provision on physical testing; Art. 13 reviewed (searched: physical, premises, data center)", "url": "https://rulebook.centralbank.ae/en/rulebook/article-13-technology-risk-and-information-security", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "Vendors appear only in business continuity paragraphs. No testing of third parties.", "cite": "No provision on testing third parties; Art. 13 reviewed (searched: vendor, third party, outsourc, external providers)", "url": "https://rulebook.centralbank.ae/en/rulebook/article-13-technology-risk-and-information-security", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No mention of operational technology.", "cite": "No provision; Art. 13 reviewed (searched: operational technology, industrial, ICS)", "url": "https://rulebook.centralbank.ae/en/rulebook/article-13-technology-risk-and-information-security", "confidence": "verified" }, "payment_systems": { "code": "required", "detail": "The whole regime governs retail payment services. The tested networks and application systems are those of the payment service provider.", "cite": "Art. 13(17)", "url": "https://rulebook.centralbank.ae/en/rulebook/article-13-technology-risk-and-information-security", "quote": "Payment Service Providers whose monthly average value of Payment Transactions amounts to ten (10) million Dirhams or above shall regularly assess the necessity to perform penetration and cyber-attack simulation testing.", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "Cloud appears once, as a disaster recovery dependency whose risk must be managed. Not linked to testing.", "cite": "No provision on testing cloud; Art. 13 reviewed (searched: cloud, shared computing, SaaS)", "url": "https://rulebook.centralbank.ae/en/rulebook/article-13-technology-risk-and-information-security", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "Nothing on multi-jurisdiction testing or data location for tests.", "cite": "No provision; Art. 13 reviewed (searched: foreign, cross-border, jurisdiction, outside the UAE)", "url": "https://rulebook.centralbank.ae/en/rulebook/article-13-technology-risk-and-information-security", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming or replay.", "cite": "No provision; Art. 13 and Annex II reviewed (searched: purple, replay, workshop)", "url": "https://rulebook.centralbank.ae/en/rulebook/article-13-technology-risk-and-information-security", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Findings must be mitigated 'in a timely manner' based on impact and risk. No deadline and no retest rule.", "cite": "Art. 13(17)", "url": "https://rulebook.centralbank.ae/en/rulebook/article-13-technology-risk-and-information-security", "quote": "A Payment Service Provider shall also take appropriate actions to mitigate the issues, threats and vulnerabilities identified in penetration and cyber-attack simulation testing in a timely manner, based on the impact and risk exposure analysis.", "confidence": "verified" }, "regulator_role": { "code": "not_addressed", "detail": "Art. 13 gives the CBUAE no role in tests. The only reporting duty in Art. 13 concerns severe service disruptions.", "cite": "No provision on regulator role in testing; Art. 13 reviewed (searched: Central Bank, report, submit, notify)", "url": "https://rulebook.centralbank.ae/en/rulebook/article-13-technology-risk-and-information-security", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "No mention of automated or AI-driven testing.", "cite": "No provision; Art. 13 and Annex II reviewed (searched: automated, artificial intelligence, AI, continuous)", "url": "https://rulebook.centralbank.ae/en/rulebook/article-13-technology-risk-and-information-security", "confidence": "verified" } } }, { "id": "ae-joint-enabling-tech-guidelines", "jurisdiction": "United Arab Emirates", "region": "GCC", "sector": "financial", "name": "Guidelines for Financial Institutions Adopting Enabling Technologies", "short": "UAE Enabling Tech Guide", "issuer": "CBUAE, Securities and Commodities Authority (SCA), DFSA and ADGM FSRA (joint issuance)", "version": "Issued on 15/11/2021, Status: In-Force", "status": "In force per the CBUAE Rulebook page retrieved 2026-09-28. The ADGM FSRA IT Risk Management page (retrieved 2026-09-28) still lists the joint guidance. No 2025 or 2026 revision found.", "public": "full", "primary_url": "https://rulebook.centralbank.ae/en/rulebook/guidelines-financial-institutions-adopting-enabling-technologies", "arabic_title": "إرشادات للمؤسسات المالية التي تعتمد التكنولوجيا التمكينية", "regulator_arabic": "مصرف الإمارات العربية المتحدة المركزي", "arabic_source_url": "https://rulebook.centralbank.ae/ar/rulebook/%D8%A5%D8%B1%D8%B4%D8%A7%D8%AF%D8%A7%D8%AA-%D9%84%D9%84%D9%85%D8%A4%D8%B3%D8%B3%D8%A7%D8%AA-%D8%A7%D9%84%D9%85%D8%A7%D9%84%D9%8A%D8%A9-%D8%A7%D9%84%D8%AA%D9%8A-%D8%AA%D8%B9%D8%AA%D9%85%D8%AF-%D8%A7%D9%84%D8%AA%D9%83%D9%86%D9%88%D9%84%D9%88%D8%AC%D9%8A%D8%A7-%D8%A7%D9%84%D8%AA%D9%85%D9%83%D9%8A%D9%86%D9%8A%D8%A9", "arabic_note": "The Arabic page names only the CBUAE, one of the four co-issuers.", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "Rulebook entire section 2413 was byte-identical to the 2026-09-28 copy. One co-issuer changed name: Federal Decree-Law No. 32 of 2025, in force January 1, 2026, replaced the Securities and Commodities Authority with the Capital Market Authority as its legal successor and says the old name is replaced \"wherever it appears in any legislation\" (CMA Law Art. 2(2) and (3), https://legislation.uaecma.gov.ae/en/article-2-capital-markets-authority). regulator_arabic gives the CBUAE name because the Arabic copy read is the CBUAE Rulebook page; the Arabic names of the other issuers, as each spells it, are: CMA \"هيئة سوق المال\", FSRA \"سلطة تنظيم الخدمات المالية\", DFSA not confirmed." }, "notes": "The only UAE financial text reviewed that sets an explicit test cadence for cloud (annual) and for APIs (annual, independent tester), and it names a supplier's systems (the API Provider) as a test target. Guidance only. It predates the DFSA (2024) and FSRA (2026) cyber rules and the CBUAE C 1/2026 regulation.", "cells": { "legal_force": { "code": "supervisory_expectation", "detail": "Guidance that uses 'should'. It sits alongside binding rules of the four authorities.", "cite": "Introduction; Scope of Application", "url": "https://rulebook.centralbank.ae/en/entiresection/2413", "quote": "The purpose of the Guidelines is to provide a set of principles when using Enabling Technologies in financial services and accompanying guidance.", "confidence": "verified" }, "scope": { "code": "all firms of 4 UAE financial regulators using APIs, cloud, AI, DLT", "detail": "All institutions licensed by the CBUAE, SCA, DFSA or FSRA that use or plan to use APIs, cloud computing, biometrics, big data analytics and AI, or distributed ledgers.", "cite": "Scope of Application", "url": "https://rulebook.centralbank.ae/en/entiresection/2413", "quote": "The Guidelines are applicable to all Institutions licensed and supervised by the Supervisory Authorities that are using, or intend to use, Enabling Technologies.", "confidence": "verified" }, "frequency": { "code": "annual", "detail": "Penetration tests of API systems and of cloud arrangements are expected at least annually.", "cite": "3.18; 3.61(b)", "url": "https://rulebook.centralbank.ae/en/entiresection/2413", "quote": "These should include conducting vulnerability assessments and penetration tests specific to the Cloud Computing arrangement on at least an annual basis.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Threat intelligence appears only in cloud monitoring (3.59(b)), not in test design.", "cite": "No provision linking threat intelligence to testing; full text reviewed (searched: threat intelligence, intelligence, scenario)", "url": "https://rulebook.centralbank.ae/en/entiresection/2413", "confidence": "verified" }, "provider_requirements": { "code": "recommended", "detail": "API penetration tests should be done by an independent function or an external expert with adequate skills. No accreditation scheme named.", "cite": "3.18", "url": "https://rulebook.centralbank.ae/en/entiresection/2413", "quote": "An independent function or external expert with adequate skills and knowledge should conduct vulnerability assessments and penetration tests on the Institution’s and the API Provider’s systems and infrastructure", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "An internal function may test APIs if it is independent.", "cite": "3.18", "url": "https://rulebook.centralbank.ae/en/entiresection/2413", "quote": "An independent function or external expert with adequate skills and knowledge should conduct vulnerability assessments and penetration tests", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "No social engineering testing.", "cite": "No provision; full text reviewed (searched: social engineering, phishing, staff testing)", "url": "https://rulebook.centralbank.ae/en/entiresection/2413", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Physical controls appear for biometrics and DLT (3.81, 3.144), not as a test target.", "cite": "No provision on physical testing; full text reviewed (searched: physical, premises, tamper)", "url": "https://rulebook.centralbank.ae/en/entiresection/2413", "confidence": "verified" }, "third_party": { "code": "permitted", "detail": "API penetration tests should cover the API Provider's systems and infrastructure as well as the institution's own.", "cite": "3.18", "url": "https://rulebook.centralbank.ae/en/entiresection/2413", "quote": "should conduct vulnerability assessments and penetration tests on the Institution’s and the API Provider’s systems and infrastructure to identify weaknesses or flaws in the security processes at least on an annual basis.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No mention of operational technology.", "cite": "No provision; full text reviewed (searched: operational technology, industrial, ICS)", "url": "https://rulebook.centralbank.ae/en/entiresection/2413", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "Payment services appear only as an example of innovative activity.", "cite": "No provision on testing payment systems; full text reviewed (searched: payment, SWIFT, card)", "url": "https://rulebook.centralbank.ae/en/entiresection/2413", "confidence": "verified" }, "cloud_saas": { "code": "permitted", "detail": "Institutions should run vulnerability assessments and penetration tests specific to each cloud arrangement, at least annually after implementation. Guidance language, not a rule.", "cite": "3.53; 3.61(b)", "url": "https://rulebook.centralbank.ae/en/entiresection/2413", "quote": "Institutions should conduct vulnerability assessments and penetration tests specific to the Cloud Computing arrangement to identify weaknesses or flaws in the security processes.", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "Outsourcing is defined to include providers outside the UAE and data center location must be assessed (3.40), but nothing addresses testing across borders.", "cite": "No provision on testing; full text reviewed (searched: outside the UAE, jurisdiction, cross-border, location)", "url": "https://rulebook.centralbank.ae/en/entiresection/2413", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming or replay.", "cite": "No provision; full text reviewed (searched: purple, replay, workshop)", "url": "https://rulebook.centralbank.ae/en/entiresection/2413", "confidence": "verified" }, "remediation_retest": { "code": "not_addressed", "detail": "Tests are to 'identify weaknesses'; nothing on fixing test findings or retesting. Remediation language covers incidents and configuration changes only (3.57, 3.59).", "cite": "No provision on remediating test findings; full text reviewed (searched: remediate, retest, findings)", "url": "https://rulebook.centralbank.ae/en/entiresection/2413", "confidence": "verified" }, "regulator_role": { "code": "not_addressed", "detail": "No regulator role in testing. Firms should address supervisor concerns before material cloud arrangements (2.11).", "cite": "No provision on regulator role in testing; full text reviewed (searched: Supervisory Authority, notify, report)", "url": "https://rulebook.centralbank.ae/en/entiresection/2413", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Material AI models should get rigorous, independent validation and testing before deployment. Separately, 3.55 covers conditions for automated testing and releases in cloud change management.", "cite": "3.102; 3.55", "url": "https://rulebook.centralbank.ae/en/entiresection/2413", "quote": "Institutions should, where relevant, conduct rigorous, independent validation and testing of material trained Big Data Analytics and AI models to ensure the accuracy, appropriateness, and reliability of the models prior to deployment.", "confidence": "verified" } } }, { "id": "ae-dfsa-gen-5-5", "jurisdiction": "United Arab Emirates", "region": "GCC", "sector": "financial", "name": "DFSA Rulebook General Module (GEN) section 5.5 Cyber risk management", "short": "DFSA GEN 5.5 (DIFC)", "issuer": "Dubai Financial Services Authority (DFSA), Dubai International Financial Centre", "version": "GEN [VER72/07-26]; section 5.5 added by DFSA RMI361/2023 [VER62/01-24]", "status": "In force (rulebook notes '[Added] DFSA RMI361/2023 (Made 21st June 2023). [VER62/01-24]'; current consolidated GEN is VER72/07-26, retrieved 2026-09-28, and 5.5.15 is unchanged). Proposed change: Consultation Paper 170 (published March 2026) would add GEN 5.6 Operational resilience with scenario testing of Critical Business Services; not in GEN VER72/07-26.", "public": "full", "primary_url": "https://dfsaen.thomsonreuters.com/entiresection/26146", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "The GEN module page and the GEN 5.5 section page on 2026-10-30 still show GEN VER72/07-26; the only text difference on the section page is the sidebar version of another module (PIB VER54/10-26). Consultation Paper 170 (Operational Resilience, March 27, 2026, comments closed May 26, 2026) is still listed as a consultation; no final rules or policy statement were found (see watch list). CP171 to CP174 do not touch GEN 5.5; CP174 Appendix 1 amends GEN only on token definitions. Arabic: the DFSA Rulebook is published in English, and dfsa.ae Arabic pages returned HTTP 403 (Cloudflare) to curl and WebFetch, so no DFSA Arabic spelling was copied. Context: Dubai Law No. (15) of 2024 defines Government Entity to include \"the authorities supervising Special Development Zones and free zones, such as the Dubai International Financial Centre\", and its Art. 15(a)(1) requires Government Entities that oversee Non-government Entities to set security controls for them and have DESC approve them. Whether this applies to GEN 5.5 is not stated in any public DFSA or DESC text." }, "notes": "Rules in force since January 2024 (VER62/01-24). DFSA Cyber Thematic Review 2024: questionnaire sent to 641 firms in Q1 2024 with a 95% response rate (p. 6); in the section on vulnerability assessments and penetration testing, almost 80% of firms declared they had implemented a comprehensive cybersecurity program (p. 11); 66% subscribed to cyber threat intelligence platforms (p. 9). The DFSA Threat Intelligence Platform (launched 2020) is voluntary. CP170 (March 2026) proposes GEN 5.6 operational resilience with testing against impact tolerances in severe but plausible scenarios; it is proposed, not in force as of GEN VER72/07-26. The consolidated GEN PDF states it has no legal effect; the online rulebook text (entiresection 26146) was used for the cited rule text and matches it.", "cells": { "legal_force": { "code": "mandatory", "detail": "GEN 5.5.15 is a Rule. The list of methods, including penetration tests and red team exercises, is Guidance.", "cite": "GEN 5.5.15", "url": "https://dfsaen.thomsonreuters.com/entiresection/26146", "quote": "An Authorised Person must ensure that: (a) it has in place a comprehensive programme to test the resilience of its IT Systems and Networks and its processes and controls implemented to comply with GEN Rules 5.5.6 to 5.5.14", "confidence": "verified" }, "scope": { "code": "all DFSA Authorised Persons", "detail": "Authorised Firms and Authorised Market Institutions for Financial Services in or from the DIFC; section 5.5 also covers a DIFC branch's activities wherever carried on. Not Authorised ISPVs or Representative Offices. DFSA says its cyber supervision also covers Registered Auditors and Credit Rating Agencies.", "cite": "GEN 5.1.1(1), (3), (5), (6)", "url": "https://dfsaen.thomsonreuters.com/sites/default/files/net_file_store/DFSA1547_1843_VER720726.pdf", "quote": "Subject to (5), this chapter applies to every Authorised Person with respect to the Financial Services carried on in or from the DIFC.", "confidence": "verified" }, "frequency": { "code": "annual (internet-facing)", "detail": "Testing must be regular and at least annual for internet-facing systems. Guidance expects more frequent testing for some firms and extra tests after system changes.", "cite": "GEN 5.5.15(b); GEN 5.5.15 Guidance 2", "url": "https://dfsaen.thomsonreuters.com/entiresection/26146", "quote": "testing under the programme is carried out regularly, and in the case of internet facing systems, at least annually", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Test methods follow the firm's cyber risk assessment (GEN 5.5.5(2)), not threat intelligence. Threat intelligence appears only for incident response plan reviews. The DFSA runs a voluntary Threat Intelligence Platform; its 2024 review found 66% of firms subscribed to cyber threat intelligence platforms.", "cite": "No provision tying threat intelligence to test design; GEN 5.5 full text reviewed (searched: threat intelligence, intelligence, scenario). CTI only in GEN 5.5.17 Guidance 4.", "url": "https://dfsaen.thomsonreuters.com/entiresection/26146", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "No independence, qualification or accreditation rule for testers.", "cite": "No provision; GEN 5.5 full text reviewed (searched: independent, external, qualified, certified, CREST, accredited)", "url": "https://dfsaen.thomsonreuters.com/entiresection/26146", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Silent on internal versus external testers.", "cite": "No provision; GEN 5.5 full text reviewed (searched: internal, in-house, third party tester)", "url": "https://dfsaen.thomsonreuters.com/entiresection/26146", "confidence": "verified" }, "social_engineering": { "code": "controls_test", "detail": "The mandatory test programme must cover the controls a firm puts in place under GEN 5.5.6 to 5.5.14, which include the GEN 5.5.14 training and awareness rule (GEN 5.5.15(a)). GEN 5.5 names no social engineering method, and Guidance 1 lists red team exercises without saying they target people. The DFSA's 2024 thematic review mentions phishing simulation campaigns among the awareness activities many firms lack; it describes practice and does not set the code.", "cite": "GEN 5.5.15(a); GEN 5.5.14; DFSA Cyber Thematic Review 2024, p. 12 considered", "url": "https://dfsaen.thomsonreuters.com/entiresection/26146", "quote": "it has in place a comprehensive programme to test the resilience of its IT Systems and Networks and its processes and controls implemented to comply with GEN Rules 5.5.6 to 5.5.14", "confidence": "verified", "history": [ { "date": "2026-10-30", "from": "permitted", "to": "controls_test", "why": "GEN 5.5.15(a) makes the test programme cover the GEN 5.5.14 training controls and GEN 5.5 names no social engineering method; the 2024 thematic review describes practice and does not set the code. Coded as CMA VASP Art. 51(16)(a)." } ], "harmonized_from": "permitted", "harmonize_reason": "R2: GEN 5.5.15(a) makes the test programme cover the GEN 5.5.14 training controls and GEN 5.5 names no social engineering method; the 2024 thematic review describes practice and does not set the code. Coded as CMA VASP Art. 51(16)(a)." }, "physical": { "code": "controls_test", "detail": "The mandatory test program must cover controls implemented under GEN 5.5.6 to 5.5.14, which include GEN 5.5.13 on physical access to data centers and server rooms. The method is not specified.", "cite": "GEN 5.5.15(a); GEN 5.5.13", "url": "https://dfsaen.thomsonreuters.com/entiresection/26146", "quote": "An Authorised Person must limit physical access to its data centres and server rooms, if any, to individuals who have a legitimate business need.", "confidence": "verified", "harmonized_from": "required", "harmonize_reason": "Test programme must cover GEN 5.5.13 physical access controls; method not specified." }, "third_party": { "code": "assurance_only", "detail": "Contracts with ICT providers must let the firm verify the provider's cyber security. Guidance says self-verification by the provider is not enough. Testing is not named as the method.", "cite": "GEN 5.5.3(1)(b)(iv); GEN 5.5.3 Guidance 2", "url": "https://dfsaen.thomsonreuters.com/entiresection/26146", "quote": "allow the Authorised Person to verify that the third party continues to meet the Authorised Person’s cyber security requirements", "confidence": "verified", "harmonized_from": "permitted", "harmonize_reason": "GEN 5.5.3(1)(b)(iv): contracts must let the firm verify the provider's cyber security; testing not named." }, "ot": { "code": "not_addressed", "detail": "No mention of operational technology.", "cite": "No provision; GEN 5.5 full text reviewed (searched: operational technology, industrial, ICS, SCADA)", "url": "https://dfsaen.thomsonreuters.com/entiresection/26146", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No mention of payment systems in the cyber section.", "cite": "No provision; GEN 5.5 full text reviewed (searched: payment, SWIFT, card, settlement)", "url": "https://dfsaen.thomsonreuters.com/entiresection/26146", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "Cloud appears only as a reference standard (CSA Cloud Controls Matrix) in GEN 5.5.2 Guidance 1. Nothing on testing cloud services.", "cite": "No provision on testing cloud; GEN 5.5 full text reviewed (searched: cloud, SaaS, hosting)", "url": "https://dfsaen.thomsonreuters.com/entiresection/26146", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "GEN chapter 5, which holds section 5.5 and its testing rule (GEN 5.5.15), applies in a Prudential Context to a Domestic Firm's activities wherever they are carried on (GEN 5.1.1(2)). Sections 5.3 and 5.5 also apply to an Authorised Firm's entire DIFC branch's activities wherever they are carried on (GEN 5.1.1(3)). A firm may rely on group-wide cyber policies (GEN 5.5.2 Guidance 2). Nothing on multi-jurisdiction tests, recognition of tests run abroad or where testers sit.", "cite": "GEN 5.1.1(2) and (3); GEN 5.5.2 Guidance 2", "url": "https://dfsaen.thomsonreuters.com/sites/default/files/net_file_store/DFSA1547_1843_VER720726.pdf", "confidence": "verified", "quote": "Sections 5.3 and 5.5 also apply to an Authorised Firm in a Prudential Context with respect to its entire DIFC branch’s activities wherever they are carried on.", "history": [ { "date": "2026-10-30", "from": "not_addressed", "to": "addressed", "why": "GEN 5.1.1(2) and (3) apply chapter 5, which holds the GEN 5.5 testing rule, to activities wherever they are carried on, the same kind of application rule counted for QFCRA CTRL 1.1.4(2), CBB and APRA." } ], "harmonized_from": "not_addressed", "harmonize_reason": "R1: GEN 5.1.1(2) and (3) apply chapter 5, which holds the GEN 5.5 testing rule, to activities wherever they are carried on, the same kind of application rule counted for QFCRA CTRL 1.1.4(2), CBB and APRA." }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming or replay.", "cite": "No provision; GEN 5.5 full text reviewed (searched: purple, replay, workshop, blue team)", "url": "https://dfsaen.thomsonreuters.com/entiresection/26146", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Firms must have a process to prioritize and remedy adverse test outcomes. Guidance expects extra tests when systems change to fix vulnerabilities found in testing, which is a retest expectation.", "cite": "GEN 5.5.15(c); GEN 5.5.15 Guidance 2", "url": "https://dfsaen.thomsonreuters.com/entiresection/26146", "quote": "it has in place a process to prioritise and remedy adverse testing outcomes.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "The DFSA reviews testing programs in firm-specific cyber risk assessments. It does not lead or approve individual tests.", "cite": "DFSA Cyber Thematic Review 2024, p. 14 (Next Steps)", "url": "https://www.dfsa.ae/download_file/3762/0", "quote": "The DFSA will continue conducting Firm specific cyber risk assessments.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "The DFSA found firms relying only on automated vulnerability scans and said they should also use scenario-based tests, penetration tests or red team exercises.", "cite": "DFSA Cyber Thematic Review 2024, p. 11", "url": "https://www.dfsa.ae/download_file/3762/0", "quote": "a number of Firms only conduct automated vulnerability scans and do not use other methods to test their critical IT infrastructure and information systems, including scenario-based testing, penetration tests and/or red team exercises.", "confidence": "verified" } } }, { "id": "ae-adgm-fsra-gen-3-5", "jurisdiction": "United Arab Emirates", "region": "GCC", "sector": "financial", "name": "FSRA General Rulebook (GEN) Rule 3.5 Cyber Risk Management, with the FSRA Information Technology Risk Management Guidance", "short": "ADGM FSRA GEN 3.5", "issuer": "Financial Services Regulatory Authority (FSRA), Abu Dhabi Global Market", "version": "GEN VER15.160926; IT Risk Management Guidance VER01.201124", "status": "In force. Compliance required from January 31, 2026 per FSRA announcement of July 29, 2025; ADGM IT Risk Management page (retrieved 2026-09-28) says the rules came into force on January 31, 2026. Current GEN is VER15.160926. The guidance is non-binding.", "public": "full", "primary_url": "https://en.adgm.thomsonreuters.com/entiresection/28467", "regulator_arabic": "سلطة تنظيم الخدمات المالية", "arabic_source_url": "https://assets.adgm.com/download/assets/20260713+ADGM%E2%80%99s+FSRA+Publishes+Its+2025+Annual+Report+AR.pdf/480916c27ea511f1bae76aed851373da", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "GEN 3.5 section text and the GEN 3.5 landing page are unchanged in text; both still point to GEN VER15.160926. FSRA papers published after 2026-09-28 do not change GEN 3.5 testing: CP 6 of 2026 (October 9, fees and late-filing fees, comments to November 6, 2026) and CP 5 of 2026 (October 6, draft DeFi Risk Management Guidance, comments to November 30, 2026), whose testing language is stress testing and tabletop exercises. The FSRA Arabic name is copied from an ADGM Arabic press release dated July 13, 2026 (a Word file served with a .pdf name). No Arabic version of the GEN Rulebook was found; adgm.com/ar returned HTTP 404. FSRA notice FSRA/FCCP/146/2025 (October 17, 2025) told ADGM firms that adherence to the CSC national cyber security policies \"is not mandatory\"." }, "notes": "New in 2025/2026: binding cyber rules made July 29, 2025 after Consultation Paper No. 3 of 2025, compliance from January 31, 2026. The GEN 3.5.14 testing rule copies DFSA GEN 5.5.15 but adds bug bounty programs to the method list. Material cyber incidents must be notified within 24 hours (GEN 3.5.18), against 72 hours at the DFSA (GEN 5.5.19). The 2024 IT Risk Management Guidance chapter 10.3 is the most detailed public UAE financial text on adversarial testing: test scoping, scenarios of compromise, agreed stop points, testing outside peak hours, and retest before closure.", "cells": { "legal_force": { "code": "mixed", "detail": "GEN 3.5.14 is a binding rule requiring a test program. The testing methods list is Guidance, and the IT Risk Management Guidance says it is not binding.", "cite": "GEN 3.5.14(2); ITRMG Introduction iii and ix", "url": "https://en.adgm.thomsonreuters.com/entiresection/28467", "quote": "An Authorised Person must ensure that: (a) it has in place a comprehensive programme to test the resilience of its IT Systems and Networks and its processes and controls implemented to comply with Rules 3.5.5 to 3.5.13", "confidence": "verified" }, "scope": { "code": "all Authorised Persons and Recognised Bodies", "detail": "The July 2025 amendments cover Authorised Persons and Recognised Bodies in ADGM, including through matching changes to MIR, PRU, PIN, COBS and CIB.", "cite": "GEN 3.5.1; FSRA announcement July 29, 2025", "url": "https://www.adgm.com/media/announcements/adgms-fsra-issues-cyber-risk-management-framework", "quote": "The Financial Services Regulatory Authority (FSRA) of ADGM today announced the implementation of amendments to its regulatory framework for Authorised Persons and Recognised Bodies in relation to cyber risk management.", "confidence": "verified" }, "frequency": { "code": "annual (internet-facing)", "detail": "Regular testing, at least annually for internet-facing systems, plus tests after system changes (Guidance 2).", "cite": "GEN 3.5.14(2)(b)", "url": "https://en.adgm.thomsonreuters.com/entiresection/28467", "quote": "testing under the programme is carried out regularly, and in the case of internet-facing systems, at least annually", "confidence": "verified" }, "threat_intel": { "code": "recommended", "detail": "The guidance describes red teaming as simulating threat intelligence-driven targeted attacks and says scenarios of compromise should follow the channels a threat actor could use. The rule itself ties testing to the firm's cyber risk assessment.", "cite": "ITRMG 10.3.3; ITRMG 10.3.4.b", "url": "https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_27332_VER01.201124.pdf", "quote": "red teaming exercises where a team of cyber security experts are permitted to simulate sophisticated threat intelligence-driven targeted attacks against the financial institution.", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "No independence, qualification or accreditation rule for testers.", "cite": "No provision; GEN 3.5 and ITRMG chapter 10 reviewed (searched: independent, qualified, certified, CREST, accredited)", "url": "https://en.adgm.thomsonreuters.com/entiresection/28467", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Silent on internal versus external testers.", "cite": "No provision; GEN 3.5 and ITRMG chapter 10 reviewed (searched: internal, in-house, external party)", "url": "https://en.adgm.thomsonreuters.com/entiresection/28467", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "The guidance lists social engineering exercises such as phishing campaigns on staff as one form of adversarial testing.", "cite": "ITRMG 10.3.3", "url": "https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_27332_VER01.201124.pdf", "quote": "Such testing can take the form of traditional penetration tests of online platforms, social engineering exercises such as phishing email campaigns on staff, threat hunting exercises, bug bounty programmes", "confidence": "verified" }, "physical": { "code": "controls_test", "detail": "The mandatory test program must cover controls under GEN 3.5.5 to 3.5.13, which include GEN 3.5.12 on physical access to data centers and server rooms. The method is not specified.", "cite": "GEN 3.5.14(2)(a); GEN 3.5.12", "url": "https://en.adgm.thomsonreuters.com/entiresection/28467", "quote": "An Authorised Person must limit physical access to its data centres and server rooms, if any, to individuals who have a legitimate business need.", "confidence": "verified", "harmonized_from": "required", "harmonize_reason": "Test programme must cover GEN 3.5.12 physical access controls; method not specified." }, "third_party": { "code": "permitted", "detail": "Guidance says tests should involve third-party service providers where appropriate. GEN 3.5.2(1)(c)(iii) requires ICT providers to let the firm verify their security.", "cite": "ITRMG 10.3.5; GEN 3.5.2(1)(c)(iii)", "url": "https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_27332_VER01.201124.pdf", "quote": "a financial institution should involve relevant stakeholders, such as the governing body, senior management, business functions, third party service provides and customers.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No mention of operational technology.", "cite": "No provision; GEN 3.5 and ITRMG reviewed (searched: operational technology, industrial, ICS, SCADA)", "url": "https://en.adgm.thomsonreuters.com/entiresection/28467", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No testing provision for payment systems.", "cite": "No provision; GEN 3.5 and ITRMG chapter 10 reviewed (searched: payment, SWIFT, card)", "url": "https://en.adgm.thomsonreuters.com/entiresection/28467", "confidence": "verified" }, "cloud_saas": { "code": "permitted", "detail": "Cloud services count as ICT Services under the third-party rule, and the asset inventory should include SaaS and cloud-hosted applications, so they fall inside the tested estate. The FSRA co-issued guidance recommends annual cloud-specific penetration tests.", "cite": "GEN 3.5.4 Guidance 4; GEN 3.5.2 Guidance 1; Enabling Technologies Guidelines 3.61(b)", "url": "https://en.adgm.thomsonreuters.com/entiresection/28467", "quote": "It should also include ICT Assets belonging to third parties upon which Authorised Person depends, including software as a service and cloud-hosted applications.", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "GEN chapter 3, which holds Rule 3.5 and its testing rule (GEN 3.5.14), applies in a Prudential Context to a Domestic Firm's activities wherever they are carried on (GEN 3.1(2)). A firm may rely on group-wide cyber policies (GEN 3.5.1 Guidance 4). Nothing on multi-jurisdiction tests, recognition of tests run abroad or where testers sit.", "cite": "GEN 3.1(2); GEN 3.5.1 Guidance 4", "url": "https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_7584_VER15160926.pdf", "confidence": "verified", "quote": "It also applies in a Prudential Context to a Domestic Firm with respect to all its activities wherever they are carried on.", "history": [ { "date": "2026-10-30", "from": "not_addressed", "to": "addressed", "why": "GEN 3.1(2) applies chapter 3, which holds the GEN 3.5 testing rule, to a Domestic Firm's activities wherever they are carried on, the same kind of application rule counted for QFCRA, CBB and APRA." } ], "harmonized_from": "not_addressed", "harmonize_reason": "R1: GEN 3.1(2) applies chapter 3, which holds the GEN 3.5 testing rule, to a Domestic Firm's activities wherever they are carried on, the same kind of application rule counted for QFCRA, CBB and APRA." }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming or replay workshops.", "cite": "No provision; GEN 3.5 and ITRMG reviewed (searched: purple, replay, workshop)", "url": "https://en.adgm.thomsonreuters.com/entiresection/28467", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "The rule requires a process to prioritize and remedy adverse test outcomes. Guidance says to fix all findings and retest them before closing.", "cite": "GEN 3.5.14(2)(c); ITRMG 10.3.4.f", "url": "https://en.adgm.thomsonreuters.com/entiresection/28467", "quote": "it has in place a process to prioritise and remedy adverse testing outcomes.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "The FSRA assesses IT practices in supervision. Test results must be reported regularly to senior management (GEN 3.5.14(3)), not filed with the FSRA.", "cite": "ADGM IT Risk Management page; GEN 3.5.14(3)", "url": "https://www.adgm.com/operating-in-adgm/it-risk-management", "quote": "The FSRA incorporates the assessment of IT practices as part of its supervisory activities over Authorised Persons, Recognised Bodies, and applicants for a Financial Services Permission.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Guidance suggests automated vulnerability scanning systems. The IT Risk Management Guidance also covers AI systems in chapter 14.", "cite": "GEN 3.5.10 Guidance 2", "url": "https://en.adgm.thomsonreuters.com/entiresection/28467", "quote": "An Authorised Person may wish to consider using automated vulnerability scanning systems to assist in effectively identifying and assessing vulnerabilities resulting from new and evolving threats.", "confidence": "verified" } } }, { "id": "ae-csc-ia-standard-v2-1", "jurisdiction": "United Arab Emirates", "region": "GCC", "sector": "cross-sector", "name": "UAE Information Assurance Standard", "short": "UAE IA Standard v2.1", "issuer": "UAE Cyber Security Council (CSC)", "version": "Version 2.1, November 2025 (last verified from the Internet Archive capture of 2026-04-03; not re-verified on 2026-10-30)", "status": "Current national standard as of 2026-09-28. CSC policy page shows 'PUBLISHED SEP 22, 2025' (Wayback capture of April 3, 2026); the attached PDF is Version 2.1, November 2025. It revises the TDRA (then TRA) UAE Information Assurance Regulation v1.1 of March 2020. csc.gov.ae refused connections from our network, so both page and PDF were retrieved from Internet Archive captures of the CSC URLs.", "public": "full", "primary_url": "https://csc.gov.ae/en/w/uae-information-assurance-standard", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unreachable", "note": "csc.gov.ae refused connections on 2026-10-30 (curl: TLS error; WebFetch: connection reset). web.archive.org also refused connections from this network and from WebFetch, so no newer capture could be checked. The September coding is kept unchanged. Web searches found no primary record of an IA Standard edition after v2.1; consultant pages still cite v2.1. Arabic fields are null because no CSC Arabic page or document could be opened; the archived copies hold no Arabic text. Context: FSRA notice FSRA/FCCP/146/2025 says adherence to CSC national policies is not mandatory for ADGM firms." }, "notes": "Predecessor: TDRA UAE Information Assurance Regulation v1.1 (March 2020), mandatory for critical entities designated by TRA under the CIIP Policy (section 2.1). In v1.1, penetration testing appears only in non-binding guidance: M5.4.1 (technical compliance checking), T7.3 automation guidance, and T7.8.6 guidance on supply chain assessments. v2.1 adds a threat intelligence control (T3.3.1), a third-party risk control (T6.2.1) whose guidance mentions supplier penetration tests and red teaming, and AI mappings. v2.1 lists DESC Information Security Regulation v3 among its references. TDRA separately offers government entities a penetration testing service: free of charge, 11 working days, with a Rules of Engagement document and a vulnerability report (TDRA service page, last updated 18/05/2023). The CSC also published a National Cloud Security Policy v2.0, not reviewed here.", "cells": { "legal_force": { "code": "mandatory", "detail": "In-scope entities must show compliance. 'Always Applicable' controls and their sub-controls are mandatory; other controls apply based on risk assessment. Implementation guidance, where penetration testing appears, is for information only.", "cite": "Section 1.1; Section 2.1 (Controls; Implementation Guidance)", "url": "https://csc.gov.ae/documents/38662/0/UAE+INFORMATION+ASSURANCE+STANDARD.pdf/abe25941-cdcf-2e44-9fd9-bf6bc8095f2a", "quote": "The information on possible automation and the implementation guidance for security controls are provided for information purposes only and can be implemented as the entity prefers, without any further explanation or justification.", "confidence": "verified" }, "scope": { "code": "federal bodies and non-government CII", "detail": "Ministries and federal authorities and non-government Critical Information Infrastructure entities. Emirate government entities are covered where no Emirate CIIP program exists; otherwise the Emirate lead enforces it.", "cite": "Section 1.2", "url": "https://csc.gov.ae/documents/38662/0/UAE+INFORMATION+ASSURANCE+STANDARD.pdf/abe25941-cdcf-2e44-9fd9-bf6bc8095f2a", "quote": "The UAE Information Assurance Standard applies to Ministries & Federal Authorities and Non-Government Critical Information Infrastructure (CII) Entities.", "confidence": "verified" }, "frequency": { "code": "not_addressed", "detail": "The mandatory vulnerability control sets no test interval. Guidance recommends annual internal audits, not tests.", "cite": "No provision; T3.3.2 and T7.4.3 reviewed (searched: annual, quarterly, frequency, periodic penetration)", "url": "https://csc.gov.ae/documents/38662/0/UAE+INFORMATION+ASSURANCE+STANDARD.pdf/abe25941-cdcf-2e44-9fd9-bf6bc8095f2a", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "T3.3.1 (new in v2.1, applicable based on risk assessment) requires collecting and acting on threat intelligence, but nothing links it to test scenarios.", "cite": "No provision linking threat intelligence to testing; full text reviewed (searched: threat intelligence, scenario, red team). General duty in T3.3.1.", "url": "https://csc.gov.ae/documents/38662/0/UAE+INFORMATION+ASSURANCE+STANDARD.pdf/abe25941-cdcf-2e44-9fd9-bf6bc8095f2a", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Under the National Cyber Security Accreditation Program (NCAP) v2.0, firms providing penetration testing to Government must comply with NCAP and show staff competence through industry-recognized certifications. The IA Standard guidance adds that tests be done by 'competent and authorized persons'.", "cite": "NCAP v2.0 (September 2025) section 2.1.1.1; IA Standard T3.3.2 Implementation Guidance (e)", "url": "https://csc.gov.ae/documents/38662/0/Cyber+Accreditation+Program_V2.0.pdf/496a178d-bcbd-a2a5-546b-8c162761e4df", "quote": "an entity seeking to provide penetration testing services to Government must be able to demonstrate compliance with NCAP requirements, and that personnel have an appropriate level of competence through maintaining industry recognized certifications", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "No bar on in-house testers. Guidance says testing must be by competent and authorized persons, and in-house development tests should be followed by independent acceptance testing.", "cite": "T3.3.2 Implementation Guidance (e); T7.4.3 Implementation Guidance (f)", "url": "https://csc.gov.ae/documents/38662/0/UAE+INFORMATION+ASSURANCE+STANDARD.pdf/abe25941-cdcf-2e44-9fd9-bf6bc8095f2a", "quote": "conducting planned, documented, and repeatable penetration tests or vulnerability assessments by competent and authorized persons to support the identification of vulnerabilities", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "Phishing and social engineering appear only as threats, not as test types.", "cite": "No provision; full text reviewed (searched: social engineering, phishing simulation, simulated phishing, awareness test)", "url": "https://csc.gov.ae/documents/38662/0/UAE+INFORMATION+ASSURANCE+STANDARD.pdf/abe25941-cdcf-2e44-9fd9-bf6bc8095f2a", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Physical security controls exist (T2) but no physical testing.", "cite": "No provision on physical testing; full text reviewed (searched: physical penetration, physical test, intrusion test)", "url": "https://csc.gov.ae/documents/38662/0/UAE+INFORMATION+ASSURANCE+STANDARD.pdf/abe25941-cdcf-2e44-9fd9-bf6bc8095f2a", "confidence": "verified" }, "third_party": { "code": "permitted", "detail": "For high-risk suppliers, guidance lists periodic vulnerability assessments and penetration testing, and involving the supplier in red teaming or tabletop exercises. T6.2.1 itself (always applicable) requires classifying suppliers by risk and mitigating supplier risk.", "cite": "T6.2.1 Implementation Guidance (c) and (g)", "url": "https://csc.gov.ae/documents/38662/0/UAE+INFORMATION+ASSURANCE+STANDARD.pdf/abe25941-cdcf-2e44-9fd9-bf6bc8095f2a", "quote": "Involving high risk suppliers in resilience assessments and simulations such as red teaming or cyber tabletop exercises.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No testing provision for operational technology.", "cite": "No provision; full text reviewed (searched: operational technology, OT, ICS, SCADA, industrial control)", "url": "https://csc.gov.ae/documents/38662/0/UAE+INFORMATION+ASSURANCE+STANDARD.pdf/abe25941-cdcf-2e44-9fd9-bf6bc8095f2a", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No testing provision for payment systems.", "cite": "No provision; full text reviewed (searched: payment, SWIFT, card)", "url": "https://csc.gov.ae/documents/38662/0/UAE+INFORMATION+ASSURANCE+STANDARD.pdf/abe25941-cdcf-2e44-9fd9-bf6bc8095f2a", "confidence": "verified" }, "cloud_saas": { "code": "permitted", "detail": "Third-party risk procedures, including the high-risk supplier measures that list penetration testing, also apply to the entity's use of cloud service providers.", "cite": "T6.2.1 Implementation Guidance", "url": "https://csc.gov.ae/documents/38662/0/UAE+INFORMATION+ASSURANCE+STANDARD.pdf/abe25941-cdcf-2e44-9fd9-bf6bc8095f2a", "quote": "This should also apply to the entity’s use of resources of cloud service providers as well.", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "Cross-border data and legal issues are addressed for information transfer and compliance, not for testing.", "cite": "No provision on testing; full text reviewed (searched: cross-border, jurisdiction, outside the UAE, national borders)", "url": "https://csc.gov.ae/documents/38662/0/UAE+INFORMATION+ASSURANCE+STANDARD.pdf/abe25941-cdcf-2e44-9fd9-bf6bc8095f2a", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming or replay.", "cite": "No provision; full text reviewed (searched: purple, replay, workshop)", "url": "https://csc.gov.ae/documents/38662/0/UAE+INFORMATION+ASSURANCE+STANDARD.pdf/abe25941-cdcf-2e44-9fd9-bf6bc8095f2a", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "The always-applicable vulnerability control requires a remediation plan before production and measures to address vulnerabilities. Guidance adds testing to confirm the fix works. No deadlines.", "cite": "T3.3.2 Sub-Controls 1 to 3; T3.3.2 Implementation Guidance (g)", "url": "https://csc.gov.ae/documents/38662/0/UAE+INFORMATION+ASSURANCE+STANDARD.pdf/abe25941-cdcf-2e44-9fd9-bf6bc8095f2a", "quote": "identify vulnerabilities in both new and existing systems and applications and define a remediation plan before placing them in a production environment. 2) test, review, check, and verify the presence of vulnerabilities in production systems.", "confidence": "verified" }, "regulator_role": { "code": "leads_or_oversees_test", "detail": "The CSC reviews self-assessments and may perform or commission compliance audits and tests of entities. Entities must facilitate testing when the CSC requests it.", "cite": "Section 3.6, Table 3", "url": "https://csc.gov.ae/documents/38662/0/UAE+INFORMATION+ASSURANCE+STANDARD.pdf/abe25941-cdcf-2e44-9fd9-bf6bc8095f2a", "quote": "Where appropriate, perform or commission tests on relevant entities to ensure that IA measures are in place, as well as their effectiveness.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Guidance allows automated tools such as code analysis and vulnerability scanners in security testing. The Chapter 4 appendix maps the National Cyber Security Policy for AI, which requires vulnerability management for AI/ML systems, onto IA controls.", "cite": "T7.4.3 Implementation Guidance (e); Chapter 4 Appendix, National Cyber Security Policy for Artificial Intelligence 2.2", "url": "https://csc.gov.ae/documents/38662/0/UAE+INFORMATION+ASSURANCE+STANDARD.pdf/abe25941-cdcf-2e44-9fd9-bf6bc8095f2a", "quote": "Implementing a systematic vulnerability management process to detect, assess, and remediate weaknesses in AI/ML systems.", "confidence": "verified" } } }, { "id": "ae-desc-isr", "jurisdiction": "United Arab Emirates", "region": "GCC", "sector": "government", "name": "Dubai Government Information Security Regulation (ISR)", "short": "Dubai DESC ISR", "issuer": "Dubai Electronic Security Center (DESC)", "version": "Version 3 (edition date not public); text available from DESC by email request only", "status": "In force for Dubai Government Entities per DESC Standards & Policies page (retrieved 2026-09-28). The ISR text is not downloadable; DESC offers it by email request only. DESC held a 'Multaqa ISR Officers' forum in January 2026 on ISR adoption and an ISR Officer Certification Program.", "public": "not_public", "primary_url": "https://www.desc.gov.ae/regulations/standards-policies/", "arabic_title": "نظام أمن المعلومات", "regulator_arabic": "مركز دبي للأمن الإلكتروني", "arabic_source_url": "https://www.desc.gov.ae/regulations-ar/standards-policies-ar/", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "The DESC Standards and Policies page text was identical to the 2026-09-28 copy; the ISR text is still offered by email request only, so 13 cells stay unknown_not_public. The four changes come from Dubai Law No. (15) of 2024 on the Dubai Electronic Security Centre (Dubai Legislation Portal), which the September coding did not use, plus the register count. Art. 14(8) of that law is a provider rule for every covered entity, not only for ISR testing. The Arabic title is the ISR heading on the DESC Arabic page; the same page also says \"نظام أمن المعلومات لحكومة دبي\" in running text. Dubai Law No. (15) of 2024 calls the centre the \"Dubai Electronic Security Centre\"; DESC's own English pages use \"Center\"." }, "notes": "Only the provider rule (Dubai Cyber Force) and the ISR's legal basis and scope can be coded from DESC's public statements. Cyber Force register on 2026-09-28: 32 penetration testing companies listing 77 certified individuals in total, and 13 incident response companies; one penetration testing listing showed an expiry date of 21/09/2026, before the snapshot date. CREST's program page lists accepted individual certifications (for example CRT and OSCP for team members, CCT INF, CCT APP, OSEP, OSWE and GXPN for team leaders) and requires Dubai Police security clearance; that page is a partner statement. dcipark.gov.ae/cyber_force, linked from the DESC release, did not resolve from our network.", "cells": { "legal_force": { "code": "mandatory", "detail": "Code unchanged; legal basis updated. Law No. (15) of 2024 supersedes Law No. (11) of 2014 and repeals Executive Council Resolution No. (13) of 2012, the two texts the DESC page cites for the ISR (Art. 23(a) and (b)). Art. 23(c) keeps legislation issued under them in force until replaced. Art. 14(1) makes compliance with DESC regulations a legal duty.", "cite": "Dubai Law No. (15) of 2024, Art. 14(1); Art. 23", "url": "https://dlp.dubai.gov.ae/Legislation%20Reference/2024/Law%20No.%20(15)%20of%202024%20Concerning%20the%20Dubai%20Electronic%20Security%20Centre.html", "quote": "A Government Entity or a Critical Non-government Entity must: 1. comply with the Electronic Security regulations, standards, and rules issued by DESC", "confidence": "verified" }, "scope": { "code": "Dubai Government Entities and DESC-classified Critical Non-government Entities", "detail": "Correction from a source the September coding missed. Dubai Law No. (15) of 2024 (issued September 4, 2024, in force on publication) tasks DESC with overseeing ISR compliance by Government Entities and by Non-government Entities that DESC classifies as critical. Non-government Entities include firms licensed in free zones such as the DIFC. The DESC ISR page still describes the ISR as applicable to Dubai Government Entities, and the classification framework is not public.", "cite": "Dubai Law No. (15) of 2024, Art. 6(5); Art. 2 (definitions of Non-government Entity and Critical Non-government Entity)", "url": "https://dlp.dubai.gov.ae/Legislation%20Reference/2024/Law%20No.%20(15)%20of%202024%20Concerning%20the%20Dubai%20Electronic%20Security%20Centre.html", "quote": "develop the Information Security Regulation and oversee compliance by the Government Entities and Critical Non-government Entities with this regulation", "confidence": "verified", "history": [ { "date": "2026-10-30", "from": "Dubai Government Entities", "to": "Dubai Government Entities and DESC-classified Critical Non-government Entities", "why": "Correction from a source the September coding missed. Dubai Law No. (15) of 2024 (issued September 4, 2024, in force on publication) tasks DESC with overseeing ISR compliance by Government Entities and by Non-government Entities that DESC classifies as critical. Non-government Entities include firms licensed in free zones such as the DIFC. The DESC ISR page still describes the ISR as applicable to Dubai Government Entities, and the classification framework is not public." } ] }, "frequency": { "code": "unknown_not_public", "detail": "ISR text not public. DESC provides it to Dubai government entities by email request only.", "cite": "ISR text available only by email request to DESC", "url": "https://www.desc.gov.ae/regulations/standards-policies/", "confidence": "unverified" }, "threat_intel": { "code": "unknown_not_public", "detail": "ISR text not public.", "cite": "ISR text available only by email request to DESC", "url": "https://www.desc.gov.ae/regulations/standards-policies/", "confidence": "unverified" }, "provider_requirements": { "code": "required", "detail": "Code unchanged; source and count updated. The rule now rests on primary law, not only on the 2023 launch release and the CREST partner page: covered entities may not engage a security company that DESC has not certified. The DESC Cyber Force register on 2026-10-30 listed 33 penetration testing companies (82 individuals) and 13 incident response companies, against 32 (77 individuals) and 13 on 2026-09-28. Two penetration testing companies were added and one dropped. Three penetration testing listings showed expiry dates before 2026-10-30 (October 21, 22 and 29, 2026).", "cite": "Dubai Law No. (15) of 2024, Art. 14(8); DESC Certified Providers page, retrieved 2026-10-30", "url": "https://dlp.dubai.gov.ae/Legislation%20Reference/2024/Law%20No.%20(15)%20of%202024%20Concerning%20the%20Dubai%20Electronic%20Security%20Centre.html", "quote": "not engage any private company or establishment specialised in Electronic Security or host the Data of such a company or establishment, unless this company or establishment is certified by DESC in accordance with the relevant standards and rules prescribed by DESC", "confidence": "verified" }, "internal_testers": { "code": "unknown_not_public", "detail": "ISR text not public. Cyber Force governs outside providers; whether in-house teams may test is not stated publicly.", "cite": "ISR text available only by email request to DESC", "url": "https://www.desc.gov.ae/regulations/standards-policies/", "confidence": "unverified" }, "social_engineering": { "code": "unknown_not_public", "detail": "ISR text not public. DESC ran a phishing awareness activity at its January 2026 ISR officers forum, which is not a testing rule.", "cite": "ISR text available only by email request to DESC", "url": "https://www.desc.gov.ae/regulations/standards-policies/", "confidence": "unverified" }, "physical": { "code": "unknown_not_public", "detail": "ISR text not public.", "cite": "ISR text available only by email request to DESC", "url": "https://www.desc.gov.ae/regulations/standards-policies/", "confidence": "unverified" }, "third_party": { "code": "unknown_not_public", "detail": "ISR text not public.", "cite": "ISR text available only by email request to DESC", "url": "https://www.desc.gov.ae/regulations/standards-policies/", "confidence": "unverified" }, "ot": { "code": "unknown_not_public", "detail": "ISR text not public. DESC has a separate ICS (OT) standard for Dubai government and semi-government entities that operate critical infrastructure or industrial control systems, also available only on request.", "cite": "DESC Standards & Policies page, ICS standard section (regulator public statement)", "url": "https://www.desc.gov.ae/regulations/standards-policies/", "confidence": "unverified" }, "payment_systems": { "code": "unknown_not_public", "detail": "ISR text not public.", "cite": "ISR text available only by email request to DESC", "url": "https://www.desc.gov.ae/regulations/standards-policies/", "confidence": "unverified" }, "cloud_saas": { "code": "unknown_not_public", "detail": "ISR text not public. DESC's separate CSP Security Standard is mandatory for cloud providers serving Dubai government entities and uses ISO/IEC 27001-style certification with yearly surveillance audits; its testing content was not reviewed.", "cite": "DESC Certifications page, CSP Security Standard (regulator public statement)", "url": "https://www.desc.gov.ae/regulations/certifications/", "confidence": "unverified" }, "cross_border": { "code": "unknown_not_public", "detail": "ISR text not public.", "cite": "ISR text available only by email request to DESC", "url": "https://www.desc.gov.ae/regulations/standards-policies/", "confidence": "unverified" }, "purple_replay": { "code": "unknown_not_public", "detail": "ISR text not public.", "cite": "ISR text available only by email request to DESC", "url": "https://www.desc.gov.ae/regulations/standards-policies/", "confidence": "unverified" }, "remediation_retest": { "code": "unknown_not_public", "detail": "ISR text not public.", "cite": "ISR text available only by email request to DESC", "url": "https://www.desc.gov.ae/regulations/standards-policies/", "confidence": "unverified" }, "regulator_role": { "code": "examines", "detail": "Correction from the same missed law. DESC must audit and assess compliance by Government Entities and Critical Non-government Entities with security legislation and standards (Art. 6(8)) and oversee ISR compliance (Art. 6(5)). Whether DESC leads, approves or receives individual tests is still not public.", "cite": "Dubai Law No. (15) of 2024, Art. 6(8); Art. 6(5)", "url": "https://dlp.dubai.gov.ae/Legislation%20Reference/2024/Law%20No.%20(15)%20of%202024%20Concerning%20the%20Dubai%20Electronic%20Security%20Centre.html", "confidence": "verified", "history": [ { "date": "2026-10-30", "from": "unknown_not_public", "to": "examines", "why": "Correction from the same missed law. DESC must audit and assess compliance by Government Entities and Critical Non-government Entities with security legislation and standards (Art. 6(8)) and oversee ISR compliance (Art. 6(5)). Whether DESC leads, approves or receives individual tests is still not public." } ], "quote": "develop, in coordination with the concerned entities in the Emirate, the measures required for auditing and assessing compliance with the Electronic Security legislation, policies, regulations, standards, and manuals; and assess compliance by Government Entities and Critical Non-government Entities therewith" }, "automated_ai": { "code": "unknown_not_public", "detail": "ISR text not public. DESC's January 2026 release describes ASAAS 2.0 as an 'AI-powered auditing engine' for real-time assessments and automated gap analysis. That is compliance auditing, not security testing.", "cite": "ISR text available only by email request to DESC; DESC news 27/01/2026 (Multaqa ISR Officers)", "url": "https://www.desc.gov.ae/dubai-electronic-security-center-hosts-multaqa-isr-officers-to-advance-isr-excellence/", "confidence": "unverified" } } }, { "id": "ae-cma-vasp-regulation-2026", "jurisdiction": "United Arab Emirates", "region": "GCC", "sector": "financial", "name": "The Regulation Concerning Virtual Assets Service Providers and the Alternative Trading System Operator (Chairman's Resolution No. (04/Chairman) of 2026)", "short": "CMA VASP and ATS Regulation 2026", "issuer": "Capital Market Authority (CMA), formerly the Securities and Commodities Authority (SCA)", "version": "2026-02-13", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://legislation.uaecma.gov.ae/en/article-51-protection-ict-assets-cybersecurity-incidents", "arabic_title": "التنظيم الخاص بمزودي خدمات الأصول الافتراضية ومشغل نظام التداول البديل", "regulator_arabic": "هيئة سوق المال", "arabic_source_url": "https://legislation.uaecma.gov.ae/ar/%D8%A7%D9%84%D9%85%D8%A7%D8%AF%D8%A9-51-%D8%AD%D9%85%D8%A7%D9%8A%D8%A9-%D8%A3%D8%B5%D9%88%D9%84-%D8%AA%D9%83%D9%86%D9%88%D9%84%D9%88%D8%AC%D9%8A%D8%A7-%D8%A7%D9%84%D9%85%D8%B9%D9%84%D9%88%D9%85%D8%A7%D8%AA-%D9%88%D8%A7%D9%84%D8%A7%D8%AA%D8%B5%D8%A7%D9%84%D8%A7%D8%AA-ict-%D9%85%D9%86-%D8%A7%D9%84%D8%AD%D9%88%D8%A7%D8%AF%D8%AB-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A%D8%A9", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Issued February 13, 2026, in force February 28, 2026 (Official Gazette February 27, 2026). A binding rule that makes CMA-licensed virtual asset service providers and alternative trading system operators run a comprehensive resilience testing program, at least yearly for internet-connected systems, and fix adverse results. It is the first CMA text found with a security testing duty; the September coding did not review SCA or CMA rules. Full English text of the General Module: https://legislation.uaecma.gov.ae/sites/default/files/en_net_file_store/CMA_EN_1630_VER1.pdf; ATS Module: https://legislation.uaecma.gov.ae/sites/default/files/en_net_file_store/CMA_EN_1632_VER1.pdf. The CMA says the Arabic text prevails. On its Arabic pages the CMA spells its name \"هيئة سوق المال\" in the CMA Law, page titles and footer, and \"هيئة سوق رأس المال\" in logo text; the former is used here.", "cells": { "legal_force": { "code": "mandatory", "detail": "A Chairman's resolution of the Capital Market Authority, in force since February 28, 2026, using \"shall\". The CMA notes that the Arabic text prevails.", "cite": "General Module Art. 51(16)(a); Resolution No. (04/Chairman)/2026, issued 13/2/2026, effective 28/2/2026", "url": "https://legislation.uaecma.gov.ae/en/article-51-protection-ict-assets-cybersecurity-incidents", "quote": "The licensed entity shall ensure: a. The existence of a comprehensive resilience testing program for its IT systems and networks, as well as testing of processes and controls implemented to comply with the provisions of this Article.", "confidence": "verified" }, "scope": { "code": "CMA-licensed virtual asset service providers and alternative trading system operators", "detail": "The General Module covers anyone conducting VASP activities in or from the UAE. The ATS Module applies the same cyber chapter to operators of alternative trading systems (ATS Module Art. 26(7)). The head office must be within the State's boundaries under the CMA's jurisdiction (General Module Art. 65(1)). The text does not mention the DIFC or ADGM.", "cite": "General Module Art. 2(1); ATS Module Art. 2(1), Art. 26(7)", "url": "https://legislation.uaecma.gov.ae/en/article-51-protection-ict-assets-cybersecurity-incidents", "quote": "The provisions of this module apply to any person who conducts or wishes to conduct any Virtual Asset Service Provider (VASP) activities in accordance with Article (12) of this module in or from within the State.", "confidence": "verified" }, "frequency": { "code": "annual (internet-connected systems)", "detail": "The resilience test program must run regularly, and at least once a year for internet-connected systems. The wording follows DFSA GEN 5.5.15 and FSRA GEN 3.5.14.", "cite": "General Module Art. 51(16)(b)", "url": "https://legislation.uaecma.gov.ae/en/article-51-protection-ict-assets-cybersecurity-incidents", "quote": "Conducting regular tests for the comprehensive program, at least once annually for internet-connected systems.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "The risk assessment must identify threats (Art. 50(3)(a)), but nothing ties threat intelligence to test design.", "cite": "No provision linking threat intelligence to testing; General Module and ATS Module reviewed (searched: threat intelligence, intelligence, scenario, red team)", "url": "https://legislation.uaecma.gov.ae/en/article-51-protection-ict-assets-cybersecurity-incidents", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "No rule on who tests. Operators of an ATS for tokenized securities and tokenized commodity contracts (ATS Module Art. 59) and of a multilateral trading facility for virtual assets (Art. 73) must appoint an independent, qualified external auditor for an annual technology audit. That is an audit, not a security test.", "cite": "No provision; General Module and ATS Module reviewed (searched: independent, qualified, certified, accredited, penetration)", "url": "https://legislation.uaecma.gov.ae/en/article-51-protection-ict-assets-cybersecurity-incidents", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Silent on internal versus external testers.", "cite": "No provision; General Module and ATS Module reviewed (searched: internal, in-house, external, independent)", "url": "https://legislation.uaecma.gov.ae/en/article-51-protection-ict-assets-cybersecurity-incidents", "confidence": "verified" }, "social_engineering": { "code": "controls_test", "detail": "The test program must cover the controls in Art. 51, which include staff cybersecurity training and awareness (51(15)). No social engineering or phishing method is named.", "cite": "General Module Art. 51(15); Art. 51(16)(a)", "url": "https://legislation.uaecma.gov.ae/en/article-51-protection-ict-assets-cybersecurity-incidents", "quote": "The licensed entity shall provide training programs for all relevant employees in cybersecurity, along with sufficient awareness measures", "confidence": "verified" }, "physical": { "code": "controls_test", "detail": "The test program must cover the Art. 51 controls, which include restricting physical access to data centers and server rooms (51(13) and (14)). The method is not specified.", "cite": "General Module Art. 51(13); Art. 51(14); Art. 51(16)(a)", "url": "https://legislation.uaecma.gov.ae/en/article-51-protection-ict-assets-cybersecurity-incidents", "quote": "The licensed entity shall restrict physical access to data centers and server rooms, if any, to persons with a legitimate business need", "confidence": "verified" }, "third_party": { "code": "assurance_only", "detail": "Contracts with third parties must require compliance with the firm's cyber requirements, incident notification and cooperation, and must let the firm verify continued compliance. Testing is not named as the method.", "cite": "General Module Art. 48(1)(b) and (c)", "url": "https://legislation.uaecma.gov.ae/en/article-51-protection-ict-assets-cybersecurity-incidents", "quote": "Allowing the licensed entity to verify that the third party continues to comply with its cybersecurity requirements.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No mention of operational technology.", "cite": "No provision; General Module and ATS Module reviewed (searched: operational technology, industrial, SCADA)", "url": "https://legislation.uaecma.gov.ae/en/article-51-protection-ict-assets-cybersecurity-incidents", "confidence": "verified" }, "payment_systems": { "code": "required", "detail": "ATS operators run market infrastructure. Art. 26(7) applies the cyber chapter to them, so their trading systems fall inside the annual resilience test program of General Module Art. 51(16). Trading systems must also be tested before going live and after updates, and members' systems must pass conformance tests (Art. 26(4); Annex (1) Art. 2 and 3). Those are functional and stress tests.", "cite": "ATS Module Art. 26(7); General Module Art. 51(16); ATS Module Art. 26(4), Annex (1) Art. 2 and 3; https://legislation.uaecma.gov.ae/en/article-26-technological-resources-and-cyber-risk-management", "url": "https://legislation.uaecma.gov.ae/en/article-51-protection-ict-assets-cybersecurity-incidents", "quote": "The licensed entity shall meet the applicable requirements regarding cyber risk management, in accordance with Chapter Three of Part Three of the General Framework Module.", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "No mention of cloud or SaaS.", "cite": "No provision; General Module and ATS Module reviewed (searched: cloud, SaaS, software as a service)", "url": "https://legislation.uaecma.gov.ae/en/article-51-protection-ict-assets-cybersecurity-incidents", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "References to outside the State concern fitness and propriety and AML equivalence, not testing.", "cite": "No provision on testing; General Module and ATS Module reviewed (searched: outside the State, cross-border, foreign, jurisdiction)", "url": "https://legislation.uaecma.gov.ae/en/article-51-protection-ict-assets-cybersecurity-incidents", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming or replay.", "cite": "No provision; General Module and ATS Module reviewed (searched: purple, replay, blue team)", "url": "https://legislation.uaecma.gov.ae/en/article-51-protection-ict-assets-cybersecurity-incidents", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Firms must have procedures to prioritize and address adverse test results. No deadline and no retest rule.", "cite": "General Module Art. 51(16)(c)", "url": "https://legislation.uaecma.gov.ae/en/article-51-protection-ict-assets-cybersecurity-incidents", "quote": "Having procedures to prioritize and address negative test results.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "The CMA supervises and inspects licensed entities and receives material cyber incident reports within 72 hours (Art. 53). It also receives the annual technology audit report from operators of a tokenized securities ATS or a virtual asset MTF (ATS Module Art. 59(2) and Art. 73(2)). Test results are not filed with it.", "cite": "General Module Art. 67(1); Art. 53(1); ATS Module Art. 59(2); Art. 73(2)", "url": "https://legislation.uaecma.gov.ae/en/article-51-protection-ict-assets-cybersecurity-incidents", "quote": "The Authority shall supervise and inspect the licensed entity to verify compliance with the Authority’s legislation and any other applicable related laws", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "No mention of AI, automated or continuous security testing. ATS members must test trading algorithms in a simulated environment (ATS Module Annex (1) Art. 3), which is algorithm testing, not security testing.", "cite": "No provision; General Module and ATS Module reviewed (searched: artificial intelligence, machine learning, AI, automated, continuous)", "url": "https://legislation.uaecma.gov.ae/en/article-51-protection-ict-assets-cybersecurity-incidents", "confidence": "verified" } } }, { "id": "ae-cbuae-retail-payment-systems", "jurisdiction": "United Arab Emirates", "region": "GCC", "sector": "financial", "name": "Retail Payment Systems Regulation (C 10/2020), Article (8): Ongoing Requirements of Designated Retail Payment Systems", "short": "CBUAE Retail Payment Systems Reg", "issuer": "Central Bank of the UAE (CBUAE)", "version": "2021-02-10", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://rulebook.centralbank.ae/en/entiresection/1509", "arabic_title": "نظام نظم الدفع للتجزئة", "regulator_arabic": "مصرف الإمارات العربية المتحدة المركزي", "arabic_source_url": "https://rulebook.centralbank.ae/ar/entiresection/1509", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Missed by the September coding. A binding CBUAE rule for payment market infrastructure: designated, systemically important retail payment systems must get periodic security reviews, by the operator or an independent party at the operator's or the CBUAE's discretion, and should test their operation networks regularly. The published date is the effective date (10/2/2021); the issue date is not shown on the Rulebook page. The Large Value Payment Systems Regulation (C 9/2020) was checked and has no security testing provision.", "cells": { "legal_force": { "code": "mandatory", "detail": "A CBUAE regulation. Breach of the ongoing requirements exposes the operator to sanctions under the Central Bank Law. The security review uses \"must\"; the network testing sentence uses \"should\".", "cite": "Art. 8 (Detailed requirements, Principal requirements)", "url": "https://rulebook.centralbank.ae/en/entiresection/1509", "quote": "Upon designation, a designated RPS is required to comply with the ongoing requirements imposed under this Regulation and the relevant provisions of PFMI (see Article (9) for detail).", "confidence": "verified" }, "scope": { "code": "designated, systemically important retail payment systems", "detail": "System operators and settlement institutions of retail payment systems the CBUAE designates as systemically important. The regulation does not apply in Financial Free Zones unless it says so.", "cite": "Introduction, Objective and Scope of Application", "url": "https://rulebook.centralbank.ae/en/entiresection/1509", "quote": "The scope of this Regulation will cover the systematically important RPS which meet one of the following conditions: (a) the concerned system is operated in the State;", "confidence": "verified" }, "frequency": { "code": "periodic, interval not set", "detail": "Security reviews must be periodic and networks tested regularly; no interval is set. A separate compliance self-assessment against the regulation and the PFMI is due at least every 24 months.", "cite": "Art. 8 (Safety)", "url": "https://rulebook.centralbank.ae/en/entiresection/1509", "quote": "The SO and/or SI of the designated RPS must conduct periodic security reviews of its system.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Operators must keep pace with the trends of cyber attacks, but nothing ties threat intelligence to tests.", "cite": "No provision linking threat intelligence to testing; Art. 8 and 9 reviewed (searched: intelligence, threat, scenario)", "url": "https://rulebook.centralbank.ae/en/entiresection/1509", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "No qualification or accreditation rule for reviewers. An independent party is an option at the operator's or the CBUAE's discretion (see internal_testers).", "cite": "No provision; full text reviewed (searched: independent, qualified, certified, accredited)", "url": "https://rulebook.centralbank.ae/en/entiresection/1509", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "The operator may run its own security reviews; the operator or the CBUAE may decide that an independent party does them.", "cite": "Art. 8 (Safety)", "url": "https://rulebook.centralbank.ae/en/entiresection/1509", "quote": "Such reviews could be performed either by the SO and/or SI of the designated RPS or, at its (or the Central Bank’s) discretion, by an independent party appointed by it.", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "Fraud awareness education for participants is required, not testing.", "cite": "No provision; full text reviewed (searched: social engineering, phishing)", "url": "https://rulebook.centralbank.ae/en/entiresection/1509", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "No physical testing.", "cite": "No provision; full text reviewed (searched: physical, premises)", "url": "https://rulebook.centralbank.ae/en/entiresection/1509", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "Outsourcing needs due diligence and oversight and must be notified to the CBUAE. Nothing on testing or auditing providers.", "cite": "No provision on testing third parties; full text reviewed (searched: third part, vendor, outsourc)", "url": "https://rulebook.centralbank.ae/en/entiresection/1509", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No mention of operational technology.", "cite": "No provision; full text reviewed (searched: operational technology, industrial)", "url": "https://rulebook.centralbank.ae/en/entiresection/1509", "confidence": "verified" }, "payment_systems": { "code": "required", "detail": "The regime governs payment market infrastructure. The payment system itself must get periodic security reviews. Its operation networks should also be regularly monitored and tested.", "cite": "Art. 8 (Safety)", "url": "https://rulebook.centralbank.ae/en/entiresection/1509", "quote": "The SO and/or SI of the designated RPS must conduct periodic security reviews of its system.", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "No mention of cloud.", "cite": "No provision; full text reviewed (searched: cloud, SaaS)", "url": "https://rulebook.centralbank.ae/en/entiresection/1509", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "Cross-border appears only for transactions.", "cite": "No provision on testing; full text reviewed (searched: cross-border, foreign, outside the State)", "url": "https://rulebook.centralbank.ae/en/entiresection/1509", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming or replay.", "cite": "No provision; full text reviewed (searched: purple, replay)", "url": "https://rulebook.centralbank.ae/en/entiresection/1509", "confidence": "verified" }, "remediation_retest": { "code": "not_addressed", "detail": "Post-incident assessments look for weaknesses after incidents; nothing on fixing review or test findings.", "cite": "No provision on test findings; full text reviewed (searched: remediat, retest, findings)", "url": "https://rulebook.centralbank.ae/en/entiresection/1509", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "The CBUAE may examine books and records, demand auditor reports and direct corrective action (Art. 8, 4.4 to 4.7). It may also decide that an independent party performs the security review.", "cite": "Art. 8, 4.5; Art. 8 (Safety)", "url": "https://rulebook.centralbank.ae/en/entiresection/1509", "quote": "The Central Bank may require the SO and/or SI of, or the Participant Person in, a designated RPS to submit to the Central Bank a report prepared by one or more auditors on matters that the Central Bank requires", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "No mention of automated or AI testing.", "cite": "No provision; full text reviewed (searched: artificial, automat)", "url": "https://rulebook.centralbank.ae/en/entiresection/1509", "confidence": "verified" } } }, { "id": "ae-cbuae-e-insurance-regulation", "jurisdiction": "United Arab Emirates", "region": "GCC", "sector": "financial", "name": "Insurance Authority Board of Directors' Resolution No. (18) of 2020 Concerning the Electronic Insurance Regulations", "short": "CBUAE Electronic Insurance Regs", "issuer": "Central Bank of the UAE (CBUAE); issued by the former Insurance Authority", "version": "2020-04-28", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://rulebook.centralbank.ae/en/entiresection/1002", "arabic_title": "قرار مجلس إدارة هيئة التأمين رقم (18) لسنة 2020 في شأن نظام التأمين الإلكتروني", "regulator_arabic": "مصرف الإمارات العربية المتحدة المركزي", "arabic_source_url": "https://rulebook.centralbank.ae/ar/entiresection/1002", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Missed by the September coding, which reviewed no insurance-specific rules. A binding rule (IA-BOD-RES 18/2020, effective 28/4/2020, In-Force) that requires insurers and insurance intermediaries selling online to test their websites and apps regularly for illegal access and vulnerabilities and fill the gaps. Its definition of Website includes AI and machine-learning systems and chatbots. The published date is the effective date. The CBUAE Operational Risk Management Regulation (C 1/2026) also applies to insurers that are juridical persons.", "cells": { "legal_force": { "code": "mandatory", "detail": "A board resolution of the former Insurance Authority, now in the CBUAE Rulebook as in force. Violations can lead to warnings, suspension of the electronic system for up to six months, or cancellation of approval (Art. 24).", "cite": "Art. 24; Art. 7", "url": "https://rulebook.centralbank.ae/en/entiresection/1002", "quote": "If it was substantiated by evidence to the Authority and any other competent authorities, that the Company, Insurance Agent or Insurance Broker committed a violation, then the Authority may take one of the following actions and penalties:", "confidence": "verified" }, "scope": { "code": "insurers and insurance intermediaries operating online", "detail": "All electronic and smart insurance operations of licensed insurers, insurance-related professions, and banks marketing insurance, as applicable.", "cite": "Art. 2", "url": "https://rulebook.centralbank.ae/en/entiresection/1002", "quote": "These regulations shall apply to all electronic and smart insurance operations practiced by licensed Insurance Companies, Insurance-related Professions and marketing insurance policies through banks to the extent applicable to their nature.", "confidence": "verified" }, "frequency": { "code": "regular, interval not set", "detail": "Tests for illegal access and vulnerability assessments of the website or app must be regular; no interval is set.", "cite": "Art. 7", "url": "https://rulebook.centralbank.ae/en/entiresection/1002", "quote": "Companies and related professions shall regularly conduct tests for Illegal Access and assessing vulnerabilities for the website or smart application to guarantee the soundness of such and to fill any potential gaps (if any).", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Cyber risk must be analyzed in the action plan (Art. 3), but nothing ties threat intelligence to tests.", "cite": "No provision; full text reviewed (searched: intelligence, threat, scenario)", "url": "https://rulebook.centralbank.ae/en/entiresection/1002", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "No rule on who tests.", "cite": "No provision; full text reviewed (searched: independent, qualified, certified, accredited, external)", "url": "https://rulebook.centralbank.ae/en/entiresection/1002", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Silent on internal versus external testers.", "cite": "No provision; full text reviewed (searched: internal, in-house, independent)", "url": "https://rulebook.centralbank.ae/en/entiresection/1002", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "No social engineering testing.", "cite": "No provision; full text reviewed (searched: social engineering, phishing)", "url": "https://rulebook.centralbank.ae/en/entiresection/1002", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "No physical testing.", "cite": "No provision; full text reviewed (searched: physical, premises)", "url": "https://rulebook.centralbank.ae/en/entiresection/1002", "confidence": "verified" }, "third_party": { "code": "required", "detail": "With the Authority's prior approval, a company may assign the management of its website to another party, and it must regularly test the website or smart application for illegal access and vulnerabilities (Art. 7). The test duty therefore covers a website a provider runs. The outsourcing contract must bind the provider to the Regulation (Art. 13). The text does not say whether the company or the provider runs the test; R6 codes required either way.", "cite": "Art. 7; Art. 13", "url": "https://rulebook.centralbank.ae/en/entiresection/1002", "quote": "Companies and related professions shall regularly conduct tests for Illegal Access and assessing vulnerabilities for the website or smart application to guarantee the soundness of such and to fill any potential gaps (if any).", "confidence": "verified", "harmonized_from": "assurance_only", "harmonize_reason": "R6: Art. 7 lets the company assign the management of its website to another party and requires regular illegal-access and vulnerability tests of the website; the mandatory test therefore covers a supplier-run system, which R6 codes required whoever runs the test." }, "ot": { "code": "not_addressed", "detail": "No mention of operational technology.", "cite": "No provision; full text reviewed (searched: operational technology, industrial)", "url": "https://rulebook.centralbank.ae/en/entiresection/1002", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "Premium collection is an electronic insurance operation, but no payment system testing is set.", "cite": "No provision; full text reviewed (searched: payment, card, SWIFT)", "url": "https://rulebook.centralbank.ae/en/entiresection/1002", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "Art. 9(2) refers to storing data inside the State and in the cloud under competent-authority criteria. No cloud testing. The Art. 1 definition of Website lists social networks, blogs and collaboration tools, so the Art. 7 test duty may reach company channels hosted on them; the text does not say so directly.", "cite": "No provision on testing cloud; full text reviewed (searched: cloud, hosting, SaaS)", "url": "https://rulebook.centralbank.ae/en/entiresection/1002", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "Data must be stored inside the State (Art. 9(2)), a residency rule that does not mention testing.", "cite": "No provision on testing; full text reviewed (searched: outside the State, cross-border, foreign)", "url": "https://rulebook.centralbank.ae/en/entiresection/1002", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming or replay.", "cite": "No provision; full text reviewed (searched: purple, replay)", "url": "https://rulebook.centralbank.ae/en/entiresection/1002", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "The test duty includes filling any gaps found. No deadline and no retest rule.", "cite": "Art. 7", "url": "https://rulebook.centralbank.ae/en/entiresection/1002", "quote": "Companies and related professions shall regularly conduct tests for Illegal Access and assessing vulnerabilities for the website or smart application to guarantee the soundness of such and to fill any potential gaps (if any).", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "The Insurance Authority, whose functions the CBUAE now holds, runs periodic or challenge inspections and may request any information.", "cite": "Art. 23(1) and (2)", "url": "https://rulebook.centralbank.ae/en/entiresection/1002", "quote": "The Insurance Authority shall supervise and conduct periodical or challenge inspections in order to ensure compliance with the legislation issued by the Authority", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "The Art. 1 definition of Website includes AI and machine-learning systems and chatbots, so the Art. 7 duty to test the website for illegal access and vulnerabilities covers them.", "cite": "Art. 1 (definition of Website); Art. 7", "url": "https://rulebook.centralbank.ae/en/entiresection/1002", "quote": "Systems based on artificial intelligence and machine learning. Autoreply, chatbot and smart personal assistant.", "confidence": "verified" } } }, { "id": "uk-cbest", "jurisdiction": "United Kingdom", "region": "Benchmark", "sector": "financial", "name": "CBEST Threat Intelligence-Led Assessments", "short": "UK CBEST", "issuer": "Bank of England, Prudential Regulation Authority and Financial Conduct Authority", "version": "2024 edition. Web guide 'last updated 25 August 2026'; its text on 2026-10-30 matches the 2026-09-28 copy. Linked PDF (created February 23, 2024) is byte-identical.", "status": "In force as a supervisory tool as of 2026-09-28. Checked the Bank of England CBEST guide page (last updated August 25, 2026), the operational resilience page (last updated July 21, 2026) and the 2025 CBEST thematic (last updated January 20, 2026). No replacement or sunset found.", "public": "partial", "primary_url": "https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/cbest-threat-intelligence-led-assessments-implementation-guide", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No change. The operational resilience page still reads 'last updated 21 July 2026' and still lists the 2023 to 2025 CBEST thematics; no 2026 thematic is posted. STAR-FS guide PDF is byte-identical. Related, not a CBEST change: the Bank, FCA and HM Treasury joint statement on frontier AI (May 15, 2026) says it is 'not intended to introduce new expectations'. The Governor's letter to the Treasury Committee (July 9, 2026) says the Bank is working to bring AI scenarios into cyber and operational testing, and the July 2026 Financial Stability Report announces a Bank and PRA consultation on cyber and ICT risk management. Both are on the watch list." }, "notes": "The current web guide differs from the PDF at the same address. The web version names CREST CCRTM and CCRTS, adds the Cyber Scheme Red Team Manager (CSRTM) as an alternative to CCRTM, and adds a CBEST thematic analysis template (CBEST (2026l)). The PDF still names the older CCSAM and CCSAS. The Cyber Scheme says CSRTM enters the guide from September 1, 2026. The guide cites 11 supporting documents (CBEST (2024a) to (2024k)), including 'Supplementary Guidance on Outsourcing and Third-Party Scenarios in CBEST'; none is linked from the public page, so their content is unknown. The 2025 CBEST thematic (published January 2026) strongly encourages rotating providers between CBESTs and reports that the most frequent scenarios were third-party supplier compromise, social engineering and malicious insiders. STAR-FS (Simulated Targeted Attack and Response for the Finance Sector), introduced in 2024 by the PRA, FCA and CREST, is a current lighter, firm-led alternative for non-systemic firms. Self-initiated STAR-FS tests can count as supervisory assessments if regulators are notified, can input to scope and receive the remediation plan (STAR-FS Implementation Guide § 4.2.1). The UK is outside DORA; CBEST has no statutory basis of its own.", "cells": { "legal_force": { "code": "supervisory_expectation", "detail": "CBEST is a supervisory assessment tool of the PRA, FCA and the Bank's FMI Directorate. No statute or rule mandates it; firms undertake it when the regulator requests it, and the guide itself says it is for information purposes only.", "cite": "CBEST Implementation Guide (2024 ed., web version updated August 25, 2026) § 3.1; § 2.2 (legal disclaimer)", "url": "https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/cbest-threat-intelligence-led-assessments-implementation-guide", "quote": "The firm/FMI is requested by the regulator to undertake a CBEST assessment as part of the supervisory cycle. The list of those requested to undertake a review is agreed by the PRA and FCA on a regular basis in line with any thematic focus and the supervisory strategy.", "confidence": "verified" }, "scope": { "code": "systemically important firms and FMIs selected by regulators", "detail": "Participants are firms and financial market infrastructures (FMIs) regulated by the PRA, FCA or the Bank of England. The regulators choose participants; a firm may also ask to run one with regulator agreement, or be asked after an incident.", "cite": "CBEST Implementation Guide § 1 (Purpose); § 3.1; Foreword", "url": "https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/cbest-threat-intelligence-led-assessments-implementation-guide", "quote": "This CBEST Implementation Guide has been developed by the Prudential Regulation Authority (PRA) for the benefit of CBEST participants which are firms and financial market infrastructures (FMIs).", "confidence": "verified" }, "frequency": { "code": "at regulator request", "detail": "No fixed cycle. The PRA and FCA agree the list of firms to be tested on a regular basis, in line with the supervisory strategy. Indicative project length is 9 to 12 months.", "cite": "CBEST Implementation Guide § 3.1; § 4.1 (indicative timeline)", "url": "https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/cbest-threat-intelligence-led-assessments-implementation-guide", "quote": "The regulators find that the average CBEST project duration is around 9 to 12 months.", "confidence": "verified" }, "threat_intel": { "code": "required", "detail": "An external, Bank of England accredited threat intelligence service provider (TISP) must produce a Targeting Report and Threat Intelligence Report; scenarios must map to important business services. Testing must be based on current and credible threat intelligence.", "cite": "CBEST Implementation Guide Annex A (TI phase); § 3.2.3; § 7.2", "url": "https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/cbest-threat-intelligence-led-assessments-implementation-guide", "quote": "CBEST testing is based on current and credible threat intelligence, provided by an external accredited provider.", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Both the TISP and the penetration testing service provider (PTSP) must be accredited by the Bank of England and be CREST members. They must employ certified individuals: CREST CCTIM for threat intelligence; CREST CCRTM or, from 2026, Cyber Scheme CSRTM, plus CREST CCRTS for testing.", "cite": "CBEST Implementation Guide § 6.4.1; § 6.4.2; Annex A (Initiation phase)", "url": "https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/cbest-threat-intelligence-led-assessments-implementation-guide", "quote": "Service providers must be accredited in order to conduct the threat intelligence, penetration testing and reporting elements of the CBEST. Accredited service providers must also be members of the cyber security membership body CREST", "confidence": "verified" }, "internal_testers": { "code": "not_allowed", "detail": "The guide defines both providers as independent companies hired by the firm and requires Bank of England accreditation of the third-party providers as a minimum criterion. It makes no provision for in-house red teams. The 2025 thematic also strongly encourages rotating providers between CBESTs.", "cite": "CBEST Implementation Guide § 3.2.3; § 3.2.4; Annex A (Initiation phase)", "url": "https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/cbest-threat-intelligence-led-assessments-implementation-guide", "quote": "PTSP is an independent company, hired by the firm/FMI to plan and execute the penetration testing activity based on the threat scenarios identified during the TI phase. The PTSP must be CBEST accredited", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "CBEST mimics attackers compromising important business services and disrupting the technology, people and processes behind them (§ 2). Its scope covers people (Annex A) and the threat intelligence Targeting Report maps the attack surfaces of people. The guide does not use the words social engineering or phishing. The regulators' 2025 CBEST thematic reports social engineering among the most frequent scenarios, which shows practice but does not set the code.", "cite": "CBEST Implementation Guide § 2 (Introduction); Annex A (Initiation phase); 2025 CBEST thematic considered", "url": "https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/cbest-threat-intelligence-led-assessments-implementation-guide", "quote": "CBEST promotes an intelligence-led penetration testing approach that mimics the actions of cyber attackers’ intent on compromising an organisation’s important business services (IBSs) and disrupting the technology assets, people and processes supporting those services.", "confidence": "verified" }, "physical": { "code": "excluded", "detail": "The guide names physical attacks, with DDoS, as scenarios that may be beyond the scope of a CBEST penetration test and tells firms to explore them outside CBEST. The wording is 'may be', not an absolute ban, but it is the only statement on physical testing.", "cite": "CBEST Implementation Guide § 7.2.3 ('Scenarios beyond the scope of CBEST assessment')", "url": "https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/cbest-threat-intelligence-led-assessments-implementation-guide", "quote": "Some of the threat scenarios presented in a Threat Intelligence Report may be beyond the scope of a CBEST’s Penetration Test for example, Distributed Denial of Service and physical attacks.", "confidence": "verified" }, "third_party": { "code": "permitted", "detail": "Malicious insider and supply chain scenarios should always be analysed and discussed. Third parties that run outsourced systems behind important business services may join the Control Group and be brought into the test. Detailed rules sit in a separate 'Supplementary Guidance on Outsourcing and Third-Party Scenarios in CBEST' that is not publicly linked.", "cite": "CBEST Implementation Guide § 7.2.3 ('Malicious Insider and Supply Chain Scenarios'); § 3.2.2; § 6.3(ii); reference CBEST (2024k)", "url": "https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/cbest-threat-intelligence-led-assessments-implementation-guide", "quote": "Malicious Insider and Supply Chain Scenarios are a feature of the threat landscape. These scenarios should always be analysed and discussed during CBEST.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "The guide and the 2025 thematic do not mention operational technology or industrial control systems.", "cite": "No provision; full text reviewed (searched: operational technology, OT, ICS, SCADA, industrial)", "url": "https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/cbest-threat-intelligence-led-assessments-implementation-guide", "confidence": "verified" }, "payment_systems": { "code": "permitted", "detail": "FMIs, which the Bank of England supervises through its FMI Directorate, are named CBEST participants alongside firms. The guide does not name specific payment systems, SWIFT or card schemes.", "cite": "CBEST Implementation Guide § 1 (Purpose); § 2 (Introduction)", "url": "https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/cbest-threat-intelligence-led-assessments-implementation-guide", "quote": "the Bank of England (BoE) has implemented the CBEST security assessment framework, which the PRA, the Financial Market Infrastructure Directorate (FMID) of the Bank of England and Financial Conduct Authority (FCA) have within their supervisory strategies.", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "The guide does not mention cloud or SaaS. Outsourced systems are handled under the general third-party wording. The 2025 thematic foreword notes the sector's reliance on cloud services but sets no testing scope.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, software as a service, hosting)", "url": "https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/cbest-threat-intelligence-led-assessments-implementation-guide", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "With UK regulator agreement a firm can run CBEST as a cross-jurisdictional assessment with other authorities, including where an underlying service provider sits abroad. Authorities using other TLPT frameworks must agree the approach in advance, and the test must still meet CBEST minimum criteria.", "cite": "CBEST Implementation Guide § 6.1 ('Cross-jurisdictional assessment'); § 3.2.1", "url": "https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/cbest-threat-intelligence-led-assessments-implementation-guide", "quote": "In agreement with the UK regulators, the firm/FMI could run CBEST as a cross-jurisdictional assessment. In this case, other relevant regulatory authorities, (as identified by the firm/FMI) can be involved in the engagement if they agree to participate.", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No replay or purple teaming step. The closest steps are a Review workshop (regulator, Control Group, providers) on the draft report, post-test interviews with the SOC for the Detection and Response assessment, and a Debrief.", "cite": "No provision; full text reviewed (searched: purple, replay, blue team)", "url": "https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/cbest-threat-intelligence-led-assessments-implementation-guide", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "The firm must produce a Remediation Plan on the regulator's template, agreed with the regulator. The regulator then tracks delivery, typically over 6 to 12 months or longer, and the firm confirms when actions close. No formal retest is set.", "cite": "CBEST Implementation Guide § 9.1; § 9.3; Annex A (All phases)", "url": "https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/cbest-threat-intelligence-led-assessments-implementation-guide", "quote": "Supervision activity involves ongoing tracking and review by the regulator of the firm/FMI’s planned remediation activities. The timescales can be anything from six to 12 months, or longer, depending on the nature of the Remediation Plan.", "confidence": "verified" }, "regulator_role": { "code": "leads_or_oversees_test", "detail": "CBEST is regulator-led. The regulator notifies the firm, identifies the important business services in scope, runs the Validation and Review workshops, receives the reports and supervises remediation.", "cite": "CBEST Implementation Guide § 3.2.1; § 6.1; § 7.3; § 9.3", "url": "https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/cbest-threat-intelligence-led-assessments-implementation-guide", "quote": "CBEST is a regulator-led assessment; regulators provide guidance and oversight throughout the assessment, verifying the exercise runs in accordance with the CBEST assessment framework.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Passing mention only: the guide says a penetration test uses manual and automated techniques. It says nothing on continuous testing, AI-driven testing or testing of AI systems. The 2025 thematic notes attackers' use of AI-driven automation but sets no testing rule.", "cite": "CBEST Implementation Guide § 8 (Penetration Testing phase, introduction)", "url": "https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/cbest-threat-intelligence-led-assessments-implementation-guide", "quote": "A Penetration Test involves the use of a variety of manual and automated techniques to simulate an attack on an organisation’s IBSs.", "confidence": "verified" } } }, { "id": "eu-tiber-eu", "jurisdiction": "European Union", "region": "Benchmark", "sector": "cross-sector", "name": "TIBER-EU: European framework for Threat Intelligence-based Ethical Red Teaming", "short": "EU TIBER-EU", "issuer": "European Central Bank and Eurosystem national central banks (approved by the ECB Governing Council)", "version": "TIBER-EU Framework, January 2025, with the January 2025 guidance documents. Framework, purple teaming and provider procurement PDFs are byte-identical to the 2026-09-28 copies.", "status": "Current as of 2026-09-28. The ECB TIBER-EU page still links the January 2025 framework and guidance; no later edition found. First published May 2018.", "public": "full", "primary_url": "https://www.ecb.europa.eu/paym/cyber-resilience/tiber-eu/html/index.en.html", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No change to the framework. The ECB page now carries the date October 29, 2026 and adds Estonia to the list of adopting jurisdictions, with a link to the TIBER-EE national implementation guide (file dated 2026-09). National guides are not coded, as in September. The TIBER-EU SSM implementation guide (November 2025) is byte-identical." }, "notes": "The 2025 update aligned TIBER-EU with the DORA TLPT RTS: DORA deadlines added, purple teaming made mandatory, 'White Team' renamed 'Control Team', and authorities may publish a short implementation document instead of a full national guide (ECB news, February 11, 2025). A test run under a TIBER-EU implementation counts as DORA TLPT if the formal DORA requirements are met (Framework ch. 1). The ECB page lists adoption in 20 jurisdictions (Austria, Belgium, Czech Republic, Denmark, Finland, France, Germany, Iceland, Ireland, Italy, Liechtenstein, Luxembourg, Malta, the Netherlands, Norway, Portugal, Romania, Slovakia, Spain, Sweden) plus the ECB and ECB Banking Supervision. In November 2025 the ECB published the TIBER-EU SSM Implementation Guide, under which the ECB acts as TLPT authority for significant institutions; it states that only DORA and the RTS are legally binding and take precedence over TIBER-EU. The framework is designed for finance but can be used in other critical sectors, which is why sector is coded cross-sector. The public framework PDF carries an 'ECB-RESTRICTED' header.", "cells": { "legal_force": { "code": "mixed", "detail": "TIBER-EU is a Eurosystem framework, not law. Adoption by an authority is voluntary and each adopting jurisdiction decides whether tests are voluntary or mandatory. When used to perform DORA TLPT, the DORA and RTS requirements are binding and take precedence.", "cite": "TIBER-EU Framework (Jan 2025), ch. 2 'Implementation of the TIBER-EU framework' (PDF p. 8); Annex 10.2 Table 1", "url": "https://www.ecb.europa.eu/pub/pdf/other/ecb.tiber_eu_framework_2025~b32eff9a10.en.pdf", "quote": "The adoption of the TIBER-EU framework by authorities and jurisdictions is voluntary, although the framework may be used to provide additional operational guidance on how to comply with legal obligations stemming from applicable legislation.", "confidence": "verified" }, "scope": { "code": "entities chosen by adopting authorities", "detail": "Entities include credit, payment and e-money institutions, payment systems, CSDs, CCPs, trading venues, insurers and other providers chosen for systemic importance and ICT risk profile. The ECB page says it can be used in all critical sectors. Adopted in 20 listed jurisdictions plus the ECB and ECB Banking Supervision as of the retrieved page.", "cite": "TIBER-EU Framework ch. 2 'Background and purpose' (PDF p. 7); ECB TIBER-EU web page", "url": "https://www.ecb.europa.eu/pub/pdf/other/ecb.tiber_eu_framework_2025~b32eff9a10.en.pdf", "quote": "credit institutions, payment institutions, electronic money institutions, payment systems, central securities depositories, central counterparties, trading venues, insurance and reinsurance undertakings, settlement platforms, and any other service providers and financial entities identified based on their systemic importance and ICT risk profile.", "confidence": "verified" }, "frequency": { "code": "every 3 years (norm)", "detail": "The framework states a three-year interval as the norm, not as a rule. Where TIBER-EU is used for DORA TLPT, the DORA 3-year minimum applies.", "cite": "TIBER-EU Framework § 2.1.1 (PDF p. 8)", "url": "https://www.ecb.europa.eu/pub/pdf/other/ecb.tiber_eu_framework_2025~b32eff9a10.en.pdf", "quote": "Because of the resources required and costs incurred, entities are not expected to conduct a TIBER-EU test too frequently – with 3 years intervals being the norm.", "confidence": "verified" }, "threat_intel": { "code": "required", "detail": "Mandatory: an external threat intelligence provider (TIP) produces a Targeted Threat Intelligence report with multiple scenarios, which the red team turns into its test plan. A national Generic Threat Landscape report is optional but highly recommended.", "cite": "TIBER-EU Framework Annex 10.2 Table 3 (mandatory items); § 5.2", "url": "https://www.ecb.europa.eu/pub/pdf/other/ecb.tiber_eu_framework_2025~b32eff9a10.en.pdf", "quote": "For each test, an external TIP produces a dedicated Targeted Threat Intelligence report (TTI report) on the entity being tested.", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Providers must be free of conflicts and meet the minimums in the Guidance for Service Provider Procurement: TI manager with 5 years' experience plus a member with 2; red team manager with 5 years plus two testers with 2; 3 (TI) and 5 (red team) references; certifications to recognised market standards; professional indemnity insurance; TI and red team staff separated. Accreditation by a recognised body is advised where feasible, not required.", "cite": "TIBER-EU Framework § 4.1.3; Annex 10.2 Table 2; TIBER-EU Guidance for Service Provider Procurement (Jan 2025) § 2.1 Table 1, § 2.2 Table 2", "url": "https://www.ecb.europa.eu/pub/pdf/other/ecb.tiber_eu_framework_2025~b32eff9a10.en.pdf", "quote": "the entity must ensure that the TIP and RTT are free from conflict of interest and meet the minimum requirements evidenced by the relevant documentation and certifications. The minimum requirements are set out in the GSPP.", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "The TIP must always be external. Internal red team testers are allowed only in exceptional cases with prior approval of the test manager, must meet the same standards as external testers, and testers of an intra-group ICT provider count as internal. Significant credit institutions under DORA cannot use internal testers.", "cite": "TIBER-EU Framework ch. 3 'The TIBER-EU Service Providers' and footnote 11 (PDF p. 16); § 3.6.3; Annex 10.2 Table 1", "url": "https://www.ecb.europa.eu/pub/pdf/other/ecb.tiber_eu_framework_2025~b32eff9a10.en.pdf", "quote": "In exceptional circumstances, and only after the prior approval by the TM, internal RTT may be used for a TIBER-EU test 11. In such cases, internal testers need to adhere to the same standards and requirements as external RTT.", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "Social engineering is part of the kill chain the red team is expected to run (delivery and exploitation stages), and red team members must have social engineering skills. The red team test plan sets the ethical boundaries for social engineering. It is not a mandatory scenario element.", "cite": "TIBER-EU Framework § 8.2.1 (PDF p. 44); § 8.3; GSPP § 2.2 Table 2", "url": "https://www.ecb.europa.eu/pub/pdf/other/ecb.tiber_eu_framework_2025~b32eff9a10.en.pdf", "quote": "Exploitation – During exploitation, the RTT’s goal is to “break in”, i.e. to compromise servers/apps/networks and exploit target staff through social engineering.", "confidence": "verified" }, "physical": { "code": "permitted", "detail": "Physical red teaming is an optional requirement that each jurisdiction may allow in its implementation, for example planting a device, with precautions such as formal consent by the entity. Red team members must have physical penetration skills.", "cite": "TIBER-EU Framework Annex 10.2 Table 3 (marked Optional); § 8.3 (PDF p. 46)", "url": "https://www.ecb.europa.eu/pub/pdf/other/ecb.tiber_eu_framework_2025~b32eff9a10.en.pdf", "quote": "The jurisdiction, in its implementation of the TIBER framework, allows physical red teaming in the scope of the methodology for the TIBER test (e.g. planting a device at the entity), provided all necessary precautions are taken.", "confidence": "verified" }, "third_party": { "code": "permitted", "detail": "Scope normally includes outsourced systems, people and processes behind critical or important functions. Expanding scope to other third parties is optional. Multi-party tests with a shared ICT third-party provider are allowed, and at least one scenario should then cover that provider's systems.", "cite": "TIBER-EU Framework ch. 6 'Scoping' (PDF p. 30); § 3.7; ch. 7 'Scenario creation' (PDF p. 39); Annex 10.2 Table 2 (marked Optional)", "url": "https://www.ecb.europa.eu/pub/pdf/other/ecb.tiber_eu_framework_2025~b32eff9a10.en.pdf", "quote": "In most cases, this will also include the systems, people and business processes underpinning the entity’s CIFs that are outsourced to third-party service providers.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "The framework does not mention operational technology or industrial control systems.", "cite": "No provision; full text reviewed (searched: operational technology, OT, ICS, SCADA, industrial)", "url": "https://www.ecb.europa.eu/pub/pdf/other/ecb.tiber_eu_framework_2025~b32eff9a10.en.pdf", "confidence": "verified" }, "payment_systems": { "code": "permitted", "detail": "Payment systems, CSDs, CCPs, trading venues and settlement platforms are listed as entities the framework covers. Whether any of them must test depends on the adopting authority or on DORA.", "cite": "TIBER-EU Framework ch. 2 'Background and purpose' (PDF p. 7)", "url": "https://www.ecb.europa.eu/pub/pdf/other/ecb.tiber_eu_framework_2025~b32eff9a10.en.pdf", "quote": "credit institutions, payment institutions, electronic money institutions, payment systems, central securities depositories, central counterparties, trading venues", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "No mention of cloud or SaaS in the framework or the procurement and purple teaming guidance reviewed. Outsourced services fall under the general third-party wording.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, hosting)", "url": "https://www.ecb.europa.eu/pub/pdf/other/ecb.tiber_eu_framework_2025~b32eff9a10.en.pdf", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "Multi-jurisdictional tests run under a lead TIBER cyber team, with other teams as participants or observers. Tests meeting all mandatory requirements get an attestation for mutual recognition. Critical infrastructure in a jurisdiction without TIBER may still be included. The procurement guidance covers tests run with non-EU authorities.", "cite": "TIBER-EU Framework § 3.7.1; § 3.7.2; Annex 10.2 Table 1; GSPP § 3.1.4", "url": "https://www.ecb.europa.eu/pub/pdf/other/ecb.tiber_eu_framework_2025~b32eff9a10.en.pdf", "quote": "TIBER-EU provides an efficient solution to this problem by ensuring mutual recognition of TIBER tests, provided that these comply with all mandatory requirements of the TIBER-EU framework.", "confidence": "verified" }, "purple_replay": { "code": "required", "detail": "Since the 2025 update, purple teaming is mandatory. The red team, blue team and control team must hold a replay and a purple teaming exercise within 10 weeks after active testing ends. Limited purple teaming during active testing is a last resort that needs test manager approval.", "cite": "TIBER-EU Framework ch. 9, § 9.3 and 'Purple Teaming exercise' (PDF p. 53 to 54); Annex 10.2 Table 4; TIBER-EU Purple Teaming Guidance § 2", "url": "https://www.ecb.europa.eu/pub/pdf/other/ecb.tiber_eu_framework_2025~b32eff9a10.en.pdf", "quote": "The PT exercise must take place within ten weeks after the end of the active testing.", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "After replay, purple teaming and 360-degree feedback, the entity must produce a remediation plan, delivered to the test manager within eight weeks, covering shortcomings, measures, priority, root cause, owners and risks. No retest is required.", "cite": "TIBER-EU Framework ch. 9 'Remediation plan' (PDF p. 55); Annex 10.2 Table 4", "url": "https://www.ecb.europa.eu/pub/pdf/other/ecb.tiber_eu_framework_2025~b32eff9a10.en.pdf", "quote": "After the replay & Purple Teaming exercises, and the 360-degree feedback process step, the entity produces a remediation plan to address the findings (from both TTIR, RTTR).", "confidence": "verified" }, "regulator_role": { "code": "leads_or_oversees_test", "detail": "The authority's TIBER cyber team assigns a test manager and an alternate to each test, oversees it, approves key steps and issues the attestation. When used for DORA TLPT, the TLPT authority acts as the TIBER authority.", "cite": "TIBER-EU Framework ch. 1 (PDF p. 4); Annex 10.2 Tables 1, 2 and 4", "url": "https://www.ecb.europa.eu/pub/pdf/other/ecb.tiber_eu_framework_2025~b32eff9a10.en.pdf", "quote": "the TIBER authority(ies) 5, which is responsible for adopting and implementing TIBER-EU, closely monitoring and guiding the test and ensuring it is conducted in the right spirit and in accordance with the requirements of the TIBER-EU framework;", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "No mention of automated, continuous or AI-driven testing, or of testing AI systems, in the framework or the procurement and purple teaming guidance reviewed.", "cite": "No provision; full text reviewed (searched: automat, continuous testing, artificial intelligence, AI, machine learning)", "url": "https://www.ecb.europa.eu/pub/pdf/other/ecb.tiber_eu_framework_2025~b32eff9a10.en.pdf", "confidence": "verified" } } }, { "id": "eu-dora-tlpt", "jurisdiction": "European Union", "region": "Benchmark", "sector": "financial", "name": "Regulation (EU) 2022/2554 (Digital Operational Resilience Act) Articles 24 to 27, with Commission Delegated Regulation (EU) 2025/1190 (RTS on threat-led penetration testing)", "short": "EU DORA TLPT", "issuer": "European Parliament and Council (DORA); European Commission (RTS, drafted by EBA, EIOPA and ESMA in agreement with the ECB)", "version": "DORA consolidated version 02022R2554-20221227; RTS 02025R1190-20250618. Cellar XHTML of both acts is byte-identical to the 2026-09-28 copies. The RTS corrigendum 32025R1190R(01) still exists in German only.", "status": "In force as of 2026-09-28. EU Publications Office (Cellar) lists only the original consolidated versions (02022R2554-20221227 and 02025R1190-20250618), so no amendments to Arts. 24 to 27 or to the RTS were found. A corrigendum to the RTS (32025R1190R(01)) exists but has no English version.", "public": "full", "primary_url": "https://eur-lex.europa.eu/eli/reg_del/2025/1190/oj/eng", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No amending act, new consolidated version or English corrigendum found in the EU Publications Office (Cellar SPARQL, 2026-10-30). Related, not a TLPT change: the ESAs statement JC 2026 25 of July 31, 2026 on frontier AI (coded below as a new instrument) says annual penetration tests may be insufficient and that operational resilience testing should simulate AI-enhanced threats. The ECB letter SSM-2026-0301 of July 7, 2026 asks significant institutions for an action plan, due October 31, 2026, centered on attack surface, vulnerability and patch management, monitoring and third-party risk; it sets no testing duty. The ESRB warning ESRB/2026/3 says the ESRB will consider reflecting frontier AI in testing frameworks (watch list)." }, "notes": "RTS recital 1 says it mirrors TIBER-EU and that firms may apply TIBER-EU where consistent with DORA. The RTS sets fixed deadlines. Initiation documents are due within 3 months of notification and the scope document within 6 months (Art. 9). Active red teaming lasts at least 12 weeks (Art. 11(5)). The red team report is due within 4 weeks, and the blue team report, replay and purple teaming within 10 weeks, of the end of active testing (Art. 12). The test summary report and the remediation plan are each due within 8 weeks of the relevant authority notice (Arts. 12(7), 13(1)). For significant institutions the ECB is TLPT authority (TIBER-EU SSM Implementation Guide, November 2025). Outside TLPT, Art. 24(4) requires independent testers, internal or external, and Art. 24(6) requires yearly testing of all systems supporting critical or important functions.", "cells": { "legal_force": { "code": "mandatory", "detail": "EU regulation, directly applicable from January 17, 2025. The TLPT RTS is a Commission Delegated Regulation, binding in its entirety and directly applicable, in force since July 8, 2025.", "cite": "Reg. (EU) 2022/2554 Art. 26(1); Art. 64; Del. Reg. (EU) 2025/1190 Art. 17", "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng#art_26", "quote": "shall carry out at least every 3 years advanced testing by means of TLPT.", "confidence": "verified" }, "scope": { "code": "financial entities identified by TLPT authorities", "detail": "Authorities must require TLPT of G-SII and O-SII banks, payment and e-money institutions above EUR 150 billion in annual payment transactions (or EUR 40 billion e-money outstanding), CSDs, CCPs, the largest trading venues and the largest insurers, unless an assessment shows it is not justified. Others can be added on impact, systemic and ICT risk criteria. Microenterprises and Art. 16(1) entities are out.", "cite": "Reg. (EU) 2022/2554 Art. 26(1), 26(8) third subpara.; Del. Reg. (EU) 2025/1190 Art. 2(1) and 2(2)", "url": "https://eur-lex.europa.eu/eli/reg_del/2025/1190/oj/eng#art_2", "quote": "TLPT authorities shall require all of the following financial entities to perform TLPT", "confidence": "verified" }, "frequency": { "code": "every 3 years", "detail": "At least every three years. The competent authority may ask a firm to test more or less often based on its risk profile. Separately, Art. 24(6) requires appropriate tests of all ICT systems supporting critical or important functions at least yearly.", "cite": "Reg. (EU) 2022/2554 Art. 26(1); Art. 24(6)", "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng#art_26", "quote": "Based on the risk profile of the financial entity and taking into account operational circumstances, the competent authority may, where necessary, request the financial entity to reduce or increase this frequency.", "confidence": "verified" }, "threat_intel": { "code": "required", "detail": "An external threat intelligence provider must analyse generic, sector and targeted intelligence and propose scenarios. The control team lead selects at least three scenarios; at most one may be non-threat-led. The TI report must include at least three end-to-end scenarios covering availability, integrity and confidentiality.", "cite": "Del. Reg. (EU) 2025/1190 Art. 10(1) to 10(4); Annex III; Reg. (EU) 2022/2554 Art. 27(2)(c)", "url": "https://eur-lex.europa.eu/eli/reg_del/2025/1190/oj/eng#art_10", "quote": "The control team lead shall select at least three scenarios to conduct the TLPT on the basis of all of the following elements:", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Testers must be of the highest suitability and reputability, certified by a Member State accreditation body or bound by a formal code of conduct, give independent assurance and hold indemnity insurance. The RTS adds CVs and certifications, 3 references (TI) and 5 (testers), a TI manager with 5 years plus one member with 2, a red team manager with 5 years plus two testers with 2, and separation of TI and red team staff. Exceptions need recorded mitigation.", "cite": "Reg. (EU) 2022/2554 Art. 27(1); Del. Reg. (EU) 2025/1190 Art. 7(1)(a) to (f), Art. 7(2)", "url": "https://eur-lex.europa.eu/eli/reg_del/2025/1190/oj/eng#art_7", "quote": "is composed of at least a manager, with at least 5 years of experience in penetration testing and red team testing as well as at least two additional testers, each with penetration testing and red team testing of at least 2 years;", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "Internal testers need approval of the competent or single TLPT authority, sufficient resources, no conflicts of interest and an external TI provider. Firms using internal testers must contract external testers every three tests; mixed teams count as internal. Significant credit institutions must use external testers only. The RTS requires an internal team of a lead plus two members, each employed for the prior 12 months.", "cite": "Reg. (EU) 2022/2554 Art. 26(8), Art. 27(2); Del. Reg. (EU) 2025/1190 Art. 15; recital 27", "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng#art_26", "quote": "When financial entities use internal testers for the purposes of undertaking TLPT, they shall contract external testers every three tests. Credit institutions that are classified as significant in accordance with Article 6(4) of Regulation (EU) No 1024/2013, shall only use external testers", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "The red team test plan must state allowed and disallowed TTPs, including ethical boundaries for social engineering. External red teams must have social engineering skills. Recital 21 lists exploiting staff through social engineering among TTPs to be used as appropriate. No provision makes it mandatory.", "cite": "Del. Reg. (EU) 2025/1190 Annex IV(b); Art. 7(1)(f)(ii); recital 21", "url": "https://eur-lex.europa.eu/eli/reg_del/2025/1190/oj/eng#anx_IV", "quote": "the tactics, techniques and procedures allowed and not-allowed for use in the attack, including ethical boundaries for social engineering;", "confidence": "verified" }, "physical": { "code": "permitted", "detail": "The targeted TI report covers, where relevant, physical targeting information including ways into the premises, and external red teams must have physical penetration skills. No provision requires a physical attack. DORA's general testing programme also lists physical security reviews (Art. 25(1)).", "cite": "Del. Reg. (EU) 2025/1190 Annex III point 2(g); Art. 7(1)(f)(ii); Reg. (EU) 2022/2554 Art. 25(1)", "url": "https://eur-lex.europa.eu/eli/reg_del/2025/1190/oj/eng#anx_III", "quote": "where relevant, physical targeting information, including ways of access to the premises of the financial entity.", "confidence": "verified" }, "third_party": { "code": "required", "detail": "Firms must identify all ICT systems behind critical or important functions, including those outsourced to ICT third-party providers, and where such providers are in scope must secure their participation. A provider may instead arrange a pooled TLPT under one designated firm; at least one pooled-test scenario must cover the provider's own systems. Joint tests cover shared intra-group providers.", "cite": "Reg. (EU) 2022/2554 Art. 26(2), 26(3), 26(4); Del. Reg. (EU) 2025/1190 Art. 10(4) second and third subparas.; Art. 6; Art. 16(4) and 16(5)", "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng#art_26", "quote": "Financial entities shall identify all relevant underlying ICT systems, processes and technologies supporting critical or important functions and ICT services, including those supporting the critical or important functions which have been outsourced or contracted to ICT third-party service providers.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "Neither DORA Arts. 24 to 27 nor the TLPT RTS mention operational technology or industrial control systems.", "cite": "No provision; full text reviewed (searched: operational technology, OT, ICS, SCADA, industrial)", "url": "https://eur-lex.europa.eu/eli/reg_del/2025/1190/oj/eng", "confidence": "verified" }, "payment_systems": { "code": "required", "detail": "Market infrastructure is in scope by entity type: CSDs and CCPs, trading venues meeting market-share tests, and payment and e-money institutions above the EUR 150 billion threshold must be required to perform TLPT unless assessed out. Payment systems as such, SWIFT and card schemes are not named.", "cite": "Del. Reg. (EU) 2025/1190 Art. 2(2)(b) to (f)", "url": "https://eur-lex.europa.eu/eli/reg_del/2025/1190/oj/eng#art_2", "quote": "payment institutions that exceeded in each of the 2 calendar years preceding the assessment by the TLPT authority EUR 150 billion of total value of payment transactions", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "The TLPT provisions do not mention cloud or SaaS. Cloud and other outsourced ICT services are covered only through the general ICT third-party provider rules in Art. 26(2) to 26(4). Texts searched: DORA Arts. 24 to 27 and Del. Reg. (EU) 2025/1190.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, hosting)", "url": "https://eur-lex.europa.eu/eli/reg_del/2025/1190/oj/eng", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "For entities active in several Member States the home TLPT authority leads and host authorities may observe or assign a test manager within 20 working days. Joint and pooled tests across Member States are coordinated by a lead authority. Attestations allow mutual recognition. The scope document must list the jurisdictions where each in-scope system is used.", "cite": "Reg. (EU) 2022/2554 Art. 26(7); Del. Reg. (EU) 2025/1190 Art. 16; Annex II point 2(b)(iii)(2)", "url": "https://eur-lex.europa.eu/eli/reg_del/2025/1190/oj/eng#art_16", "quote": "The TLPT authorities of the host Member States may, within 20 working days from the receipt of the information on a future conduct of a TLPT, either express their interest in following the TLPT as observers or assign a test manager to participate in the TLPT.", "confidence": "verified" }, "purple_replay": { "code": "required", "detail": "No later than 10 weeks after active testing, blue team and testers must replay the attack and the control team must run a purple teaming exercise. Limited purple teaming during active testing is a last resort needing prior validation by the TLPT authority.", "cite": "Del. Reg. (EU) 2025/1190 Art. 12(5); Art. 11(10)", "url": "https://eur-lex.europa.eu/eli/reg_del/2025/1190/oj/eng#art_12", "quote": "No later than 10 weeks after the end of the active red team testing phase, the blue team and the testers shall replay the offensive and defensive actions performed during the TLPT. The control team shall also conduct a purple teaming exercise", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Within 8 weeks of the authority's notice the firm must submit remediation plans listing each finding, measures, priority, expected completion, root cause, owners and risks. DORA also requires internal validation that all weaknesses are fully addressed. No formal TLPT retest is set.", "cite": "Del. Reg. (EU) 2025/1190 Art. 13; Reg. (EU) 2022/2554 Art. 24(5), Art. 26(6)", "url": "https://eur-lex.europa.eu/eli/reg_del/2025/1190/oj/eng#art_13", "quote": "Within 8 weeks from the notification referred to in Article 12(7) of this Regulation, the financial entity shall provide the remediation plans and the documentation referred to in Article 26(6) of Regulation (EU) 2022/2554 to the TLPT authority", "confidence": "verified" }, "regulator_role": { "code": "leads_or_oversees_test", "detail": "The TLPT authority sets up a TLPT cyber team, names a test manager and alternate for each test, takes part in all phases, validates scope, TI report and test plan, and issues an attestation. The competent authority validates the scope and may change test frequency.", "cite": "Del. Reg. (EU) 2025/1190 Art. 3; Arts. 9 to 12; Art. 14; Reg. (EU) 2022/2554 Art. 26(2), 26(7)", "url": "https://eur-lex.europa.eu/eli/reg_del/2025/1190/oj/eng#art_3", "quote": "The TLPT authority shall participate to all the phases of the TLPT.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Only in the general testing programme: Art. 25(1) lists vulnerability scans and scanning software solutions among required test types. The TLPT provisions (Arts. 26 and 27 and the RTS) say nothing on automated, continuous or AI-driven testing or on testing AI systems.", "cite": "Reg. (EU) 2022/2554 Art. 25(1); TLPT provisions reviewed with no match (searched: automat, artificial intelligence, AI, machine learning)", "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng#art_25", "quote": "vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software solutions", "confidence": "verified" } } }, { "id": "hk-hkma-icast", "jurisdiction": "Hong Kong", "region": "Benchmark", "sector": "financial", "name": "Intelligence-led Cyber Attack Simulation Testing (iCAST) under the Cyber Resilience Assessment Framework (C-RAF 2.0), Cybersecurity Fortification Initiative 2.0", "short": "HK iCAST (C-RAF 2.0)", "issuer": "Hong Kong Monetary Authority (HKMA)", "version": "C-RAF 2.0 under the CFI 2.0 circular of November 3, 2020; SPM TM-C-1 V.1 of 29.11.24. TM-C-1 PDF and the June 2, 2026 circular are byte-identical to the September copies.", "status": "In force as of 2026-09-28. The HKMA circular dated June 2, 2026 still names C-RAF 2.0 as a current supervisory requirement. No C-RAF 3.0 found on the HKMA Banking Regulatory Document Repository or HKMA CFI page (page last revised August 26, 2026). A separate Cyber Resilience Testing Framework is in development, with a first test run targeted for late 2026.", "public": "partial", "primary_url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20241202-2-EN/TM-C-1.pdf", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No change. HKMA CFI page still shows last revision August 26, 2026. C-RAF 2.0 text remains non-public. No HKMA circular on cyber testing dated after June 2, 2026 was found. The Chief Executive's 2026 Policy Address (September 16, 2026, para. 105) says the HKMA 'is also developing a Cyber Resilience Testing Framework for banks'; the June 2, 2026 circular targets an initial test run with selected institutions for late 2026 (watch list). HKMA circulars of April 1, 2026 and June 1, 2026 on operational resilience cover scenario testing under SPM OR-2, not security testing." }, "notes": "Public record: HKMA circulars of May 24, 2016, December 21, 2016, June 12, 2018, November 3, 2020 (CFI 2.0 and annex), SPM TM-C-1 (November 29, 2024) and the circular dated June 2, 2026. The controlling C-RAF 2.0 document is available only on the HKMA Supervisory Communication Website (CFI 2.0 circular, footnote 1), so scope rules for iCAST are marked unknown_not_public. Cells marked secondary cite the superseded C-RAF 1.0 (December 2016) from a copy hosted by a third party (webflow), not by the HKMA. 2024 to 2026 changes: TM-C-1 (November 29, 2024) superseded the September 15, 2015 circular and restated that iCAST applies to medium and high inherent risk AIs, without new requirements. The circular dated June 2, 2026 (BRDR ID 20260529-8-EN) announced a Cyber Resilience Testing Framework (CRTF), a new supervisory framework to stress test AIs' response to and recovery from actual breaches, developed with an HKAB industry working group; an initial test run with selected institutions is targeted for late 2026. It also set up a Task Force on A.I.-Driven Cyber Risks. The HKMA 2025 Annual Report lists developing the CRTF and a pilot run as a 2026 priority. No HKMA text found that adds purple teaming to iCAST. From June 2, 2026, AIs designated as critical infrastructure operators also have a statutory annual penetration test under the PCICSO (see row hk-hkma-pcicso-cop).", "cells": { "legal_force": { "code": "supervisory_expectation", "detail": "iCAST is part of C-RAF, which TM-C-1 describes. TM-C-1 is a statutory guideline under section 7(3) of the Banking Ordinance, not legislation, and it says AIs are required to run regular C-RAF assessments.", "cite": "SPM TM-C-1, Classification and para. 3.5.2", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20241202-2-EN/TM-C-1.pdf", "quote": "AIs are required to conduct regular assessments under the C-RAF with a view to raising their cyber defence maturity to a level commensurate with the assessed risk exposures.", "confidence": "verified" }, "scope": { "code": "AIs with medium or high inherent risk", "detail": "All authorized institutions (AIs) run the C-RAF inherent risk and maturity assessments. iCAST applies to AIs whose inherent risk is rated medium or high. The 2016 to 2020 roll-out covered about 180 AIs in three phases (30, 60 and about 90).", "cite": "SPM TM-C-1, para. 3.5.1(c); HKMA circular of June 12, 2018", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20241202-2-EN/TM-C-1.pdf", "quote": "an Intelligence-led Cyber Attack Simulation Testing (iCAST) for AIs with “medium” or “high” inherent risk ratings to test their cyber resilience by simulating real-life cyber attacks.", "confidence": "verified" }, "frequency": { "code": "regular; interval not public", "detail": "TM-C-1 requires regular C-RAF assessments but the public text sets no interval. The CFI 2.0 circular set first-round iCAST deadlines of end-June 2022, end-March 2023 and end-December 2023 for Groups 1 to 3. Any repeat cycle is set in the C-RAF 2.0 document, which is not public.", "cite": "SPM TM-C-1, para. 3.5.2; CFI 2.0 circular of November 3, 2020, para. (ii)", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20201103-1-EN/20201103-1-EN.pdf", "quote": "The timeline for completing the C-RAF 2.0 assessments for the 3 groups of AIs is as follows:", "confidence": "verified" }, "threat_intel": { "code": "required", "detail": "iCAST is defined as intelligence-led. The HKMA announced that scenarios would replicate real attacks based on specific, current threat intelligence. The 2016 C-RAF 1.0 text required a tailored threat intelligence report for high inherent risk AIs and allowed a generic report for medium risk AIs; the C-RAF 2.0 detail is not public.", "cite": "HKMA circular of May 24, 2016, Annex, Part I(iii); C-RAF 1.0 (Dec 2016) paras. 4.6.7 to 4.6.8", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20160524-1-EN/20160524-1-EN.pdf", "quote": "Simulation test scenarios will be designed to replicate current real life cyber attacks based on specific and up-to-date threat intelligence.", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "The HKMA publishes named qualifications for each iCAST role (manager, threat intelligence specialist, specialist, tester). These are CREST certifications or listed equivalents, including HKIB CCASP, GIAC, OSCE/OSEE and OSCP. Since 2018 the HKMA also accepts professionals without a listed qualification if the AI assesses and documents their expertise.", "cite": "CFI 2.0 Annex, List of equivalent qualifications; HKMA circular of June 12, 2018", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20180612-1-EN/20180612-1-EN.pdf", "quote": "The HKMA is prepared to accept the appointment of these qualified professionals by AIs to perform the C-RAF Inherent Risk Assessment, the Maturity Assessment or the iCAST, provided that a careful assessment of their expertise and experience is performed and the assessment result is properly documented.", "confidence": "verified" }, "internal_testers": { "code": "unknown_not_public", "detail": "The C-RAF 2.0 text is not public. The superseded C-RAF 1.0 of December 2016 allowed iCAST to be run with internal resources, with management endorsement of the report.", "cite": "C-RAF 1.0 (Dec 2016), para. 4.9.4 (superseded; third-party-hosted copy)", "url": "https://uploads-ssl.webflow.com/59d28ad983887e000196f803/5fecc1fe13498132b4fa835b_HKMA%20CFI%20-%20Cyber%20Resilience%20Assessment%20Framework%20-%20Dec%202016.pdf", "quote": "In case the test was conducted by AI’s internal resources, the report should be reviewed and endorsed by management of the AI.", "confidence": "secondary" }, "social_engineering": { "code": "unknown_not_public", "detail": "The C-RAF 2.0 text is not public. The superseded C-RAF 1.0 named phishing email and social engineering as channels an iCAST specialist uses to start a test.", "cite": "C-RAF 1.0 (Dec 2016), para. 5.2.3 (superseded; third-party-hosted copy)", "url": "https://uploads-ssl.webflow.com/59d28ad983887e000196f803/5fecc1fe13498132b4fa835b_HKMA%20CFI%20-%20Cyber%20Resilience%20Assessment%20Framework%20-%20Dec%202016.pdf", "quote": "initiates test through various channels (such as phishing email, social engineering, etc.)", "confidence": "secondary" }, "physical": { "code": "unknown_not_public", "detail": "The C-RAF 2.0 text is not public. The superseded C-RAF 1.0 iCAST chapter (Chapter 4) did not mention physical intrusion; physical controls appear only in the maturity matrix.", "cite": "C-RAF 1.0 (Dec 2016), Chapter 4 reviewed (superseded; third-party-hosted copy)", "url": "https://uploads-ssl.webflow.com/59d28ad983887e000196f803/5fecc1fe13498132b4fa835b_HKMA%20CFI%20-%20Cyber%20Resilience%20Assessment%20Framework%20-%20Dec%202016.pdf", "confidence": "secondary" }, "third_party": { "code": "unknown_not_public", "detail": "The C-RAF 2.0 text is not public. The superseded C-RAF 1.0 drew iCAST scope to include \"situational awareness and third party\" and had the control group agree which partners were in scope. The June 2026 circular asks AIs to assess third-party service providers' cyber resilience but does not tie this to iCAST.", "cite": "C-RAF 1.0 (Dec 2016), para. 4.3.3 and Figure 14 (superseded; third-party-hosted copy)", "url": "https://uploads-ssl.webflow.com/59d28ad983887e000196f803/5fecc1fe13498132b4fa835b_HKMA%20CFI%20-%20Cyber%20Resilience%20Assessment%20Framework%20-%20Dec%202016.pdf", "quote": "The group will agree the test objectives in terms of systems, processes, partners to be included", "confidence": "secondary" }, "ot": { "code": "unknown_not_public", "detail": "The C-RAF 2.0 text is not public. The superseded C-RAF 1.0 iCAST chapter did not mention operational technology.", "cite": "C-RAF 1.0 (Dec 2016), Chapter 4 reviewed (superseded; third-party-hosted copy)", "url": "https://uploads-ssl.webflow.com/59d28ad983887e000196f803/5fecc1fe13498132b4fa835b_HKMA%20CFI%20-%20Cyber%20Resilience%20Assessment%20Framework%20-%20Dec%202016.pdf", "confidence": "secondary" }, "payment_systems": { "code": "unknown_not_public", "detail": "The C-RAF 2.0 text is not public. The superseded C-RAF 1.0 listed initiating fund movements to other AIs as a possible test goal and used clearing and settlement as its scoping example.", "cite": "C-RAF 1.0 (Dec 2016), paras. 4.5.3 and 4.7.2 (superseded; third-party-hosted copy)", "url": "https://uploads-ssl.webflow.com/59d28ad983887e000196f803/5fecc1fe13498132b4fa835b_HKMA%20CFI%20-%20Cyber%20Resilience%20Assessment%20Framework%20-%20Dec%202016.pdf", "quote": "encrypting important files for ransom, v) initiating funds movements to other AIs, etc.", "confidence": "secondary" }, "cloud_saas": { "code": "unknown_not_public", "detail": "CFI 2.0 added control principles for cloud technology and virtualisation security to C-RAF 2.0. Public text links these to the maturity assessment, not to iCAST scope. The iCAST scope rules are not public.", "cite": "CFI 2.0 Annex, C-RAF 2.0 risk assessment list, first bullet", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20201103-2-EN/20201103-2-EN.pdf", "quote": "latest technology trends (e.g. cloud technology and virtualisation security)", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "CFI 2.0 lets AIs rely on results of similar cyber resilience assessments run by their banking group or head office. C-RAF 1.0 limited assessment scope to systems that support the AI's Hong Kong business.", "cite": "CFI 2.0 Annex, C-RAF 2.0 risk assessment list, third bullet", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20201103-2-EN/20201103-2-EN.pdf", "quote": "Allowing more flexibility for AIs to leverage the results of similar cyber resilience assessments performed by their banking groups or headquarters;", "confidence": "verified" }, "purple_replay": { "code": "unknown_not_public", "detail": "CFI 2.0 added Blue team requirements to iCAST to measure detection, response and recovery. Public text does not say whether a joint replay or purple exercise follows; the detail sits in the non-public C-RAF 2.0 document.", "cite": "CFI 2.0 Annex, C-RAF 2.0 risk assessment list, second bullet", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20201103-2-EN/20201103-2-EN.pdf", "quote": "Introduction of Blue team requirements for iCAST to measure the effectiveness of detection, response and recovery functions of AIs;", "confidence": "verified" }, "remediation_retest": { "code": "recommended", "detail": "The HKMA told AIs to rectify all control gaps found in C-RAF assessments, with governance and board reporting. No public deadline or retest rule for iCAST findings.", "cite": "HKMA circular of June 12, 2018, penultimate paragraph", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20180612-1-EN/20180612-1-EN.pdf", "quote": "we would like to remind those AIs which have completed the C-RAF assessments to devote adequate management attention and resources to rectifying all the control gaps identified in the C-RAF assessments.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "The HKMA does not run the test. It reviews AIs' C-RAF assessment results and conducts on-site examinations and off-site reviews on a risk basis.", "cite": "SPM TM-C-1, para. 3.6.1", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20241202-2-EN/TM-C-1.pdf", "quote": "The HKMA conducts a range of supervisory work on AIs’ cyber risk management and cybersecurity controls, including in the form of on-site examinations, reviews of AIs’ C-RAF assessment results and other off-site reviews following a risk-based approach.", "confidence": "verified" }, "automated_ai": { "code": "unknown_not_public", "detail": "Public iCAST texts do not mention automated, continuous or AI-driven testing, and the C-RAF 2.0 text is not public. The June 2026 circular addresses attacks using frontier AI models and asks for scenario testing of response and recovery, but does not set rules for AI-driven testing or for testing AI systems.", "cite": "HKMA circular of June 2, 2026 (ref. B1/15C, G4/58C), first bullet list", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20260529-8-EN/20260529-8-EN.pdf", "quote": "these frontier A.I. models show capacity to independently identify and exploit zero-day vulnerabilities in critical software and infrastructures", "confidence": "verified" } } }, { "id": "hk-hkma-pcicso-cop", "jurisdiction": "Hong Kong", "region": "Benchmark", "sector": "financial", "name": "Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653), with the Code of Practice for Authorized Institutions designated by the Monetary Authority as Critical Infrastructure Operators", "short": "HK PCICSO bank CoP", "issuer": "Legislative Council of Hong Kong (Ordinance); Monetary Authority as designated authority (Code of Practice)", "version": "Ord. No. 4 of 2025 (gazette copy byte-identical); HKMA Code of Practice dated June 2, 2026 (byte-identical).", "status": "In force. The Ordinance came into operation on January 1, 2026 (HK Government press release of June 27, 2025). The HKMA sectoral Code of Practice came into operation on June 2, 2026 (HKMA circular dated June 2, 2026).", "public": "full", "primary_url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20260527-25-EN/20260527-25-EN.pdf", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No change. No revised HKMA code of practice found on BRDR. The consolidated Cap. 653 on elegislation.gov.hk was not re-read; the gazette copy of Ord. No. 4 of 2025 was used, as in September." }, "notes": "New in 2026. This row covers the statutory penetration test for AIs designated as critical infrastructure operators, which sits alongside iCAST. The Code leans on the non-public C-RAF maturity matrix for many controls. The Code lets a designated AI reuse results of other assessments (for example C-RAF work) if together they cover all critical computer systems and meet sections 6.3.1 to 6.3.7 and the statutory interval (para. 6.3.8). The penetration test must cover at least network security, system software security, client-side and server-side application security (para. 6.3.6). Legal text read from the LegCo gazette copy of Ord. No. 4 of 2025; the consolidated Cap. 653 on elegislation.gov.hk blocked automated retrieval.", "cells": { "legal_force": { "code": "mandatory", "detail": "Section 24 of the Ordinance imposes the risk assessment duty, including a penetration test, and makes non-compliance an offence (fine of HK$300,000 on summary conviction, HK$500,000 on indictment, plus daily fines). The Code of Practice is not subsidiary legislation, but the Monetary Authority may issue binding directions with reference to it.", "cite": "Ord. No. 4 of 2025, s. 24(1), 24(8), 24(9); Code of Practice para. 1.1.5", "url": "https://www.legco.gov.hk/yr2025/english/ord/2025ord004-e.pdf", "quote": "A CI operator commits an offence if the operator fails to comply with subsection (1) or a requirement imposed under subsection (5).", "confidence": "verified" }, "scope": { "code": "AIs designated as CI operators", "detail": "The Code applies to authorized institutions the Monetary Authority designates as critical infrastructure operators. Under Schedule 2 the Monetary Authority also regulates Cap. 584 licensees and settlement institutions and operators of designated payment systems, but this Code covers designated AIs only. The number of designated AIs is not public.", "cite": "Code of Practice para. 1.1.2; Ord. No. 4 of 2025, Schedule 2 Part 2 item 1", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20260527-25-EN/20260527-25-EN.pdf", "quote": "This Code is applicable to an Authorized Institution (AI) designated by the MA as a Critical Infrastructure (CI) operator (Designated AI).", "confidence": "verified" }, "frequency": { "code": "annual", "detail": "The first risk assessment is due within 12 months of designation, then at least once every 12 months, with a report to the regulating authority within 3 months. A separate security audit is due at least once every 24 months (s. 25).", "cite": "Ord. No. 4 of 2025, s. 24(1)(a)", "url": "https://www.legco.gov.hk/yr2025/english/ord/2025ord004-e.pdf", "quote": "at least once every 12 months after the expiry of the first period", "confidence": "verified" }, "threat_intel": { "code": "recommended", "detail": "The Code allows the penetration test to be run either from the position of a potential attacker or based on threat intelligence. Threat intelligence is one option, not a requirement.", "cite": "Code of Practice para. 6.3.6", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20260527-25-EN/20260527-25-EN.pdf", "quote": "The penetration test in the computer-system security risk assessment should be carried out from the position of a potential attacker or based on threat intelligence", "confidence": "verified" }, "provider_requirements": { "code": "recommended", "detail": "Testers should have suitable knowledge, relevant experience and appropriate professional qualifications. No named certification or accreditation scheme. The audit (not the test) must be done by an assessor following C-RAF Chapter 1 section 1.2.4.", "cite": "Code of Practice paras. 6.3.5 to 6.3.6, 6.4.2", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20260527-25-EN/20260527-25-EN.pdf", "quote": "The penetration test should be conducted by a tester having suitable knowledge, relevant experience and appropriate professional qualifications.", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Neither the Ordinance nor the Code says whether the penetration tester must be external or independent.", "cite": "No provision; full text reviewed (searched: internal, independent, external, in-house, qualified)", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20260527-25-EN/20260527-25-EN.pdf", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "Not mentioned. The Ordinance defines a penetration test as simulating an attack \"by electronic means\", which leaves out human-channel attacks without prohibiting them.", "cite": "No provision; full text reviewed (searched: social engineering, phishing, human, staff); Schedule 4 Part 1 definition of penetration test", "url": "https://www.legco.gov.hk/yr2025/english/ord/2025ord004-e.pdf", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Not mentioned for testing. Physical security appears only as a control (Code para. 6.2.14). The statutory penetration test is defined as an attack \"by electronic means\".", "cite": "No provision; full text reviewed (searched: physical, premises, on-site); Code para. 6.2.14 is a control, not a test", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20260527-25-EN/20260527-25-EN.pdf", "confidence": "verified" }, "third_party": { "code": "required", "detail": "A critical computer system can be designated whether or not the operator controls it, and the statutory risk assessment must include a penetration test of the critical computer systems concerned. A supplier-run system that is designated is therefore inside the mandatory test.", "cite": "Ord. No. 4 of 2025, s. 13(1) and Schedule 4 Part 2 item 2", "url": "https://www.legco.gov.hk/yr2025/english/ord/2025ord004-e.pdf", "quote": "designate a computer system (whether under the control of the operator or not)", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "Not mentioned in the banking Code or in the penetration test provisions.", "cite": "No provision; full text reviewed (searched: operational technology, industrial control, SCADA, OT)", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20260527-25-EN/20260527-25-EN.pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "The testing provisions do not name payment systems. The test covers whatever critical computer systems are designated.", "cite": "No provision; full text reviewed (searched: payment, SWIFT, card, settlement)", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20260527-25-EN/20260527-25-EN.pdf", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "Cloud appears as a control section (6.2.24) pointing to the HKMA Practice Guide on Cloud Adoption of January 8, 2026, not in the test scope provisions.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, CSP); Code para. 6.2.24 is a control, not a test", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20260527-25-EN/20260527-25-EN.pdf", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "A system can be designated if it is accessible by the operator in or from Hong Kong, and the Code defines this as regardless of the system's physical location. The mandatory penetration test can therefore reach systems hosted outside Hong Kong.", "cite": "Code of Practice para. 2.1.2 (definition \"accessible from Hong Kong\"); Ord. s. 13(1)(a)", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20260527-25-EN/20260527-25-EN.pdf", "quote": "means a computer system which can be accessed from an entry point in Hong Kong regardless of the physical location of that system", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming or replay step.", "cite": "No provision; full text reviewed (searched: purple, replay, blue team, workshop)", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20260527-25-EN/20260527-25-EN.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "The statutory assessment must cover identification of the treatment and monitoring needed for identified risks. The Code asks for a treatment plan per finding with a timeline and a responsible party. No retest rule.", "cite": "Ord. No. 4 of 2025, s. 24(3) and Schedule 4 Part 2 item 5; Code para. 6.3.7(c)", "url": "https://www.legco.gov.hk/yr2025/english/ord/2025ord004-e.pdf", "quote": "Identification of the treatment and monitoring required to deal with the identified risks.", "confidence": "verified" }, "regulator_role": { "code": "receives_results", "detail": "The operator must submit the assessment report to the regulating authority (the Monetary Authority for designated AIs). The authority can order extra assessments after notified changes. The Commissioner can require operators to take part in security drills.", "cite": "Ord. No. 4 of 2025, s. 24(1)(b), 24(5), 26", "url": "https://www.legco.gov.hk/yr2025/english/ord/2025ord004-e.pdf", "quote": "submit to the regulating authority that regulates the operator a report for the assessment", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "No mention of automated, continuous or AI-driven testing.", "cite": "No provision; full text reviewed (searched: automated, continuous, artificial intelligence, AI, machine learning)", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20260527-25-EN/20260527-25-EN.pdf", "confidence": "verified" } } }, { "id": "sg-abs-aase", "jurisdiction": "Singapore", "region": "Benchmark", "sector": "financial", "name": "Red Team: Adversarial Attack Simulation Exercise Guidelines for the Financial Industry in Singapore", "short": "SG ABS AASE", "issuer": "The Association of Banks in Singapore (ABS), Standing Committee for Cyber Security", "version": "September 2024 (v2.0 per the ABS listing). PDF byte-identical to the 2026-09-28 copy.", "status": "Current as of 2026-09-28. The ABS cyber security guidelines page lists the September 2024 edition (v2.0) as the current AASE guideline; no later edition found. MAS TRM Guidelines (January 2021) still cite version 1 of November 2018.", "public": "full", "primary_url": "https://www.abs.org.sg/docs/library/abs-red-team-adversarial-attack-simulation-exercises-guidelines----september-2024.pdf", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No change. The ABS cyber security guidelines page still links the September 2024 edition. The MAS and ABS AI-Driven Cyber and Technology Risk Taskforce (July 28, 2026) has a guidance workstream on controls for AI-enabled threats; no guidance published by 2026-10-30 (watch list)." }, "notes": "2024 edition changes read against Version 1.0 (November 2018): new sections on purple teams, automated and continuous simulation, and a relaxed minimum frequency (from at least once per year to at least once every 24 months). The acknowledgements list MAS as a member of the ABS working group. The reference list names CBEST, TIBER-EU, TIBER-NL, iCAST, CORIE, SAMA F.E.E.R. and the G-7 Fundamental Elements for Threat-Led Penetration Testing. On July 28, 2026 MAS and ABS set up the AI-Driven Cyber and Technology Risk Taskforce (ACT) to develop guidance on AI-enabled threats and trial AI-enabled defensive tools; no change to AASE had been published by 2026-09-28. The ABS page also lists Penetration Testing Guidelines 2.0 (April 2024), not coded here.", "cells": { "legal_force": { "code": "voluntary", "detail": "An industry guideline written by an ABS working group that included MAS. It is not a MAS instrument and says it should not be relied on alone for regulatory compliance. MAS TRM Guidelines para. 13.4 expects FIs to run adversarial attack simulation exercises and cites the ABS guideline as its source definition (see row sg-mas-trm).", "cite": "Sec. 2 Introduction; Sec. 11 Acknowledgements", "url": "https://www.abs.org.sg/docs/library/abs-red-team-adversarial-attack-simulation-exercises-guidelines----september-2024.pdf", "quote": "This document aids in planning and executing such exercises but should not be relied on solely to achieve compliance with regulations.", "confidence": "verified" }, "scope": { "code": "FIs in Singapore (opt-in)", "detail": "Written for financial institutions in Singapore; other organizations may use it. FIs may adopt it in part or in full depending on maturity.", "cite": "Sec. 2 Introduction", "url": "https://www.abs.org.sg/docs/library/abs-red-team-adversarial-attack-simulation-exercises-guidelines----september-2024.pdf", "quote": "This guideline is intended to support FIs within Singapore but may also be used by other organisations to plan and conduct such exercises.", "confidence": "verified" }, "frequency": { "code": "risk-based; at least every 24 months", "detail": "Frequency is risk-based. The guide recommends an exercise at least once every 24 months, with an option to go to every 12 months. Version 1.0 (2018) recommended at least once per year, so the 2024 edition halved the recommended minimum frequency.", "cite": "Sec. 6.4; Version 1.0 Sec. 6.4", "url": "https://www.abs.org.sg/docs/library/abs-red-team-adversarial-attack-simulation-exercises-guidelines----september-2024.pdf", "quote": "recommends that AASE be performed once every 24 months minimally, but FIs have the flexibility to increase the frequency to every 12 months should this be deemed necessary.", "confidence": "verified" }, "threat_intel": { "code": "recommended", "detail": "Scenarios are built from threat intelligence and attack modelling. Generic and targeted threat intelligence are described; intelligence can come from in-house analysts or external providers.", "cite": "Sec. 1 Executive Summary; Sec. 7.2.2", "url": "https://www.abs.org.sg/docs/library/abs-red-team-adversarial-attack-simulation-exercises-guidelines----september-2024.pdf", "quote": "FIs are encouraged to create scenarios for their attack simulation by identifying the most likely adversaries and the attack vectors through attack modelling.", "confidence": "verified" }, "provider_requirements": { "code": "recommended", "detail": "Providers and practitioners should hold accreditations or certifications that require practical demonstration of advanced skills; no body is named. FIs should not reject a provider only for lacking a particular accreditation. Criminal background checks, insurance and indemnity are expected.", "cite": "Sec. 7.1.4, 7.1.4.4", "url": "https://www.abs.org.sg/docs/library/abs-red-team-adversarial-attack-simulation-exercises-guidelines----september-2024.pdf", "quote": "The provider and all its practitioners should hold accreditations or certifications that require practical demonstration of an advanced understanding of offensive and/or defensive security skills", "confidence": "verified" }, "internal_testers": { "code": "allowed", "detail": "The Attacker can be employed or contracted. The guide notes larger FIs often have internal teams and external providers may be engaged for an independent view.", "cite": "Sec. 4 Definitions (Attacker); Sec. 7.1.2 \"Consider Engaging External Providers\"", "url": "https://www.abs.org.sg/docs/library/abs-red-team-adversarial-attack-simulation-exercises-guidelines----september-2024.pdf", "quote": "While larger FIs tend to have their own internal specialised teams, external providers may be engaged to offer independent views on conducting the Attack Modelling and the simulated attack.", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "Listed as a typical entry point and as a feature that separates AASE from penetration testing.", "cite": "Sec. 5.2; Sec. 7.3.2", "url": "https://www.abs.org.sg/docs/library/abs-red-team-adversarial-attack-simulation-exercises-guidelines----september-2024.pdf", "quote": "Social engineering may be used", "confidence": "verified" }, "physical": { "code": "permitted", "detail": "Listed as a typical entry point. Concessions may include bypassing a physically secured network outlet, and physical access may need real-time supervision by the Exercise Director.", "cite": "Sec. 5.2; Sec. 7.3.2; Sec. 7.1.4.2", "url": "https://www.abs.org.sg/docs/library/abs-red-team-adversarial-attack-simulation-exercises-guidelines----september-2024.pdf", "quote": "Physical security may be tested", "confidence": "verified" }, "third_party": { "code": "permitted", "detail": "Supply chain attacks are a typical entry point and key suppliers are part of target reconnaissance. The guide warns that some cloud or outsourced providers forbid attack simulation or need notice, and FIs should weigh those contracts when picking targets. Its sample artifact lists compromising third-party sites for a watering hole attack as an out-of-scope technique.", "cite": "Sec. 7.3.2; Sec. 7.1.3 (Legal and Regulatory Risk); Sec. 8.1.4; Sec. 8.2.1", "url": "https://www.abs.org.sg/docs/library/abs-red-team-adversarial-attack-simulation-exercises-guidelines----september-2024.pdf", "quote": "Entry points typically include (but are not limited to): • Physical breaches • Infrastructure breaches • Social engineering (phishing, vishing, etc.) • Supply chain attacks", "confidence": "verified" }, "ot": { "code": "permitted", "detail": "OT is not named as a target, but FIs may seek providers with Internet of Things or operational technology skills, depending on their technology stack.", "cite": "Sec. 7.1.4.1", "url": "https://www.abs.org.sg/docs/library/abs-red-team-adversarial-attack-simulation-exercises-guidelines----september-2024.pdf", "quote": "Understanding of and capabilities in Internet of Things and/or Operational Technology devices.", "confidence": "verified" }, "payment_systems": { "code": "permitted", "detail": "Payment systems appear in worked examples: a payment processing gateway goal, a phishing-to-SWIFT scenario, and a sample threat report scenario on payment and settlement systems. High-risk actions such as submitting payment messages can be moved to a replica environment.", "cite": "Sec. 7.1.3; Sec. 7.2.4; Sec. 8.1.1", "url": "https://www.abs.org.sg/docs/library/abs-red-team-adversarial-attack-simulation-exercises-guidelines----september-2024.pdf", "quote": "The Attacker utilizes phishing to get a foothold in the organization by targeting privileged users. Subsequently, it aims to locate and pivot to SWIFT", "confidence": "verified" }, "cloud_saas": { "code": "permitted", "detail": "Cloud-hosted functions can be targets, subject to the provider's contract terms. Cloud skill is a provider selection factor and cloud is a section of the target reconnaissance report.", "cite": "Sec. 7.1.3 (Legal and Regulatory Risk); Sec. 7.1.4.1; Sec. 8.1.4", "url": "https://www.abs.org.sg/docs/library/abs-red-team-adversarial-attack-simulation-exercises-guidelines----september-2024.pdf", "quote": "FIs using systems or functions hosted by an external provider (i.e. Cloud service or external business function) should review the contractual terms of the service, as some providers do not allow attack simulations or require prior notice.", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "The guide notes that regulators in some countries require AASE and suggests telling regulators in advance (Sec. 7.1.6.4), values a provider's reputation across jurisdictions (Sec. 7.1.4) and asks remediation risk assessments to weigh where systems are located (Sec. 7.5.1). None reaches foreign entities, sets multi-jurisdiction or recognized tests, or limits where testers sit.", "cite": "No cross-border provision under R1; Sec. 7.1.4, 7.1.6.4 and 7.5.1 considered (searched: jurisdiction, overseas, located, country)", "url": "https://www.abs.org.sg/docs/library/abs-red-team-adversarial-attack-simulation-exercises-guidelines----september-2024.pdf", "confidence": "verified", "history": [ { "date": "2026-10-30", "from": "addressed", "to": "not_addressed", "why": "Sec. 7.1.6.4, 7.1.4 and 7.5.1 only note other regulators' practice, provider experience abroad and system location in remediation; none meets R1." } ], "harmonized_from": "addressed", "harmonize_reason": "R1: Sec. 7.1.6.4, 7.1.4 and 7.5.1 only note other regulators' practice, provider experience abroad and system location in remediation; none meets R1." }, "purple_replay": { "code": "recommended", "detail": "Describes purple team exercises and an optional attack and defence joint replay after the exercise, as a tabletop, lab or live replay.", "cite": "Sec. 5.1.6; Sec. 7.4.3", "url": "https://www.abs.org.sg/docs/library/abs-red-team-adversarial-attack-simulation-exercises-guidelines----september-2024.pdf", "quote": "A joint post-attack exercise can be organised to enable a step-by-step replay of the attack", "confidence": "verified" }, "remediation_retest": { "code": "recommended", "detail": "The FI should set a remediation timeline, assign a project manager to track actions to closure and report progress to senior management. No retest requirement.", "cite": "Sec. 7.5.1; Sec. 8.3.4", "url": "https://www.abs.org.sg/docs/library/abs-red-team-adversarial-attack-simulation-exercises-guidelines----september-2024.pdf", "quote": "The FI should formalise a remediation timeline based on the exercise report, along with the organisation’s risk appetite and compensating controls.", "confidence": "verified" }, "regulator_role": { "code": "not_addressed", "detail": "No regulator role in running or receiving the exercise. The guide only suggests it may be prudent to tell regulators in advance.", "cite": "Sec. 7.1.6.4", "url": "https://www.abs.org.sg/docs/library/abs-red-team-adversarial-attack-simulation-exercises-guidelines----september-2024.pdf", "quote": "It may be prudent to advise the regulators of the intent to execute such exercises upfront.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Defines automated attack simulation (breach and attack simulation tools) and continuous adversarial attack simulation, and says some FIs run continuous simulations. No mention of AI-driven testing or of testing AI systems.", "cite": "Sec. 4 Definitions; Sec. 6.5", "url": "https://www.abs.org.sg/docs/library/abs-red-team-adversarial-attack-simulation-exercises-guidelines----september-2024.pdf", "quote": "Some FIs may choose to test its defences through continuous adversarial attack simulations", "confidence": "verified" } } }, { "id": "sg-mas-trm-testing", "jurisdiction": "Singapore", "region": "Benchmark", "sector": "financial", "name": "Guidelines on Risk Management Practices: Technology Risk (Technology Risk Management Guidelines), Section 13 Cyber Security Assessment", "short": "SG MAS TRM s.13", "issuer": "Monetary Authority of Singapore (MAS)", "version": "January 2021 (page 'Published Date: 18 January 2021'). PDF byte-identical to the 2026-09-28 copy.", "status": "In force as of 2026-09-28. The MAS guideline page (retrieved 2026-09-28) still shows published date January 18, 2021 and the same PDF. No revised TRM Guidelines found. The sector-specific TRM Notices listed on the page were cancelled with effect from May 10, 2024. On July 28, 2026 MAS and ABS formed the AI-Driven Cyber and Technology Risk Taskforce, which is to develop guidance on AI-enabled threats.", "public": "full", "primary_url": "https://www.mas.gov.sg/-/media/mas/regulations-and-financial-stability/regulatory-and-supervisory-framework/risk-management/trm-guidelines-18-january-2021.pdf", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No change to the Guidelines. MAS consultation P012-2026 (June 10, 2026, closed July 31, 2026) proposes amendments to the TRM Notices on asset management, risk assessment, capacity, change management, monitoring, backups and incidents; it proposes no penetration testing or red teaming duty, so it changes no cell here (listed under left_out). MAS issued separate Guidelines on AI Risk Management on October 7, 2026 (coded below as a new instrument). A vendor claim that MAS required AI-assisted red teaming of internet-facing systems from July 1, 2026 was checked against MAS's site search and published texts and not found. A MAS advisory of April 17, 2026 on AI-driven threats is described by secondary sources but no copy was found on mas.gov.sg." }, "notes": "Strictest testing element: an expectation of penetration testing at least once a year for Internet-facing systems (para. 13.2.4) plus an expectation that FIs \"should perform\" an adversarial attack simulation exercise (para. 13.4.1), with no set AASE interval. Para. 13.2.2 lets FIs add a bug bounty programme to complement PT. Footnotes 32 and 33 take their AASE and red team definitions from ABS AASE Version 1 (November 2018). Coding convention for this guideline: all text is \"should\" or \"is expected to\"; payment_systems is coded required because the vocabulary has no recommended value and the text directs PT at a named scope. The MAS PDF and guideline page were retrieved with a headless browser because curl received a bot-check page.", "cells": { "legal_force": { "code": "supervisory_expectation", "detail": "Guidelines, not law. MAS considers how far an FI observes their spirit when supervising it. Adherence is scaled to the risk and complexity of the FI.", "cite": "Para. 2.2 and 2.3", "url": "https://www.mas.gov.sg/-/media/mas/regulations-and-financial-stability/regulatory-and-supervisory-framework/risk-management/trm-guidelines-18-january-2021.pdf", "quote": "In supervising an FI, the degree of observance with the spirit of the Guidelines by an FI is an area of consideration by MAS.", "confidence": "verified" }, "scope": { "code": "all MAS-regulated FIs", "detail": "Applies to banks, insurers, capital markets intermediaries, market infrastructure (exchanges, clearing houses, central securities depository, trade repositories), designated payment system operators, payment institutions and others, as listed on the MAS guideline page.", "cite": "MAS guideline page, \"Applies to\" list", "url": "https://www.mas.gov.sg/regulation/guidelines/technology-risk-management-guidelines", "quote": "Designated Payment System Operator", "confidence": "verified" }, "frequency": { "code": "annual (internet-facing systems)", "detail": "PT frequency is risk-based. For systems directly reachable from the Internet, MAS expects PT at least once a year and after major changes. No frequency is set for adversarial attack simulation exercises.", "cite": "Para. 13.2.4", "url": "https://www.mas.gov.sg/-/media/mas/regulations-and-financial-stability/regulatory-and-supervisory-framework/risk-management/trm-guidelines-18-january-2021.pdf", "quote": "For systems directly accessible from the Internet, the FI is expected to conduct PT to validate the adequacy of the security controls at least once annually or whenever these systems undergo major changes or updates.", "confidence": "verified" }, "threat_intel": { "code": "recommended", "detail": "Scenarios should be challenging but plausible. Using threat intelligence to pick threat actors and TTPs is optional (\"could\").", "cite": "Para. 13.5.1 and 13.5.2", "url": "https://www.mas.gov.sg/-/media/mas/regulations-and-financial-stability/regulatory-and-supervisory-framework/risk-management/trm-guidelines-18-january-2021.pdf", "quote": "The FI could also design the exercise scenario by using threat intelligence that is relevant to their IT environment to identify threat actors who are most likely to pose a threat to the FI", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "Section 13 sets no tester certification, accreditation or independence rule. Para. 3.5.1 has a general expectation that staff, contractors and service providers are competent.", "cite": "No provision; full text reviewed (searched: CREST, certif, accredit, independent, qualified, tester); general competence expectation at para. 3.5.1", "url": "https://www.mas.gov.sg/-/media/mas/regulations-and-financial-stability/regulatory-and-supervisory-framework/risk-management/trm-guidelines-18-january-2021.pdf", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "Silent on whether testers or red teams must be internal or external.", "cite": "No provision; full text reviewed (searched: internal, external, in-house, independent)", "url": "https://www.mas.gov.sg/-/media/mas/regulations-and-financial-stability/regulatory-and-supervisory-framework/risk-management/trm-guidelines-18-january-2021.pdf", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "Scenario-based cyber exercises could include social engineering. Footnote 32 says adversarial attack simulation targets people, processes and technology.", "cite": "Para. 13.3.1 and footnote 32", "url": "https://www.mas.gov.sg/-/media/mas/regulations-and-financial-stability/regulatory-and-supervisory-framework/risk-management/trm-guidelines-18-january-2021.pdf", "quote": "These exercises could include social engineering", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "No physical intrusion testing. Physical security appears only as data centre controls (para. 8.5).", "cite": "No provision; full text reviewed (searched: physical, premises, tailgating, on-site); para. 8.5 is a control, not a test", "url": "https://www.mas.gov.sg/-/media/mas/regulations-and-financial-stability/regulatory-and-supervisory-framework/risk-management/trm-guidelines-18-january-2021.pdf", "confidence": "verified" }, "third_party": { "code": "permitted", "detail": "FIs should involve service providers in cyber exercises where the objectives call for it. The PT and AASE paragraphs do not bring third-party systems into test scope.", "cite": "Para. 13.3.2", "url": "https://www.mas.gov.sg/-/media/mas/regulations-and-financial-stability/regulatory-and-supervisory-framework/risk-management/trm-guidelines-18-january-2021.pdf", "quote": "the FI should involve relevant stakeholders, including senior management, business functions, corporate communications, crisis management team, service providers, and technical staff", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No OT testing. Internet of Things devices are covered as controls in para. 11.5 only.", "cite": "No provision; full text reviewed (searched: operational technology, industrial control, OT, SCADA); para. 11.5 IoT is a control, not a test", "url": "https://www.mas.gov.sg/-/media/mas/regulations-and-financial-stability/regulatory-and-supervisory-framework/risk-management/trm-guidelines-18-january-2021.pdf", "confidence": "verified" }, "payment_systems": { "code": "required", "detail": "MAS expects annual penetration testing of systems directly accessible from the Internet (para. 13.2.4, 'is expected to'), and para. 13.2.1 says PT of online financial services should combine blackbox and greybox testing. Para. 14.1.1 defines online financial services to include payment services provisioned via the Internet, so they fall inside the expected test. A guideline, not a binding rule (see legal_force).", "cite": "Para. 13.2.4; para. 13.2.1; para. 14.1.1", "url": "https://www.mas.gov.sg/-/media/mas/regulations-and-financial-stability/regulatory-and-supervisory-framework/risk-management/trm-guidelines-18-january-2021.pdf", "quote": "For systems that are directly accessible from the Internet, the FI is expected to conduct PT to validate the adequacy of the security controls at least once annually or whenever these systems undergo major changes or updates.", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "Section 13 does not mention cloud or SaaS.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, service provider) in Section 13", "url": "https://www.mas.gov.sg/-/media/mas/regulations-and-financial-stability/regulatory-and-supervisory-framework/risk-management/trm-guidelines-18-january-2021.pdf", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "No provision on tests across jurisdictions, foreign group entities or data location during testing.", "cite": "No provision; full text reviewed (searched: overseas, cross-border, jurisdiction, head office, group)", "url": "https://www.mas.gov.sg/-/media/mas/regulations-and-financial-stability/regulatory-and-supervisory-framework/risk-management/trm-guidelines-18-january-2021.pdf", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming or replay step.", "cite": "No provision; full text reviewed (searched: purple, replay, blue team)", "url": "https://www.mas.gov.sg/-/media/mas/regulations-and-financial-stability/regulatory-and-supervisory-framework/risk-management/trm-guidelines-18-january-2021.pdf", "confidence": "verified" }, "remediation_retest": { "code": "recommended", "detail": "A remediation process should track and resolve issues from assessments and exercises, with severity classification and a timeframe for each severity. No retest rule.", "cite": "Para. 13.6.1", "url": "https://www.mas.gov.sg/-/media/mas/regulations-and-financial-stability/regulatory-and-supervisory-framework/risk-management/trm-guidelines-18-january-2021.pdf", "quote": "A comprehensive remediation process should be established to track and resolve issues identified from the cyber security assessments or exercises.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "MAS does not run or receive tests under these Guidelines. Observance is weighed in supervision.", "cite": "Para. 2.2", "url": "https://www.mas.gov.sg/-/media/mas/regulations-and-financial-stability/regulatory-and-supervisory-framework/risk-management/trm-guidelines-18-january-2021.pdf", "quote": "In supervising an FI, the degree of observance with the spirit of the Guidelines by an FI is an area of consideration by MAS.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Addresses automated security testing in software delivery (DevSecOps, static and dynamic application security testing tools). It does not address automated or AI-driven penetration testing or red teaming, or testing of AI systems.", "cite": "Para. 6.3.1; Annex A, para. A.2", "url": "https://www.mas.gov.sg/-/media/mas/regulations-and-financial-stability/regulatory-and-supervisory-framework/risk-management/trm-guidelines-18-january-2021.pdf", "quote": "DevSecOps is the practice of automating and integrating IT operations, quality assurance and security practices in the software development process.", "confidence": "verified" } } }, { "id": "sg-csa-ccop-2026", "jurisdiction": "Singapore", "region": "Benchmark", "sector": "cross-sector", "name": "Cybersecurity Code of Practice for Critical Information Infrastructure 2026 (CCoP 2026, Release 1)", "short": "SG CSA CCoP 2026", "issuer": "Cyber Security Agency of Singapore (Commissioner of Cybersecurity)", "version": "2026-07-29", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://isomer-user-content.by.gov.sg/36/8b555ddb-16ab-486c-9fda-e12197a4e320/Cybersecurity%20Code%20of%20Practice%20(2026).pdf", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Binding code under the Cybersecurity Act 2018 for owners of designated critical information infrastructure, a class that covers banking, payments and market infrastructure and government e-services. It requires a red or purple team simulation at least every 24 months and annual penetration tests of IT systems. Release 1 took effect on July 29, 2026 and supersedes CCoP 2.0; the earlier editions were not in the September matrix.", "cells": { "legal_force": { "code": "mandatory", "detail": "Issued by the Commissioner of Cybersecurity under s. 35A of the Cybersecurity Act 2018. CII owners must comply; the Commissioner can issue a written direction under s. 12(1) for breaches. In force July 29, 2026; new clauses carry compliance dates of July 29, 2027 or December 31, 2027.", "cite": "CCoP 2026 cl. 1.1.1; 1.4.1; 1.4.7; Compliance Timeline", "url": "https://isomer-user-content.by.gov.sg/36/8b555ddb-16ab-486c-9fda-e12197a4e320/Cybersecurity%20Code%20of%20Practice%20(2026).pdf", "quote": "The CIIO must comply with this Code pursuant to section 35A(6) of the Act.", "confidence": "verified" }, "scope": { "code": "designated CII owners (banking, payments, markets, government e-services and other sectors)", "detail": "Applies to owners of computers designated as critical information infrastructure. The Act's First Schedule lists banking services, payments clearing and settlement, securities and derivatives trading and clearing, and electronic delivery of government services among the essential services (items 12 to 18, 42 and 43).", "cite": "CCoP 2026 cl. 1.3.1; Cybersecurity Act 2018 First Schedule items 12 to 18, 42 and 43 (https://sso.agc.gov.sg/Act/CA2018)", "url": "https://isomer-user-content.by.gov.sg/36/8b555ddb-16ab-486c-9fda-e12197a4e320/Cybersecurity%20Code%20of%20Practice%20(2026).pdf", "quote": "This Code is intended to specify the minimum requirements that the CIIO shall implement to ensure the cybersecurity of its CII and CII interconnected systems.", "confidence": "verified" }, "frequency": { "code": "red or purple team every 24 months; pen test and vulnerability assessment every 12 months (IT), 24 months (OT)", "detail": "Red or purple team attack simulation at least every 24 months; penetration test and vulnerability assessment at least every 12 months for IT CII and 24 months for OT CII, plus after major system changes; threat hunting every 24 months; scenario-based exercises every 12 months. The compliance timeline does not list 5.14 to 5.16 as new requirements.", "cite": "CCoP 2026 cl. 5.16.2; 5.15.1; 5.15.2; 5.14.3; 6.3.1; 7.3.4; Compliance Timeline", "url": "https://isomer-user-content.by.gov.sg/36/8b555ddb-16ab-486c-9fda-e12197a4e320/Cybersecurity%20Code%20of%20Practice%20(2026).pdf", "quote": "The CIIO shall conduct a red teaming or purple teaming attack simulation on its CII at least once every 24 months to test and validate the effectiveness of its cybersecurity measures against prevalent cybersecurity threats.", "confidence": "verified" }, "threat_intel": { "code": "required", "detail": "Scenario-based exercises must be built with threat modelling and must test responses to threats identified through threat intelligence (7.3.5(a)). Owners must run processes to obtain and analyse threat intelligence (6.4.1). The red or purple team clause asks only for testing \"against prevalent cybersecurity threats\" (5.16.2). The sector threat profile sentence sits in the 7.3 preamble, which is not binding (1.2.7).", "cite": "CCoP 2026 cl. 7.3.5(a); 6.4.1; 5.16.2; 1.2.7", "url": "https://isomer-user-content.by.gov.sg/36/8b555ddb-16ab-486c-9fda-e12197a4e320/Cybersecurity%20Code%20of%20Practice%20(2026).pdf", "quote": "These scenarios shall be designed to test and validate: (a) the effectiveness and timeliness of responses to threats and vulnerabilities identified through threat intelligence and risk assessments;", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Third-party penetration testing firms must hold industry-recognised accreditation and their testers industry-recognised certification; the Code gives CREST 'or equivalent' as an example. Third-party tests must run under the CII owner's supervision. No provider rule for red or purple team providers.", "cite": "CCoP 2026 cl. 5.15.3(a) to (b); 5.15.4", "url": "https://isomer-user-content.by.gov.sg/36/8b555ddb-16ab-486c-9fda-e12197a4e320/Cybersecurity%20Code%20of%20Practice%20(2026).pdf", "quote": "The CIIO shall ensure that third-party penetration testing service providers and their penetration testers who are performing penetration tests on a CII possess industry-recognised accreditations and certifications respectively", "confidence": "verified" }, "internal_testers": { "code": "not_addressed", "detail": "The provider rule in 5.15.3 applies only to third-party providers. The Code does not say whether in-house teams may run penetration tests or attack simulations.", "cite": "No provision; full text reviewed (searched: internal, in-house, independent, third-party)", "url": "https://isomer-user-content.by.gov.sg/36/8b555ddb-16ab-486c-9fda-e12197a4e320/Cybersecurity%20Code%20of%20Practice%20(2026).pdf", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "Scenario-based exercises may include social engineering. Awareness is measured through means such as quizzes and surveys (9.1.2), not phishing tests.", "cite": "CCoP 2026 cl. 1.2.1 (definition of 'scenario-based cybersecurity exercise'); 9.1.2", "url": "https://isomer-user-content.by.gov.sg/36/8b555ddb-16ab-486c-9fda-e12197a4e320/Cybersecurity%20Code%20of%20Practice%20(2026).pdf", "quote": "Depending on the nature of the threats, CIIO may include social engineering and cyber range components in these scenarios.", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "'Physical sites' is defined only as locations hosting the CII. No physical intrusion test or physical controls test.", "cite": "No provision; full text reviewed (searched: physical security, premises, tailgating, on-site)", "url": "https://isomer-user-content.by.gov.sg/36/8b555ddb-16ab-486c-9fda-e12197a4e320/Cybersecurity%20Code%20of%20Practice%20(2026).pdf", "confidence": "verified" }, "third_party": { "code": "assurance_only", "detail": "Tests cover the CII; exercises must also cover interconnected systems and involve external parties. Supplier systems are reached through contract terms giving audit rights or the supplier's own audit report, and processes to validate compliance.", "cite": "CCoP 2026 cl. 3.10.3(c); 3.10.4; 7.3.6; 7.3.7(e)", "url": "https://isomer-user-content.by.gov.sg/36/8b555ddb-16ab-486c-9fda-e12197a4e320/Cybersecurity%20Code%20of%20Practice%20(2026).pdf", "quote": "The rights of the CIIO to commission an audit of the external party’s cybersecurity posture in relation to the outsourced functions, activities or operations", "confidence": "verified" }, "ot": { "code": "required", "detail": "OT CII must have a vulnerability assessment and a penetration test at least every 24 months, the first within 12 months of the compliance date. Section 10 adds OT architecture controls.", "cite": "CCoP 2026 cl. 5.14.3(b); 5.15.1(b); s. 10", "url": "https://isomer-user-content.by.gov.sg/36/8b555ddb-16ab-486c-9fda-e12197a4e320/Cybersecurity%20Code%20of%20Practice%20(2026).pdf", "quote": "for a CII which is an OT system - at least once every 24 months, with the first instance to be completed no later than 12 months after the Compliance Date.", "confidence": "verified" }, "payment_systems": { "code": "required", "detail": "Every testing clause applies to all designated CII. The Act lists payments clearing and settlement, securities and derivatives clearing and settlement, and banking payment services as essential services whose computers can be designated.", "cite": "CCoP 2026 cl. 5.15.1; 5.16.2; Cybersecurity Act 2018 First Schedule items 12 to 15 (https://sso.agc.gov.sg/Act/CA2018)", "url": "https://isomer-user-content.by.gov.sg/36/8b555ddb-16ab-486c-9fda-e12197a4e320/Cybersecurity%20Code%20of%20Practice%20(2026).pdf", "quote": "Payments clearing and settlement services", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "Cloud-hosted CII stays the owner's responsibility and needs a risk assessment sent to the Commissioner before go-live, but no clause names cloud or SaaS in the test scope. CSA said a separate CCoP (Cloud) will launch in the second half of 2026 (watch list).", "cite": "CCoP 2026 cl. 3.9.1 to 3.9.3 (searched: cloud, SaaS, test)", "url": "https://isomer-user-content.by.gov.sg/36/8b555ddb-16ab-486c-9fda-e12197a4e320/Cybersecurity%20Code%20of%20Practice%20(2026).pdf", "quote": "The CIIO shall remain responsible and accountable for maintaining oversight of the cybersecurity of the CII and for managing cybersecurity risks to the CII, even when the CII is wholly or partly implemented on cloud computing systems.", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "Part 3 of the Act, on provider-owned CII, applies to CII located wholly or partly in Singapore (s. 3(1)), and the Commissioner may designate systems located wholly outside Singapore that a person in Singapore owns (s. 3(1A), s. 7(1A)). The Code also makes a cloud provider supporting CII appoint a person in Singapore to accept legal service (cl. 3.9.4). No provision on offshore testers or on recognising tests run abroad.", "cite": "Cybersecurity Act 2018 s. 3(1) and (1A); CCoP 2026 cl. 3.9.4", "url": "https://sso.agc.gov.sg/Act/CA2018", "quote": "Part 3 (except sections 7(1A) and 8) applies to any provider-owned critical information infrastructure located wholly or partly in Singapore.", "confidence": "verified" }, "purple_replay": { "code": "recommended", "detail": "The owner may meet the 24-month duty with a purple team instead of a red team (5.16.2), so purple teaming is an option, not a duty. Red or purple team plans must include a \"blue team report and reconciliation\" stage (5.16.1(c)). No clause requires a joint replay or purple session.", "cite": "CCoP 2026 cl. 5.16.2; 5.16.1(c); 1.2.1 (definition of \"purple teaming\"). Compare ABS AASE (September 2024) Sec. 7.4.2 Reconciliation and 7.4.3 Attack/Defence Joint Replay.", "url": "https://isomer-user-content.by.gov.sg/36/8b555ddb-16ab-486c-9fda-e12197a4e320/Cybersecurity%20Code%20of%20Practice%20(2026).pdf", "quote": "The CIIO shall conduct a red teaming or purple teaming attack simulation on its CII at least once every 24 months", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "All vulnerabilities must be remediated in a timely manner, by risk. Reports sent on request must come with remediation plans. No retest duty is stated.", "cite": "CCoP 2026 cl. 5.14.2; 5.15.5; 5.16.3; 2.1", "url": "https://isomer-user-content.by.gov.sg/36/8b555ddb-16ab-486c-9fda-e12197a4e320/Cybersecurity%20Code%20of%20Practice%20(2026).pdf", "quote": "The CIIO shall remediate all cybersecurity vulnerabilities in a timely manner, with priority given to vulnerabilities that pose a greater risk to the security or operations of the CII.", "confidence": "verified" }, "regulator_role": { "code": "receives_results", "detail": "The Commissioner may request vulnerability assessment, penetration test, attack simulation, threat hunting and exercise reports, due within 30 working days or 30 days. The Commissioner also runs national exercises under s. 16 of the Act.", "cite": "CCoP 2026 cl. 5.14.5; 5.15.5; 5.16.3; 6.3.4; 7.3.8; 7.3.9", "url": "https://isomer-user-content.by.gov.sg/36/8b555ddb-16ab-486c-9fda-e12197a4e320/Cybersecurity%20Code%20of%20Practice%20(2026).pdf", "quote": "The CIIO shall, if requested by the Commissioner, submit a copy of the report of any completed red teaming or purple teaming attack simulation, along with the CIIO’s remediation plans, to the Commissioner within 30 working days of receiving the request.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Annex A guidance for enterprise systems suggests breach and attack simulation that runs continuously and automatically. No rule on tests run by AI agents. CSA said on July 22, 2026 that further technical guidance on adversarial attack simulation, penetration testing and threat hunting will follow later in 2026.", "cite": "CCoP 2026 Annex A ('Breach Attack Simulation')", "url": "https://isomer-user-content.by.gov.sg/36/8b555ddb-16ab-486c-9fda-e12197a4e320/Cybersecurity%20Code%20of%20Practice%20(2026).pdf", "quote": "The CIIO should conduct Breach and Attack Simulation to continuously and automatically simulate real-world attack scenarios against the CIIO’s defences to identify gaps.", "confidence": "verified" } } }, { "id": "sg-mas-ai-rm", "jurisdiction": "Singapore", "region": "Benchmark", "sector": "financial", "name": "Guidelines on Artificial Intelligence Risk Management", "short": "SG MAS AI RM Guidelines", "issuer": "Monetary Authority of Singapore (MAS)", "version": "2026-10-07", "status": "Not yet in force: finalized October 7, 2026, takes effect October 7, 2027 and Sections 5 and 6 by October 7, 2028 (para. 1.8); added to the set on 2026-10-30", "public": "full", "primary_url": "https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Finalized on October 7, 2026 after a November 2025 consultation. MAS lists vulnerability assessments, penetration tests and red teaming across AI systems, including supplier AI, among the key areas financial institutions should consider before deploying AI. Section 5 applies from October 7, 2028.", "cells": { "legal_force": { "code": "supervisory_expectation", "detail": "Guidelines that set MAS supervisory expectations. They take effect on October 7, 2027; FIs have until October 7, 2028 to meet Section 5, which holds the security testing expectation.", "cite": "Guidelines para. 1.1; 1.8", "url": "https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf", "quote": "These Guidelines take effect on 7 October 2027. FIs may meet the expectations set out in Sections 3 to 4 from 7 October 2027, and Section 5 and 6 of the Guidelines by 7 October 2028.", "confidence": "verified" }, "scope": { "code": "all MAS-regulated FIs that use AI, proportionate", "detail": "All financial institutions as defined in the Financial Services and Markets Act 2022, applied in proportion to size and risk. An FI whose AI use is unlikely to have a material adverse impact may apply basic governance only (2.3 to 2.5). For other FIs, footnote 12 says cybersecurity life cycle controls stay relevant even for low-risk AI.", "cite": "Guidelines para. 2.1; 2.3; footnote 12", "url": "https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf", "quote": "The Guidelines apply to all FIs in a proportionate manner, according to their size and risk profile.", "confidence": "verified" }, "frequency": { "code": "before deployment; then risk-based re-validation", "detail": "Security testing sits in the technology and cybersecurity review before an AI system goes into production. High-materiality AI is re-validated regularly by independent parties. No fixed interval.", "cite": "Guidelines para. 5.22; 5.24", "url": "https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf", "quote": "An FI should conduct technology and cybersecurity reviews to ensure that AI can be deployed into the production environment in a controlled and secure manner.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Para. 5.22(b) names threat classes to test against (manipulation, evasion, poisoning) but does not require threat intelligence to shape tests.", "cite": "No provision; full text reviewed (searched: threat intelligence, intelligence-led, threat-led, scenario)", "url": "https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "No accreditation or qualification rule for security testers. A separate rule requires high-materiality AI to be validated before deployment by competent personnel independent of development and deployment (5.19); that rule covers validators, not security testers.", "cite": "No provision for security testers; full text reviewed (searched: accredit, certif, qualified, CREST, tester); para. 5.19 for validators", "url": "https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "The text assumes in-house testing of AI and asks FIs to consider giving training and testing to different teams. It does not say who runs the security tests in 5.22(b).", "cite": "Guidelines para. 5.16(b)", "url": "https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf", "quote": "Separation of duties, such as assigning different teams to train and test the AI systems, should also be considered.", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: social engineering, phishing, impersonation)", "url": "https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: physical, premises)", "url": "https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf", "confidence": "verified" }, "third_party": { "code": "permitted", "detail": "The FI should ensure that third-party AI is reviewed, including by testing third-party AI services in its own use cases with its own data and by compensatory testing where providers disclose too little (para. 5.10). Para. 5.22(b) lists vulnerability assessments, penetration testing and red teaming across AI systems, which footnote 10 extends to supplier AI, among areas the FI should consider. Coded permitted under R3: guideline 'should' on a seam dimension.", "cite": "Guidelines para. 5.10; 5.22(b); footnote 10", "url": "https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf", "quote": "The FI should ensure that AI developed by third parties are subject to appropriate reviews, which include testing third-party AI services in the context of the FI’s use cases (including using the FI’s own data), and performing compensatory testing", "confidence": "verified", "harmonized_from": "required", "harmonize_reason": "R3: Para. 5.10 says the FI 'should ensure' third-party AI is reviewed and tested; guideline 'should' is permitted on the seam dimensions." }, "ot": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: operational technology, OT, industrial, SCADA)", "url": "https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: payment, settlement, card)", "url": "https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "Third-party AI services are covered under third_party. The text does not name cloud or SaaS.", "cite": "No provision; full text reviewed (searched: cloud, SaaS, hosting)", "url": "https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "Applies on a group basis to locally incorporated FIs under consolidated supervision or owning CII. An FI in a global group may rely on group frameworks that meet the guidelines.", "cite": "Guidelines para. 1.2; 1.5", "url": "https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf", "quote": "An FI which is part of a global group may take guidance from or leverage their Group’s AI risk management frameworks, as long as those frameworks meet the expectations set out in these Guidelines.", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: purple, replay, blue team)", "url": "https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf", "confidence": "verified" }, "remediation_retest": { "code": "recommended", "detail": "Testing is meant \"to identify and remediate security weaknesses\" (5.22(b)), and pre-deployment review findings and remediation actions go to the approval body, which should see them actioned (5.21). No remediation plan, deadline or retest is set for security test findings.", "cite": "Guidelines para. 5.22(b); 5.21", "url": "https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf", "quote": "Conduct vulnerability assessments, penetration testing, and red teaming across AI systems to identify and remediate security weaknesses.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "Supervisory expectations; no duty to send test results to MAS. MAS said on October 7, 2026 that it intends to consult in 2027 on further guidance on agentic AI.", "cite": "Guidelines para. 1.1", "url": "https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf", "quote": "These Guidelines set out MAS’ supervisory expectations in the areas of oversight, key AI risk management systems, policies, procedures, AI life cycle controls, and capabilities and capacity for the use of AI.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Lists vulnerability assessments, penetration testing and red teaming across AI systems, and testing against adversarial threats such as manipulation, evasion and poisoning, among the key areas an FI should consider in its pre-deployment cybersecurity reviews (5.22(b)). Testing of generative AI and AI agents should cover failure modes and guardrails (5.15). No rules for tests run by AI agents.", "cite": "Guidelines para. 5.22(b); 5.15; 5.14(b)", "url": "https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf", "quote": "Evaluation and testing of newer AI developments such as Generative AI and AI agents should cover their key failure modes and the effectiveness of associated guardrails", "confidence": "verified" } } }, { "id": "au-cfr-corie", "jurisdiction": "Australia", "region": "Benchmark", "sector": "financial", "name": "Cyber Operational Resilience Intelligence-led Exercises (CORIE) Framework, Program Guide for Financial Institutions (including Financial Market Infrastructure) in Australia", "short": "AU CFR CORIE v2.0", "issuer": "Council of Financial Regulators (APRA, ASIC, RBA, Treasury)", "version": "Version 2.0, July 2022, with Appendix B Provider Guide Version 2.0. Both PDFs byte-identical to the 2026-09-28 copies.", "status": "In use as of 2026-09-28. The CFR approved expansion of the program in its March 2024 quarterly statement, described ongoing CORIE cyber stress testing over 2025, and listed CORIE among joint initiatives for the year ahead in its March 23, 2026 statement. No version later than 2.0 found on cfr.gov.au.", "public": "full", "primary_url": "https://www.cfr.gov.au/publications/policy-statements-and-other-reports/2022/revised-corie-framework-rollout/pdf/corie-framework.pdf", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No change. CFR statements of June 23, September 3 and October 1, 2026 discuss frontier AI and cyber risk but announce no CORIE change. The September 3 statement says a Payments Crisis Coordination Framework (RBA and the National Office of Cyber Security) 'will be published shortly'; it is a crisis coordination document, not a testing rule." }, "notes": "Tier parameters: Tier 1 runs 3 scenarios (one generic from the CTC) against 2 critical business services over a 5 to 9 month test phase; Tier 2 runs 1 scenario over 4 to 6 months; Tier 3 runs 1 CTC generic scenario over 4 to 5 months (Sec. 5.7.1). Closure phase is typically 5 weeks (Sec. 5.9). The guide says CORIE is not a pass or fail test and not a benchmarking tool (Sec. 1). The provider guide allowed certification exemptions during the pilot (Provider Guide footnotes 3 and 4). CFR statements: expansion approved (media release 2024-01, March 2024); ongoing cyber stress testing through CORIE over 2025 (CFR initiatives on systemic risks, 2025); CORIE listed among joint initiatives for the year ahead (media release 2026-02, March 23, 2026). Number of FIs tested is not published in the documents read. Coding note: most CORIE text uses \"should\"; cells use required only where the text says \"must\" or \"required\".", "cells": { "legal_force": { "code": "supervisory_expectation", "detail": "A program run by the CFR agencies. FIs join by invitation, and the relevant regulator proposes exercise type and frequency. The guide cites no statutory power and no penalty for declining.", "cite": "Sec. 2.1; Sec. 4.2", "url": "https://www.cfr.gov.au/publications/policy-statements-and-other-reports/2022/revised-corie-framework-rollout/pdf/corie-framework.pdf", "quote": "In implementation, CORIE involves an invitation of participation sent to FIs. Each time the CFR will invite a new group of FI to participate.", "confidence": "verified" }, "scope": { "code": "invited FIs and FMIs, tiered", "detail": "FIs, including financial market infrastructure, regulated by a CFR member. A Cyber Risk Assessment places each FI in Tier 1 to 4; Tiers 1 to 3 run a red team exercise and Tier 4 covers all other CFR-regulated FIs, which run purple and gold exercises only. The 2021 pilot used a small number of systemically important FIs.", "cite": "Sec. 3; Sec. 4.1; Sec. 5.7.1.1 to 5.7.1.4", "url": "https://www.cfr.gov.au/publications/policy-statements-and-other-reports/2022/revised-corie-framework-rollout/pdf/corie-framework.pdf", "quote": "Tier 4 – all other FIs regulated by a member of the CFR.", "confidence": "verified" }, "frequency": { "code": "set by regulator per tier", "detail": "The relevant regulator proposes red team frequency using the Cyber Risk Assessment. Purple and gold exercises should be completed annually by Tier 1 to 3 FIs, and are annual activities for Tier 4.", "cite": "Sec. 2.1; Sec. 3; Sec. 2.5; Sec. 5.7.1.4", "url": "https://www.cfr.gov.au/publications/policy-statements-and-other-reports/2022/revised-corie-framework-rollout/pdf/corie-framework.pdf", "quote": "The relevant Regulator will assess the risk an FI poses to the stability of the Australian financial markets and financial system, and will propose the following in a structured and defined way:", "confidence": "verified" }, "threat_intel": { "code": "required", "detail": "Red team scenarios must come from the threat intelligence provider or from CTC-supplied scenarios. Provider threat intelligence is required for the top tiers; Tier 3 uses CTC generic intelligence.", "cite": "Sec. 5.5; Sec. 5.8.1.1; Sec. 5.7.1", "url": "https://www.cfr.gov.au/publications/policy-statements-and-other-reports/2022/revised-corie-framework-rollout/pdf/corie-framework.pdf", "quote": "Red Team scenarios must be based on threat scenarios identified by the Threat Intelligence Provider, or those provided by the CTC.", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Providers must meet minimum standards that the CTC assesses. The Provider Guide lists required certifications: Red Team Lead needs CREST CCSAM or SANS SEC564/565 plus one of CCSAS, CCT Inf, OSCE/OSCE3 or GXPN, and 7 years experience; Threat Intelligence Lead needs CREST CCTIM or GIAC GCTI. Background checks on provider staff are expected.", "cite": "Sec. 5.7.1; Sec. 4.4.1; Provider Guide Sec. 2.1.1.3 and 2.2.1.5", "url": "https://www.cfr.gov.au/publications/policy-statements-and-other-reports/2022/revised-corie-framework-rollout/pdf/corie-framework.pdf", "quote": "Threat Intelligence and Red Team Providers must meet the standards set out in this Guide.", "confidence": "verified" }, "internal_testers": { "code": "not_allowed", "detail": "The red team exercise must use an external provider. Internal teams that meet the provider standards may run the purple and gold exercises.", "cite": "Sec. 1.2; Sec. 2.5; Sec. 6.1", "url": "https://www.cfr.gov.au/publications/policy-statements-and-other-reports/2022/revised-corie-framework-rollout/pdf/corie-framework.pdf", "quote": "Only Red Team exercises require an external provider. Purple and Gold exercises can be performed with internal resources if preferred.", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "Red team providers should be able to do social engineering, and the worked scenarios use phishing, spear phishing and malicious media drops. Use depends on the threat intelligence.", "cite": "Sec. 2.4; Sec. 5.2.1.3; Sec. 5.2.2.3", "url": "https://www.cfr.gov.au/publications/policy-statements-and-other-reports/2022/revised-corie-framework-rollout/pdf/corie-framework.pdf", "quote": "capable of performing management, OSINT, reconnaissance, surveillance, cyber-attack simulation, social engineering, physical breach, and reporting", "confidence": "verified" }, "physical": { "code": "permitted", "detail": "Physical breach is a required provider skill, and a worked scenario simulates physical proximity attacks on offices and staff, wireless attacks and stolen devices.", "cite": "Sec. 2.4; Sec. 5.2.2.3; Sec. 5.2.3.3", "url": "https://www.cfr.gov.au/publications/policy-statements-and-other-reports/2022/revised-corie-framework-rollout/pdf/corie-framework.pdf", "quote": "Scenario simulates close physical proximity attacks on FI’s offices and staff, attempts to gain corporate network access to deploy ransomware.", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "Business services are defined as people, processes and technology, but the guide does not address suppliers, outsourced or critical third-party systems in test scope.", "cite": "No provision; full text reviewed (searched: third party, supplier, service provider, outsourc, supply chain)", "url": "https://www.cfr.gov.au/publications/policy-statements-and-other-reports/2022/revised-corie-framework-rollout/pdf/corie-framework.pdf", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No mention of operational technology.", "cite": "No provision; full text reviewed (searched: operational technology, industrial, SCADA, OT)", "url": "https://www.cfr.gov.au/publications/policy-statements-and-other-reports/2022/revised-corie-framework-rollout/pdf/corie-framework.pdf", "confidence": "verified" }, "payment_systems": { "code": "permitted", "detail": "Two of three worked scenarios target payment systems (fraudulent payment initiation, card holder data theft). FMIs are in scope of the program.", "cite": "Sec. 5.2.1; Sec. 5.2.3", "url": "https://www.cfr.gov.au/publications/policy-statements-and-other-reports/2022/revised-corie-framework-rollout/pdf/corie-framework.pdf", "quote": "Threat Intelligence has identified an adversary, Nation State 1 (NS1), targeting regional FI’s PS1 to initiate fraudulent payment transactions.", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "No mention of cloud or SaaS.", "cite": "No provision; full text reviewed (searched: cloud, SaaS)", "url": "https://www.cfr.gov.au/publications/policy-statements-and-other-reports/2022/revised-corie-framework-rollout/pdf/corie-framework.pdf", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "Providers and testers need not be in Australia. FIs should decide whether data sovereignty or resourcing policy requires locally based teams. A worked scenario covers staff of an overseas office.", "cite": "Sec. 5.7.2; Provider Guide Sec. 1; Sec. 5.2.3", "url": "https://www.cfr.gov.au/publications/policy-statements-and-other-reports/2022/revised-corie-framework-rollout/pdf/corie-framework.pdf", "quote": "Providers, and their testers, are not required to be physically located in Australia to participate in exercises.", "confidence": "verified" }, "purple_replay": { "code": "recommended", "detail": "Replay attacks are Stage 6 of every red team exercise. A separate purple exercise should be completed annually by Tier 1 to 3 FIs (10 to 20 days).", "cite": "Sec. 5.1; Sec. 5.9.2; Sec. 6", "url": "https://www.cfr.gov.au/publications/policy-statements-and-other-reports/2022/revised-corie-framework-rollout/pdf/corie-framework.pdf", "quote": "A Purple Exercise should be completed by Tier 1, 2 and 3 FIs annually.", "confidence": "verified" }, "remediation_retest": { "code": "recommended", "detail": "The FI prepares a remediation plan, shares it with the CFR and the relevant regulator, and updates it after replay attacks. The regulator and CTC track remediation of important weaknesses. No deadlines or formal retest.", "cite": "Sec. 5.1; Sec. 2.1; Sec. 5.9.1.3; Sec. 5.9.2", "url": "https://www.cfr.gov.au/publications/policy-statements-and-other-reports/2022/revised-corie-framework-rollout/pdf/corie-framework.pdf", "quote": "To complete the Closure Phase, the FI details a remediation plan and provides an outline to the CFR via the CTC.", "confidence": "verified" }, "regulator_role": { "code": "leads_or_oversees_test", "detail": "CORIE Team Coordinators from CFR agencies manage exercises: they approve critical business services, review scenarios, receive threat intelligence and execution reports, and check provider standards. Regulators track remediation and use results to find systemic weaknesses.", "cite": "Sec. 1; Sec. 2.1; Sec. 4.4", "url": "https://www.cfr.gov.au/publications/policy-statements-and-other-reports/2022/revised-corie-framework-rollout/pdf/corie-framework.pdf", "quote": "The CTC will manage Exercises on behalf of the CFR with a view to ensuring they are:", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Mentions continuous red teaming only as part of existing testing programs that FIs should keep. No provision on automated or AI-driven testing or on testing AI systems.", "cite": "Sec. 1", "url": "https://www.cfr.gov.au/publications/policy-statements-and-other-reports/2022/revised-corie-framework-rollout/pdf/corie-framework.pdf", "quote": "CORIE complements traditional security testing programs, such as vulnerability assessments, penetration testing and continuous red teaming", "confidence": "verified" } } }, { "id": "au-apra-cps-234", "jurisdiction": "Australia", "region": "Benchmark", "sector": "financial", "name": "Prudential Standard CPS 234 Information Security (testing control effectiveness), with Prudential Practice Guide CPG 234", "short": "AU APRA CPS 234", "issuer": "Australian Prudential Regulation Authority (APRA)", "version": "CPS 234 July 2019 (commenced July 1, 2019); CPG 234 June 2019. Both PDFs byte-identical; APRA CPS 234 page text unchanged apart from menu labels.", "status": "In force as of 2026-09-28. The APRA CPS 234 page (retrieved 2026-09-28) shows the 2019 instrument as current and lists CPG 234 (June 1, 2019) as current guidance. No 2025 or 2026 amendment to CPS 234 found.", "public": "full", "primary_url": "https://www.apra.gov.au/sites/default/files/cps_234_july_2019_for_public_release.pdf", "checked": "2026-10-30", "recheck": { "date": "2026-10-30", "outcome": "unchanged", "note": "No change to CPS 234 or CPG 234; no APRA consultation on CPS 234 found. APRA's Letter to Industry on AI (April 30, 2026) sets testing expectations on top of CPS 234 and is coded below as a new instrument. The APRA and ASIC release of August 27, 2026 on frontier AI roundtables sets no testing duty." }, "notes": "Coded because para. 27 to 31 impose a binding testing duty. It is not a threat-led red team regime: CPG 234 Attachment G mentions \"red team\" tests only as an example approach for detection controls. Vendor summaries often say CPS 234 requires testing \"at least annually\"; the binding annual duty in para. 31 is to review the testing program, and the annual testing figure comes from non-binding CPG 234. Para. 26 separately requires annual review and testing of information security response plans. APRA is a CFR member and takes part in CORIE (row au-cfr-corie).", "cells": { "legal_force": { "code": "mandatory", "detail": "A prudential standard made under the Banking Act 1959, Insurance Act 1973, Life Insurance Act 1995, PHIPS Act 2015 and SIS Act 1993. CPG 234 is non-binding guidance.", "cite": "CPS 234 para. 1 and para. 27", "url": "https://www.apra.gov.au/sites/default/files/cps_234_july_2019_for_public_release.pdf", "quote": "An APRA-regulated entity must test the effectiveness of its information security controls through a systematic testing program.", "confidence": "verified" }, "scope": { "code": "all APRA-regulated entities", "detail": "ADIs (including foreign ADIs for Australian branch operations), general insurers, life companies, private health insurers and RSE licensees.", "cite": "CPS 234 para. 2 and 3", "url": "https://www.apra.gov.au/sites/default/files/cps_234_july_2019_for_public_release.pdf", "quote": "This Prudential Standard applies to all ‘APRA-regulated entities’", "confidence": "verified" }, "frequency": { "code": "risk-based; program reviewed annually", "detail": "Test nature and frequency must match threat change, asset criticality, incident consequences, exposure to untrusted environments and change. The program must be reviewed at least annually. CPG 234 says a sufficient set of controls would be tested at least annually.", "cite": "CPS 234 para. 27 and 31; CPG 234 \"Systematic testing program\"", "url": "https://www.apra.gov.au/sites/default/files/cps_234_july_2019_for_public_release.pdf", "quote": "An APRA-regulated entity must review the sufficiency of the testing program at least annually or when there is a material change to information assets or the business environment.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "No requirement that threat intelligence drive test scenarios. Para. 27(a) ties test nature and frequency to how fast vulnerabilities and threats change.", "cite": "No provision; full text reviewed (searched: threat intelligence, scenario, intelligence-led); para. 27(a) links frequency to threat change", "url": "https://www.apra.gov.au/sites/default/files/cps_234_july_2019_for_public_release.pdf", "confidence": "verified" }, "provider_requirements": { "code": "required", "detail": "Testers must be appropriately skilled and functionally independent. No named certification.", "cite": "CPS 234 para. 30", "url": "https://www.apra.gov.au/sites/default/files/cps_234_july_2019_for_public_release.pdf", "quote": "An APRA-regulated entity must ensure that testing is conducted by appropriately skilled and functionally independent specialists.", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "Internal testers are allowed if functionally independent. CPG 234 says testers should not have operational responsibility for the controls they test.", "cite": "CPS 234 para. 30; CPG 234 \"Independence of testers\"", "url": "https://www.apra.gov.au/sites/default/files/cpg_234_information_security_june_2019_0.pdf", "quote": "This includes the use of testers who do not have operational responsibility for the controls being validated.", "confidence": "verified" }, "social_engineering": { "code": "permitted", "detail": "CPG 234 (guidance) lists social engineering tests as an example approach for access controls.", "cite": "CPG 234 Attachment G", "url": "https://www.apra.gov.au/sites/default/files/cpg_234_information_security_june_2019_0.pdf", "quote": "Social engineering test", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Physical security appears in CPG 234 as a control tested by social engineering tests; physical intrusion testing is not named.", "cite": "No provision; full text reviewed (searched: physical, premises, on-site) in testing provisions; CPG 234 Attachment G lists physical security as a control", "url": "https://www.apra.gov.au/sites/default/files/cpg_234_information_security_june_2019_0.pdf", "confidence": "verified" }, "third_party": { "code": "assurance_only", "detail": "Where third or related parties manage information assets and the entity relies on their testing, it must assess whether that testing meets para. 27(a) to (e). Footnote 12 extends this to all such assets, not only outsourced material business activities.", "cite": "CPS 234 para. 28 and footnote 12", "url": "https://www.apra.gov.au/sites/default/files/cps_234_july_2019_for_public_release.pdf", "quote": "the APRA-regulated entity must assess whether the nature and frequency of testing of controls in respect of those information assets is commensurate with paragraphs 27(a) to 27(e)", "confidence": "verified", "harmonized_from": "required", "harmonize_reason": "Para. 28: the entity must assess the third party's own testing." }, "ot": { "code": "not_addressed", "detail": "No mention of operational technology.", "cite": "No provision; full text reviewed (searched: operational technology, industrial, SCADA, OT)", "url": "https://www.apra.gov.au/sites/default/files/cps_234_july_2019_for_public_release.pdf", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "Testing provisions do not name payment systems.", "cite": "No provision; full text reviewed (searched: payment, SWIFT, card)", "url": "https://www.apra.gov.au/sites/default/files/cps_234_july_2019_for_public_release.pdf", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "Cloud is not named in testing provisions. Para. 27(d) covers exposure to untrusted environments, which CPG 234 footnote 7 describes as the internet and connections to service providers and customers.", "cite": "No provision; full text reviewed (searched: cloud, SaaS); para. 27(d) untrusted environments", "url": "https://www.apra.gov.au/sites/default/files/cps_234_july_2019_for_public_release.pdf", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "For foreign ADIs the standard applies only to Australian branch operations. A Head of a group must apply the requirements across the group, including entities that are not APRA-regulated.", "cite": "CPS 234 para. 3 and 4", "url": "https://www.apra.gov.au/sites/default/files/cps_234_july_2019_for_public_release.pdf", "quote": "The obligations imposed by this Prudential Standard on, or in relation to, a foreign ADI, a Category C insurer or an EFLIC apply only in relation to the Australian branch operations of that entity.", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No purple teaming or replay.", "cite": "No provision; full text reviewed (searched: purple, replay, red team) in CPS 234; CPG 234 mentions red team tests only as an example technique", "url": "https://www.apra.gov.au/sites/default/files/cps_234_july_2019_for_public_release.pdf", "confidence": "verified" }, "remediation_retest": { "code": "required", "detail": "Deficiencies that cannot be remediated in time must be escalated to the Board or senior management, and material weaknesses that cannot be fixed in time must be notified to APRA within 10 business days. CPG 234 says success criteria should define when re-testing is needed.", "cite": "CPS 234 para. 29 and 36; CPG 234 \"Systematic testing program\"", "url": "https://www.apra.gov.au/sites/default/files/cps_234_july_2019_for_public_release.pdf", "quote": "An APRA-regulated entity must escalate and report to the Board or senior management any testing results that identify information security control deficiencies that cannot be remediated in a timely manner.", "confidence": "verified" }, "regulator_role": { "code": "receives_results", "detail": "APRA does not run tests. It must be notified of material control weaknesses the entity expects it cannot remediate in time.", "cite": "CPS 234 para. 36", "url": "https://www.apra.gov.au/sites/default/files/cps_234_july_2019_for_public_release.pdf", "quote": "An APRA-regulated entity must notify APRA as soon as possible and, in any case, no later than 10 business days, after it becomes aware of a material information security control weakness", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "CPG 234 lists automated techniques such as chaos monkey testing, fuzzing and vulnerability scans, and says controls exposed to untrusted environments would typically be tested throughout the year. No provision on AI-driven testing or testing AI systems.", "cite": "CPG 234 Attachment G; CPG 234 \"Systematic testing program\"", "url": "https://www.apra.gov.au/sites/default/files/cpg_234_information_security_june_2019_0.pdf", "quote": "Chaos monkey testing", "confidence": "verified" } } }, { "id": "au-apra-ai-letter-2026", "jurisdiction": "Australia", "region": "Benchmark", "sector": "financial", "name": "APRA Letter to Industry on Artificial Intelligence (AI), with attachment 'AI Supervisory Engagement Debrief: Observations for Executive Management'", "short": "AU APRA AI letter 2026", "issuer": "Australian Prudential Regulation Authority (APRA)", "version": "2026-04-30", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://www.apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Issued April 30, 2026 to all APRA-regulated entities. APRA \"expects\" penetration testing and automated vulnerability discovery aimed at AI-specific attack paths, and security testing of AI-generated code, and warns of stronger supervisory action and enforcement.", "cells": { "legal_force": { "code": "supervisory_expectation", "detail": "A letter to industry setting APRA expectations on top of its prudential standards. It is not a new standard; it warns of stronger supervisory action and enforcement where AI risks are not managed.", "cite": "Letter, body", "url": "https://www.apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai", "quote": "Where entities fail to adequately identify, manage or control AI risks in a manner proportionate to their size, scale and complexity, we will take stronger supervisory action and, where appropriate, pursue enforcement.", "confidence": "verified" }, "scope": { "code": "all APRA-regulated entities", "detail": "Addressed to all APRA-regulated entities. The observations come from a late-2025 engagement with large banks, insurers and superannuation trustees.", "cite": "Letter, addressee line", "url": "https://www.apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai", "quote": "To: All APRA-regulated entities", "confidence": "verified" }, "frequency": { "code": "before AI deployment and throughout the lifecycle; no interval", "detail": "No fixed cycle. Expects risk and information security assessments before deployment and through the lifecycle, with continuous monitoring by criticality.", "cite": "Attachment, 'Traditional change management and assurance' expectations", "url": "https://www.apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai", "quote": "conducting comprehensive risk and information security assessments prior to deployment and throughout the lifecycle.", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "Lists AI attack paths observed (prompt injection, data leakage, insecure integrations, exploit injection, agent misuse) but does not require threat intelligence to shape tests.", "cite": "No provision; full text reviewed (searched: threat intelligence, intelligence-led, scenario)", "url": "https://www.apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "No rule on tester qualifications.", "cite": "No provision; full text reviewed (searched: accredit, certif, qualified, independent tester)", "url": "https://www.apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai", "confidence": "verified" }, "internal_testers": { "code": "allowed_with_conditions", "detail": "Expects second-line risk and internal audit to have the technical skills and tooling to assess AI systems independently.", "cite": "Attachment, 'Traditional change management and assurance' expectations", "url": "https://www.apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai", "quote": "second line risk management and internal audit functions possess technical capability and tooling to independently assess AI systems including probabilistic models and agentic workflows;", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: social engineering, phishing, impersonation)", "url": "https://www.apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: physical, premises)", "url": "https://www.apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai", "confidence": "verified" }, "third_party": { "code": "assurance_only", "detail": "Supplier AI is handled through supply-chain mapping, contracts, audit rights and assurance. APRA noted few entities had tested exit and substitution for critical AI providers.", "cite": "Attachment, 'Supplier risk management' expectations", "url": "https://www.apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai", "quote": "contractual and governance arrangements which provide sufficient transparency, auditability and assurance over AI services.", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: operational technology, OT, industrial)", "url": "https://www.apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai", "confidence": "verified" }, "payment_systems": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: payment, settlement, card)", "url": "https://www.apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: cloud, SaaS)", "url": "https://www.apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai", "confidence": "verified" }, "cross_border": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: offshore, overseas, foreign, group)", "url": "https://www.apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; full text reviewed (searched: purple, replay, red team)", "url": "https://www.apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai", "confidence": "verified" }, "remediation_retest": { "code": "recommended", "detail": "Stresses timely patching and closure of vulnerabilities, and notes remediation timelines that lag the threat. Sets no remediation plan, deadline or retest for test findings.", "cite": "Letter, body; Attachment, 'AI threats are increasing' observations", "url": "https://www.apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai", "quote": "APRA emphasises the need for entities to prioritise and strengthen their security defences, including the timely implementation of patching, closure of vulnerabilities and focused attention to cyber hygiene.", "confidence": "verified" }, "regulator_role": { "code": "examines", "detail": "APRA applies supervisory focus through prudential reviews and thematic work. No duty to send test results.", "cite": "Letter, body", "url": "https://www.apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai", "quote": "APRA will apply its supervisory focus to entities’ AI adoption and manage the resulting risks.", "confidence": "verified" }, "automated_ai": { "code": "addressed", "detail": "Expects penetration testing and automated vulnerability discovery aimed at AI-specific attack paths, and security testing of AI-generated code. APRA observed gaps in security testing programs for AI. No rules for tests run by AI agents.", "cite": "Attachment, 'AI threats are increasing' expectations", "url": "https://www.apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai", "quote": "security controls and capabilities that effectively address AI‑specific threats and attack paths. This would include strong privileged access management, timely patching, hardened configurations, automated vulnerability discovery, penetration testing, and controls over agentic and autonomous workflows;", "confidence": "verified" } } }, { "id": "au-homeaffairs-soci-sons", "jurisdiction": "Australia", "region": "Benchmark", "sector": "cross-sector", "name": "Security of Critical Infrastructure Act 2018 (Cth), Part 2C Divisions 3 and 4: cyber security exercises and vulnerability assessments for systems of national significance", "short": "AU SOCI SoNS tests", "issuer": "Department of Home Affairs (the Secretary gives notices); Minister for the Act declares systems of national significance (s. 52B)", "version": "2022-04-01", "status": "In force; added to the set on 2026-10-30", "public": "full", "primary_url": "https://www.legislation.gov.au/C2018A00029/latest/text", "checked": "2026-10-30", "added": "2026-10-30", "notes": "Missed in September. Australia's critical infrastructure law lets the Secretary order systems of national significance, which can include bank, insurer and financial market infrastructure assets, to run cyber security exercises and vulnerability assessments that 'test the vulnerability of the system' (s. 30CY). Part 2C was added by Act No. 33 of 2022; the compilation read is No. 9 of June 4, 2026.", "cells": { "legal_force": { "code": "mandatory", "detail": "Statutory duty once a notice is given; civil penalty of 200 penalty units for non-compliance (ss. 30CP, 30CV).", "cite": "SOCI Act ss. 30CP; 30CV", "url": "https://www.legislation.gov.au/C2018A00029/latest/text", "quote": "An entity must comply with a notice given to the entity under section 30CM.", "confidence": "verified" }, "scope": { "code": "systems of national significance, on notice (incl. banking, insurance and FMI assets)", "detail": "The Minister may declare any critical infrastructure asset a system of national significance; critical banking, insurance, superannuation and financial market infrastructure assets are critical infrastructure assets (s. 9(1)(da) to (dd)). Commonwealth-owned assets are excluded unless declared or prescribed (s. 9(2A)).", "cite": "SOCI Act ss. 52B; 9(1); 9(2A); 30CM(1)", "url": "https://www.legislation.gov.au/C2018A00029/latest/text", "quote": "The Secretary may, by written notice given to an entity that is the responsible entity for a system of national significance, require the entity to:", "confidence": "verified" }, "frequency": { "code": "on the Secretary's notice", "detail": "No cycle. Exercises and vulnerability assessments happen when the Secretary gives notice, after consulting the entity and any relevant Commonwealth regulator, and with regard to cost and proportionality.", "cite": "SOCI Act ss. 30CM(1) to (6); 30CU(1) to (4)", "url": "https://www.legislation.gov.au/C2018A00029/latest/text", "quote": "In deciding whether to give a notice to an entity under subsection (1) or (2), the Secretary must have regard to:", "confidence": "verified" }, "threat_intel": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; Part 2C reviewed (searched: threat intelligence, intelligence, scenario)", "url": "https://www.legislation.gov.au/C2018A00029/latest/text", "confidence": "verified" }, "provider_requirements": { "code": "not_addressed", "detail": "No qualification rule for testers. External auditors, authorised by the Secretary and not employees of the entity, may be required to prepare a new evaluation report of an exercise (s. 30CR).", "cite": "No provision for testers; Part 2C reviewed; ss. 30CR(5), 30CT for evaluation reports", "url": "https://www.legislation.gov.au/C2018A00029/latest/text", "confidence": "verified" }, "internal_testers": { "code": "allowed", "detail": "The entity may run the vulnerability assessment itself or cause it to be run. If the Secretary believes it cannot comply, a designated officer may run it (s. 30CW).", "cite": "SOCI Act ss. 30CU(1)(a); 30CW", "url": "https://www.legislation.gov.au/C2018A00029/latest/text", "quote": "undertake, or cause to be undertaken, a vulnerability assessment in relation to:", "confidence": "verified" }, "social_engineering": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; Part 2C reviewed (searched: social engineering, phishing, personnel)", "url": "https://www.legislation.gov.au/C2018A00029/latest/text", "confidence": "verified" }, "physical": { "code": "not_addressed", "detail": "Notices can require access to premises for designated officers to observe or assess, but no physical test is set.", "cite": "No provision; Part 2C reviewed (searched: physical, premises); ss. 30CM(4)(b), 30CW(5)(a)", "url": "https://www.legislation.gov.au/C2018A00029/latest/text", "confidence": "verified" }, "third_party": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; Part 2C reviewed (searched: third party, supplier, outsourc)", "url": "https://www.legislation.gov.au/C2018A00029/latest/text", "confidence": "verified" }, "ot": { "code": "not_addressed", "detail": "Systems of national significance can include energy and water assets, but the testing provisions do not mention OT.", "cite": "No provision; Part 2C reviewed (searched: operational technology, industrial control, SCADA)", "url": "https://www.legislation.gov.au/C2018A00029/latest/text", "confidence": "verified" }, "payment_systems": { "code": "permitted", "detail": "Assets used to operate a critical payment system are critical financial market infrastructure assets and can be declared systems of national significance, which opens them to exercise and assessment notices.", "cite": "SOCI Act s. 12D(1)(i); s. 52B; s. 30CU", "url": "https://www.legislation.gov.au/C2018A00029/latest/text", "quote": "an asset that is used in connection with the operation of a payment system that, in accordance with subsection (6), is critical to the security and reliability of the financial services and markets sector.", "confidence": "verified" }, "cloud_saas": { "code": "not_addressed", "detail": "No provision in Part 2C.", "cite": "No provision; Part 2C reviewed (searched: cloud, data storage, SaaS)", "url": "https://www.legislation.gov.au/C2018A00029/latest/text", "confidence": "verified" }, "cross_border": { "code": "addressed", "detail": "Assets located outside Australia are not critical infrastructure assets, except some satellite and submarine cable assets.", "cite": "SOCI Act s. 9(2B) to (2D)", "url": "https://www.legislation.gov.au/C2018A00029/latest/text", "quote": "an asset is not a critical infrastructure asset if, or to the extent to which, the asset is located outside Australia.", "confidence": "verified" }, "purple_replay": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; Part 2C reviewed (searched: purple, replay, red team)", "url": "https://www.legislation.gov.au/C2018A00029/latest/text", "confidence": "verified" }, "remediation_retest": { "code": "not_addressed", "detail": "Reports go to the Secretary within 30 days, but Part 2C sets no remediation duty.", "cite": "No provision; Part 2C reviewed (searched: remediat, rectif)", "url": "https://www.legislation.gov.au/C2018A00029/latest/text", "confidence": "verified" }, "regulator_role": { "code": "leads_or_oversees_test", "detail": "The Secretary orders the exercise or assessment, may have designated officers observe or run it, and receives the evaluation or assessment report within 30 days.", "cite": "SOCI Act ss. 30CM(4); 30CQ; 30CW; 30CZ", "url": "https://www.legislation.gov.au/C2018A00029/latest/text", "quote": "allow one or more specified designated officers to observe the cyber security exercise;", "confidence": "verified" }, "automated_ai": { "code": "not_addressed", "detail": "No provision.", "cite": "No provision; Part 2C reviewed (searched: automat, artificial intelligence, AI)", "url": "https://www.legislation.gov.au/C2018A00029/latest/text", "confidence": "verified" } } } ], "changes": [ { "date": "2026-10-30", "text": "We published this section: 71 US and Gulf testing rules and 13 international benchmarks, each coded on 17 dimensions. All but UAE IA Standard v2.1 were read against their sources on October 30, 2026.", "sources": [ "testingRulesData" ] }, { "date": "2026-10-30", "text": "Rechecked 49 of the 50 rows of the September coding against their sources: 47 unchanged, 1 amended, 1 superseded. Not reachable, so kept as coded in September: UAE IA Standard v2.1.", "sources": [ "qa-qfcra-ctrl-ict-risk", "sa-nca-cscc", "ae-csc-ia-standard-v2-1" ] }, { "date": "2026-10-30", "text": "Added 7 US rules: OCC GENIUS Act rule (12 CFR 15), FHFA information security bulletins, FCA cyber risk management rule, Fed Regulation HH (designated FMUs), SEC Regulation SE system safeguards, IRS Pub 1075 and CMS ARC-AMPE. OCC GENIUS Act rule (12 CFR 15) was issued after September 28, 2026. The others were issued earlier and missed by the first coding.", "sources": [ "us-occ-genius-part15", "us-fhfa-ab-2017-02", "us-fca-609-930", "us-frb-reg-hh", "us-sec-reg-se-sbsef", "us-irs-pub1075", "us-cms-arc-ampe" ] }, { "date": "2026-10-30", "text": "Added 4 Saudi rules: CMA Cybersecurity Guidelines, NCA CCC-2:2024, NCA TCC-1:2021 and SAMA IPO Rules. All were issued earlier and missed by the first coding.", "sources": [ "sa-cma-cyber-guidelines", "sa-nca-ccc", "sa-nca-tcc", "sa-sama-ipo-rules" ] }, { "date": "2026-10-30", "text": "Added 3 UAE rules: CMA VASP and ATS Regulation 2026, CBUAE retail payment systems regulation and CBUAE electronic insurance regulations. All were issued earlier and missed by the first coding.", "sources": [ "ae-cma-vasp-regulation-2026", "ae-cbuae-retail-payment-systems", "ae-cbuae-e-insurance-regulation" ] }, { "date": "2026-10-30", "text": "Added 1 Qatari rule: NCSA vulnerability management guidelines. It was issued earlier and missed by the first coding.", "sources": [ "qa-ncsa-vuln-mgmt-guidelines" ] }, { "date": "2026-10-30", "text": "Added 5 Bahraini rules: CBB GR-12.2 payments and open banking, CBB CRA-5.8 crypto-asset, CBB SIO-9.6 stablecoin issuers, CBB RM-3 money changers and CBB OM-5.2 financing companies. All were issued earlier and missed by the first coding.", "sources": [ "bh-cbb-gr12-ancillary-payments", "bh-cbb-cra58-crypto", "bh-cbb-sio96-stablecoin", "bh-cbb-rm3-money-changers", "bh-cbb-om52-financing" ] }, { "date": "2026-10-30", "text": "Added 1 Kuwaiti rule: CBK e-payment cyber minimum. It was issued earlier and missed by the first coding.", "sources": [ "kw-cbk-epay-cyber-min" ] }, { "date": "2026-10-30", "text": "Added 9 Omani rules: CBO BCM framework, CBO open banking framework, CBO PSP licensing policy, CBO BNPL framework, CBO digital bank framework, FSA listed company guidelines, CDC external cloud policy, MTCIT managed services standards and MTCIT government mobile app standards. All were issued earlier and missed by the first coding.", "sources": [ "om-cbo-bcm-framework", "om-cbo-open-banking", "om-cbo-psp-licensing", "om-cbo-bnpl", "om-cbo-digital-banks", "om-fsa-infosec-guidelines", "om-cdc-external-cloud", "om-mtcit-managed-services", "om-mtcit-gov-mobile-apps" ] }, { "date": "2026-10-30", "text": "Added 4 benchmarks: SG CSA CCoP 2026, SG MAS AI risk management guidelines, AU APRA AI letter 2026 and AU SOCI SoNS tests. SG MAS AI risk management guidelines was issued after September 28, 2026. The others were issued earlier and missed by the first coding.", "sources": [ "sg-csa-ccop-2026", "sg-mas-ai-rm", "au-apra-ai-letter-2026", "au-homeaffairs-soci-sons" ] }, { "date": "2026-10-30", "text": "Corrected 18 cells of the September coding, after a second reading of the texts and to apply the same coding rules in every country. CFTC system safeguards, Human seam: from Not addressed to Controls tested, seam not crossed. FedRAMP Rev5 (legacy), Cross-border: from Addressed to Not addressed. FedRAMP CR26 / 20x, Threat intelligence: from Recommended to Not addressed. SAMA CSF, Cloud and SaaS: from Not addressed to Supplier assurance only. NCSC national baseline controls, Supplier seam: from Not addressed to Supplier assurance only. NCSC national baseline controls, Cloud and SaaS: from Not addressed to Supplier assurance only. QCB technology risks for banks, Cross-border: from Not addressed to Addressed. QCB insurance cyber regulation, Payment systems: from Required to Not addressed. QCB insurance cyber regulation, Cross-border: from Not addressed to Addressed. QFCRA CTRL 8.5, Who is covered: from QFC authorised firms to QFC authorised firms except wholesale advisory firms. QFCRA CTRL 8.5, Cross-border: from Not addressed to Addressed. CBUAE operational risk regulation, Payment systems: from Required to Not addressed. DFSA GEN 5.5 (DIFC), Human seam: from Permitted to Controls tested, seam not crossed. DFSA GEN 5.5 (DIFC), Cross-border: from Not addressed to Addressed. ADGM FSRA GEN 3.5, Cross-border: from Not addressed to Addressed. Dubai DESC ISR, Who is covered: from Dubai Government Entities to Dubai Government Entities and DESC-classified Critical Non-government Entities. Dubai DESC ISR, Regulator role: from Text not public to Examines in supervision. SG ABS AASE, Cross-border: from Addressed to Not addressed.", "sources": [ "us-cftc-system-safeguards", "us-fedramp-rev5", "us-fedramp-cr26", "sa-sama-csf", "kw-ncsc-nbcc", "qa-qcb-technology-risks-banks", "qa-qcb-insurance-cyber", "qa-qfcra-ctrl-ict-risk", "ae-cbuae-oprisk-2026", "ae-dfsa-gen-5-5", "ae-adgm-fsra-gen-3-5", "ae-desc-isr", "sg-abs-aase" ] }, { "date": "2026-10-30", "text": "Two proposed changes did not pass review. A row for the European Supervisory Authorities’ statement of July 31, 2026 on ICT risks from frontier AI models was left out: it encourages firms and lists testing only as actions to consider. A recode of the SAMA CSF cross-border cell was rejected, since its cloud location clause is a data location rule, not a testing rule.", "sources": [ "eu-dora-tlpt", "sa-sama-csf" ] }, { "date": "2026-10-30", "text": "A row for the CBUAE’s guidance note of February 11, 2026 on AI and machine learning was left out. Its tests are bias tests, model stress tests and validation, and tests of automatic updates, none of them a security test. Its security content is reviews, including annual cybersecurity reviews of AI providers, which the coding rules do not count as tests, so we cite it as related guidance.", "sources": [ "cbuaeAiGuidance" ] }, { "date": "2026-10-30", "text": "Dubai’s DESC Cyber Force register listed 33 penetration testing companies and 82 individuals, against 32 and 77 on September 28. Three of the 33 listings showed expiry dates before October 30.", "sources": [ "ae-desc-isr" ] }, { "date": "2026-10-29", "text": "Saudi Arabia’s NCA posted CSCC-2:2026 on its Arabic CSCC page, replacing CSCC-1:2019. The document gives only its year of issue. Critical systems are still penetration tested at least every six months by a qualified team. Critical systems are now identified through NCA’s Haseen portal.", "sources": [ "sa-nca-cscc" ], "previous": "Critical Systems Cybersecurity Controls CSCC-1:2019." }, { "date": "2026-10-23", "text": "The OCC issued its final GENIUS Act rule for payment stablecoin issuers, 12 CFR part 15. It requires periodic independent testing and takes effect on January 18, 2027.", "sources": [ "us-occ-genius-part15" ] }, { "date": "2026-10-07", "text": "The Monetary Authority of Singapore finalized its AI risk management guidelines. They take effect on October 7, 2027.", "sources": [ "sg-mas-ai-rm" ] }, { "date": "2026-10-01", "text": "The Seam Report 2026 published its analysis of 50 testing regimes as of September 28, 2026, chapter 9. This section continues it.", "sources": [ "seamReport" ] }, { "date": "2026-09-14", "text": "The CBUAE’s Operational Risk Management Regulation, C 1/2026, took effect. It requires an independent third-party penetration test of critical functions.", "sources": [ "ae-cbuae-oprisk-2026" ] }, { "date": "2026-08-19", "text": "Bahrain’s NCSC issued Decision No. 36 of 2026, mandatory cybersecurity standards for critical sectors. Its Annex 1 is not public.", "sources": [ "bh-ncsc-cni-standards-2026" ] }, { "date": "2026-07-04", "text": "FedRAMP’s Consolidated Rules 2026 became optional for cloud providers. They become mandatory on January 1, 2027.", "sources": [ "us-fedramp-cr26" ] }, { "date": "2026-05-01", "text": "QFCRA rule change RM/2026-1 took wholesale advisory firms out of the ICT risk rules in CTRL Part 8.5.", "sources": [ "qa-qfcra-ctrl-ict-risk" ] }, { "date": "2026-04-05", "text": "Kuwait’s NCSC Decision No. 2 of 2026, national baseline controls, was published in the official gazette, with 18 months to comply.", "sources": [ "kw-ncsc-nbcc" ] }, { "date": "2026-02-28", "text": "The UAE Capital Market Authority’s regulation for virtual asset service providers took effect, with resilience testing at least once a year for internet-connected systems.", "sources": [ "ae-cma-vasp-regulation-2026" ] }, { "date": "2026-02-11", "text": "The CBUAE issued its guidance note on AI and machine learning, with yearly bias tests and independent cybersecurity reviews of AI providers.", "sources": [ "cbuaeAiGuidance" ] }, { "date": "2026-01-31", "text": "ADGM’s FSRA cyber risk rules, GEN 3.5, came into force, with testing at least once a year for internet-facing systems.", "sources": [ "ae-adgm-fsra-gen-3-5" ] }, { "date": "2026-01-06", "text": "The Central Bank of Oman issued its business continuity framework, with a threat-led penetration test or red team exercise of critical systems at least every three years.", "sources": [ "om-cbo-bcm-framework" ] }, { "date": "2025-12-03", "text": "The Central Bank of Kuwait issued CORF v1.0, with red teaming at least once a year.", "sources": [ "kw-cbk-corf" ] }, { "date": "2025-10-01", "text": "QFCRA’s ICT and information security risk rules, CTRL Part 8.5, took effect.", "sources": [ "qa-qfcra-ctrl-ict-risk" ] }, { "date": "2025-08-31", "text": "The FFIEC retired its voluntary Cybersecurity Assessment Tool.", "sources": [ "us-ffiec-cat" ] }, { "date": "2025-06-12", "text": "The SEC withdrew its proposed Regulation SCI amendments, which would have made penetration testing annual for SCI entities.", "sources": [ "secSciWithdrawal" ] } ], "watch": [ { "what": "FedRAMP Consolidated Rules 2026 become mandatory; no new Rev5 certifications after June 11, 2027", "due": "2027-01-01", "look": "FedRAMP rules repository, timeline and effective dates", "sources": [ "us-fedramp-cr26", "us-fedramp-rev5" ] }, { "what": "CBO outsourcing circular BM 1234 takes effect. It sets no security testing duty; check whether CBO pairs it with supplier testing instructions", "due": "2027-01-01", "look": "CBO circulars (cbo.gov.om)", "sources": [ "om-cbo-csrf" ] }, { "what": "The OCC’s GENIUS Act rule, 12 CFR part 15, takes effect for payment stablecoin issuers", "due": "2027-01-18", "look": "Federal Register and eCFR title 12 part 15", "sources": [ "us-occ-genius-part15" ] }, { "what": "Full compliance deadline for Kuwait’s NCSC baseline controls, 18 months from gazette publication by our count", "due": "2027-10-05", "look": "Kuwait Al-Youm gazette index and ncsc.gov.kw", "sources": [ "kw-ncsc-nbcc" ] }, { "what": "Repeal date of the FedRAMP Authorization Act unless Congress extends it", "due": "2027-12-23", "look": "44 U.S.C. 3607 notes and congress.gov, including the FY2027 NDAA", "sources": [ "us-fedramp-cr26" ] }, { "what": "Final FDIC, NCUA and Federal Reserve GENIUS Act rules for the stablecoin issuers each supervises", "look": "Federal Register", "sources": [ "us-occ-genius-part15" ] }, { "what": "IRS Publication 1075 Rev. 12-2026, now an early release draft that keeps the three-year penetration test of the federal tax information environment", "look": "irs.gov Safeguards program and draft forms", "sources": [ "us-irs-pub1075" ] }, { "what": "NIST SP 800-82r4, guide to OT security, final after the September 21, 2026 draft", "look": "NIST CSRC publications", "sources": [ "us-fisma-nist" ] }, { "what": "NCA licensing framework for cybersecurity services (RFCS-1:2026), which would license penetration testing and red teaming", "look": "NCA public consultations and regulatory documents (nca.gov.sa)", "sources": [ "ncaRfcs" ] }, { "what": "NCA AI Cybersecurity Guidelines (AICG-1:2026), final text", "look": "NCA public consultations (nca.gov.sa)", "sources": [ "ncaAicg" ] }, { "what": "English text of NCA CSCC-2:2026", "look": "NCA English CSCC page", "sources": [ "sa-nca-cscc" ] }, { "what": "DFSA final operational resilience rules (CP170), with scenario testing of critical business services", "look": "DFSA consultation papers and the GEN module", "sources": [ "ae-dfsa-gen-5-5" ] }, { "what": "CBUAE standards under the Operational Risk Management Regulation, which could set a test interval or tester rules", "look": "CBUAE Rulebook, risk management section", "sources": [ "ae-cbuae-oprisk-2026" ] }, { "what": "DESC classification of critical non-government entities and certification rules under Dubai Law No. 15 of 2024", "look": "Dubai Official Gazette and desc.gov.ae regulations", "sources": [ "ae-desc-isr" ] }, { "what": "A UAE IA Standard edition after v2.1, which we could not rule out while csc.gov.ae was unreachable", "look": "csc.gov.ae policies listing", "sources": [ "ae-csc-ia-standard-v2-1" ] }, { "what": "A revised NCSA accreditation standard or recognition route after NCSA’s memorandum with CREST International", "look": "NCSA publications and news (ncsa.gov.qa)", "sources": [ "qa-ncsa-niscf-pentest-accreditation", "ncsaConference" ] }, { "what": "An NCSA scheme for OT cybersecurity assessments", "look": "NCSA publications and news (ncsa.gov.qa)", "sources": [ "ncsaConference" ] }, { "what": "QFMA’s adoption decision and official publication date for the NIA controls for market participants", "look": "QFMA legal decisions library", "sources": [ "qa-qfma-ncsa-nia-fmp" ] }, { "what": "Publication of Annex 1 of Bahrain NCSC Decision 36/2026, or retirement of the 2022 baseline", "look": "NCSC standards and controls pages (ncsc.gov.bh)", "sources": [ "bh-ncsc-cni-standards-2026", "bh-ncsc-baseline-controls" ] }, { "what": "Licensing of cybersecurity service providers in Bahrain, planned in the national strategy for 2025 to 2028", "look": "NCSC executive decisions (ncsc.gov.bh)", "sources": [ "bh-ncsc-baseline-controls" ] }, { "what": "The CBB Payment Service Requirements Module, consulted on in February 2026", "look": "CBB consultations and the Volume 5 rulebook", "sources": [ "bh-cbb-gr12-ancillary-payments" ] }, { "what": "CBK’s final open banking framework and any API security testing it sets", "look": "CBK press releases and instructions (cbk.gov.kw)", "sources": [ "kw-cbk-corf" ] }, { "what": "CBK instructions on approval of external CORF assessors for exchange and payment companies", "look": "CBK instruction compendia for exchange companies and e-payment firms", "sources": [ "kw-cbk-corf" ] }, { "what": "CBO licensing and emergency policies adopted by its board but not yet published", "look": "CBO news and circulars (cbo.gov.om)", "sources": [ "om-cbo-digital-banks" ] }, { "what": "Whether MTCIT still accredits cloud providers that serve government under its Cloud and Hosting Services Standard (GC_S2), now that MTCIT says regulating cloud hosting has moved to the TRA. We hold the standard out of the set until this is clear", "look": "MTCIT accreditation program page and the TRA legal library" }, { "what": "FSA instructions under the securities law executive regulations, which could add testing rules for capital market firms", "look": "FSA legislation encyclopedia (e.fsa.gov.om)", "sources": [ "om-fsa-infosec-guidelines" ] }, { "what": "HKMA Cyber Resilience Testing Framework for banks", "look": "HKMA circulars and the Cybersecurity Fortification Initiative page", "sources": [ "hk-hkma-icast" ] }, { "what": "CSA technical guidance for the Singapore CCoP on adversarial attack simulation and penetration testing", "look": "CSA codes of practice page", "sources": [ "sg-csa-ccop-2026" ] }, { "what": "Bank of England and PRA consultation on cyber and ICT risk management", "look": "PRA consultation papers", "sources": [ "uk-cbest" ] } ], "sources": { "us-nydfs-part500": { "title": "Cybersecurity Requirements for Financial Services Companies, 23 NYCRR Part 500 (as amended by the Second Amendment), New York State Department of Financial Services (DFS)", "url": "https://www.dfs.ny.gov/system/files/documents/2026/07/NYCRR-part-500-Cybersecurity-Regulation.pdf", "checked": "2026-10-30" }, "us-ffiec-is-booklet": { "title": "FFIEC Information Technology Examination Handbook, Information Security booklet (read with the Architecture, Infrastructure, and Operations booklet), Federal Financial Institutions Examination Council (FRB, FDIC, OCC, NCUA, CFPB, State Liaison Committee)", "url": "https://ithandbook.ffiec.gov/media/swzjlcxk/ffiec_itbooklet_informationsecurity.pdf", "checked": "2026-10-30" }, "us-ffiec-cat": { "title": "FFIEC Cybersecurity Assessment Tool, Federal Financial Institutions Examination Council", "url": "https://www.ffiec.gov/sites/default/files/media/resources/FFIEC_CAT_May_2017.pdf", "checked": "2026-10-30" }, "us-sec-reg-sci": { "title": "Regulation Systems Compliance and Integrity (Regulation SCI), 17 CFR 242.1000-242.1007, U.S. Securities and Exchange Commission", "url": "https://www.ecfr.gov/current/title-17/chapter-II/part-242", "checked": "2026-10-30" }, "us-cftc-system-safeguards": { "title": "CFTC system safeguards testing requirements for designated contract markets, swap execution facilities, derivatives clearing organizations and swap data repositories (17 CFR 38.1051, 37.1401, 39.18, 49.24), U.S. Commodity Futures Trading Commission", "url": "https://www.ecfr.gov/current/title-17/section-38.1051", "checked": "2026-10-30" }, "us-interagency-infosec-guidelines": { "title": "Interagency Guidelines Establishing Information Security Standards (12 CFR part 30 app. B; 12 CFR part 208 app. D-2; 12 CFR part 364 app. B) and NCUA Guidelines for Safeguarding Member Information (12 CFR part 748 app. A), OCC, Federal Reserve Board, FDIC; NCUA (parallel text)", "url": "https://www.ecfr.gov/current/title-12/part-30/appendix-Appendix%20B%20to%20Part%2030", "checked": "2026-10-30" }, "us-ftc-safeguards-rule": { "title": "Standards for Safeguarding Customer Information (FTC Safeguards Rule), 16 CFR part 314, U.S. Federal Trade Commission", "url": "https://www.ecfr.gov/current/title-16/section-314.4", "checked": "2026-10-30" }, "us-fisma-nist": { "title": "Federal Information Security Modernization Act of 2014 (44 U.S.C. 3551-3558) with NIST SP 800-53 Rev. 5 controls CA-8, RA-5, SA-11 and SP 800-53B baselines, U.S. Congress (statute); NIST (SP 800-53, SP 800-53B); OMB and CISA (FISMA metrics)", "url": "https://www.law.cornell.edu/uscode/text/44/3554", "checked": "2026-10-30" }, "us-fedramp-rev5": { "title": "FedRAMP Rev5 security controls baselines (legacy) and FedRAMP Penetration Test Guidance, General Services Administration, FedRAMP Program Management Office", "url": "https://raw.githubusercontent.com/FedRAMP/docs-legacy/ed5e17f7c69a99a2511a93655353224b23bcf72e/overrides/assets/LEGACY%20FedRAMP_Security_Controls_Baseline.xlsx", "checked": "2026-10-30" }, "us-fedramp-cr26": { "title": "FedRAMP Consolidated Rules for 2026 (Rev5 and 20x rulesets), General Services Administration, FedRAMP", "url": "https://raw.githubusercontent.com/FedRAMP/2026-markdown/2f81e380a6615d48927a72c5007df785c038f891/index.md", "checked": "2026-10-30" }, "us-cisa-hva": { "title": "Federal High Value Asset program: OMB M-19-03 and CISA Binding Operational Directive 18-02 (HVA assessments), OMB (M-19-03); DHS CISA (BOD 18-02, HVA PMO)", "url": "https://www.cisa.gov/news-events/directives/bod-18-02-securing-high-value-assets", "checked": "2026-10-30" }, "us-omb-m22-09": { "title": "OMB M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles (application security testing actions), Office of Management and Budget", "url": "https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf", "checked": "2026-10-30" }, "us-occ-genius-part15": { "title": "Implementing the Guiding and Establishing National Innovation for U.S. Stablecoins Act for the Issuance of Stablecoins by Entities Subject to the Jurisdiction of the Office of the Comptroller of the Currency, final rule, 12 CFR part 15 (91 FR 67000, Oct. 23, 2026), Office of the Comptroller of the Currency (OCC)", "url": "https://www.federalregister.gov/documents/2026/10/23/2026-21706/implementing-the-guiding-and-establishing-national-innovation-for-us-stablecoins-act-for-the", "checked": "2026-10-30" }, "us-fhfa-ab-2017-02": { "title": "FHFA Advisory Bulletin AB 2017-02, Information Security Management (Sept. 28, 2017), with AB 2023-02, Supplemental Guidance to AB 2017-02 (Jan. 13, 2023), Federal Housing Finance Agency (FHFA)", "url": "https://www.fhfa.gov/advisory-bulletin/ab-2017-02", "checked": "2026-10-30" }, "us-fca-609-930": { "title": "Farm Credit Administration, Cyber Risk Management, 12 CFR 609.930 (final rule 88 FR 85825, Dec. 11, 2023; effective Jan. 1, 2025), Farm Credit Administration (FCA)", "url": "https://www.ecfr.gov/current/title-12/section-609.930", "checked": "2026-10-30" }, "us-frb-reg-hh": { "title": "Regulation HH, Designated Financial Market Utilities, 12 CFR 234.3(a)(17) operational risk standard, as amended 89 FR 18749 (Mar. 15, 2024), Board of Governors of the Federal Reserve System", "url": "https://www.ecfr.gov/current/title-12/section-234.3", "checked": "2026-10-30" }, "us-sec-reg-se-sbsef": { "title": "Regulation SE, Core Principle 13, System safeguards for security-based swap execution facilities, 17 CFR 242.830 (adopted 88 FR 87156, Dec. 15, 2023; effective Feb. 13, 2024), U.S. Securities and Exchange Commission (SEC)", "url": "https://www.ecfr.gov/current/title-17/section-242.830", "checked": "2026-10-30" }, "us-irs-pub1075": { "title": "Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (Rev. 11-2021), Internal Revenue Service, Office of Safeguards", "url": "https://www.irs.gov/pub/irs-pdf/p1075.pdf", "checked": "2026-10-30" }, "us-cms-arc-ampe": { "title": "Acceptable Risk Controls for ACA, Medicaid, and Partner Entities (ARC-AMPE), Volume I v1.02 and Volume II ACA Administering Entities Mandatory Baseline v1.02, Centers for Medicare & Medicaid Services, Center for Consumer Information and Insurance Oversight", "url": "https://www.cms.gov/files/document/arc-ampevol2sspp-aca-aev102-50803212025.xlsx", "checked": "2026-10-30" }, "sa-sama-csf": { "title": "Cyber Security Framework, Saudi Central Bank (SAMA; issued as Saudi Arabian Monetary Authority)", "url": "https://rulebook.sama.gov.sa/en/cyber-security-framework-2", "checked": "2026-10-30" }, "sa-sama-feer": { "title": "Financial Entities Ethical Red-Teaming Framework (F.E.E.R.), Saudi Central Bank (SAMA; issued as Saudi Arabian Monetary Authority)", "url": "https://rulebook.sama.gov.sa/en/financial-entities-ethical-red-teaming-0", "checked": "2026-10-30" }, "sa-sama-crfr": { "title": "Cyber Resilience Fundamental Requirements (CRFR), Saudi Central Bank (SAMA)", "url": "https://rulebook.sama.gov.sa/en/cyber-resilience-fundamental-requirements-crfr-1", "checked": "2026-10-30" }, "sa-nca-ecc": { "title": "Essential Cybersecurity Controls (ECC-2:2024), National Cybersecurity Authority (NCA)", "url": "https://nca.gov.sa/en/regulatory-documents/controls-list/ecc/", "checked": "2026-10-30" }, "sa-nca-cscc": { "title": "Critical Systems Cybersecurity Controls (CSCC-2:2026), National Cybersecurity Authority (NCA)", "url": "https://cdn.nca.gov.sa/api/public/cms/files/14828b9c-c1d5-4c6c-9b06-b6564f3ed17a_CSCC---2-2026-AR-.pdf", "checked": "2026-10-30" }, "sa-nca-otcc": { "title": "Operational Technology Cybersecurity Controls (OTCC-1:2022), National Cybersecurity Authority (NCA)", "url": "https://nca.gov.sa/en/regulatory-documents/controls-list/otcc/", "checked": "2026-10-30" }, "sa-cma-cyber-guidelines": { "title": "Cybersecurity Guidelines for Capital Market Institutions, Capital Market Authority (CMA)", "url": "https://cma.gov.sa/en/RulesRegulations/Guides/Documents/Cyber_Security_en.pdf", "checked": "2026-10-30" }, "sa-nca-ccc": { "title": "Cloud Cybersecurity Controls (CCC-2:2024), National Cybersecurity Authority (NCA)", "url": "https://cdn.nca.gov.sa/api/files/public/upload/6d5408a3-d8e6-4e96-963b-2c7198e5b7c2_CCC-2-2024-EN-.pdf", "checked": "2026-10-30" }, "sa-nca-tcc": { "title": "Telework Cybersecurity Controls (TCC-1:2021), National Cybersecurity Authority (NCA)", "url": "https://nca.gov.sa/telework_cybersecurity_controls-en.pdf", "checked": "2026-10-30" }, "sa-sama-ipo-rules": { "title": "Initial Public Offering (IPO) Rules for Receiving and Lending Banks, Saudi Central Bank (SAMA)", "url": "https://rulebook.sama.gov.sa/en/initial-public-offering-ipo-rules-receiving-and-lending-banks", "checked": "2026-10-30" }, "bh-cbb-om55-banks": { "title": "CBB Rulebook Volume 1 (Conventional Banks), Module OM Operational Risk Management, Section OM-5.5 Cyber Security Risk Management, Central Bank of Bahrain (CBB)", "url": "https://cbben.thomsonreuters.com/entiresection/116037", "checked": "2026-10-30" }, "bh-cbb-rm9-insurance-investment": { "title": "CBB Rulebook Volume 3 (Insurance) and Volume 4 (Investment Business), Module RM Risk Management, Chapter RM-9 Cyber Security Risk Management, Central Bank of Bahrain (CBB)", "url": "https://cbben.thomsonreuters.com/entiresection/301270", "checked": "2026-10-30" }, "bh-ncsc-baseline-controls": { "title": "Baseline Cybersecurity Controls (NCSC-CP-D22-0001), National Cyber Security Center (NCSC), Kingdom of Bahrain", "url": "https://www.ncsc.gov.bh/assets/images/baseline_cybersecurity_controls_v1_80828fdb7d.pdf", "checked": "2026-10-30" }, "bh-ncsc-cni-standards-2026": { "title": "Cyber Security Standards for Critical Sectors (Annex 1 to NCSC Decision No. (36) of 2026), National Cyber Security Center (NCSC), Kingdom of Bahrain", "url": "https://www.ncsc.gov.bh/static_assets/documents/decision-36-2026.pdf", "checked": "2026-10-30" }, "bh-cbb-gr12-ancillary-payments": { "title": "CBB Rulebook Volume 5 (Specialised Licensees), Type 7 Ancillary Service Providers: Module GR Section GR-12.2 Cyber Security Risk Management, with Module OB (Open Banking) Section OB-1.1, Central Bank of Bahrain (CBB)", "url": "https://cbben.thomsonreuters.com/entiresection/506116", "checked": "2026-10-30" }, "bh-cbb-cra58-crypto": { "title": "CBB Rulebook Volume 6 (Capital Markets), Module CRA Crypto-Asset, Chapter CRA-5 Technology Governance and Cyber Security (Section CRA-5.8 Cyber Security), Central Bank of Bahrain (CBB)", "url": "https://cbben.thomsonreuters.com/entiresection/605259", "checked": "2026-10-30" }, "bh-cbb-sio96-stablecoin": { "title": "CBB Rulebook Volume 6 (Capital Markets), Module SIO Stablecoin Issuance & Offering, Chapter SIO-9 Technology Governance & Cyber Security (Section SIO-9.6 Cyber Security), Central Bank of Bahrain (CBB)", "url": "https://cbben.thomsonreuters.com/entiresection/2305008", "checked": "2026-10-30" }, "bh-cbb-rm3-money-changers": { "title": "CBB Rulebook Volume 5 (Specialised Licensees), Type 1 Money Changers, Module RM Money Changers Risk Management, Chapter RM-3 Cyber Security Risk Management, Central Bank of Bahrain (CBB)", "url": "https://cbben.thomsonreuters.com/entiresection/501572", "checked": "2026-10-30" }, "bh-cbb-om52-financing": { "title": "CBB Rulebook Volume 5 (Specialised Licensees), Type 3 Financing Companies, Module OM Operational Risk Management, Section OM-5.2 Internet Security (with BR-1.6), Central Bank of Bahrain (CBB)", "url": "https://cbben.thomsonreuters.com/entiresection/504263", "checked": "2026-10-30" }, "kw-cbk-corf": { "title": "Cyber and Operational Resilience Framework for All Local Banks and Financial Institutions (CORF), Central Bank of Kuwait (CBK)", "url": "https://www.cbk.gov.kw/en/images/corf-170113_v10_tcm10-170113.pdf", "checked": "2026-10-30" }, "kw-ncsc-nbcc": { "title": "Kuwait National Basic Cybersecurity Controls (Annex 1 to NCSC Decision No. 2 of 2026), National Cyber Security Center (NCSC), State of Kuwait", "url": "https://mesferlaw.com/%D8%A7%D9%84%D9%85%D8%B1%D9%83%D8%B2-%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A-%D9%84%D9%84%D8%A3%D9%85%D9%86-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A-%D9%82%D8%B1%D8%A7%D8%B1-%D8%B1%D9%82-2/", "checked": "2026-10-30", "secondary": true }, "kw-cbk-epay-cyber-min": { "title": "Instructions on Minimum Cybersecurity and Business Continuity Requirements for E-Payment Service Providers and E-Money Service Providers (CBK Circular No. (2/PS/527/2023)), Central Bank of Kuwait (CBK)", "url": "https://www.cbk.gov.kw/en/images/epayment-chap2-152798_v120_tcm10-152798.pdf", "checked": "2026-10-30" }, "om-cbo-csrf": { "title": "Cyber Security & Resilience Framework (CS&RF), Central Bank of Oman (CBO)", "url": "https://cbo.gov.om/sites/assets/FintechCompulsoryDocs/Cyber%20Security%20&%20Resilience%20Framework%20(CS&RF).pdf", "checked": "2026-10-30" }, "om-mtcit-gov-security-assessment": { "title": "Ministerial Circular No. (11/2022) on security assessment of government websites, portals, service windows and electronic applications, with the Security Assessment Services Standard (GC_S1), Ministry of Transport, Communications and Information Technology (MTCIT), Oman", "url": "https://mtcit.gov.om/web/content/mtcit.content/827/attachment?download=True", "checked": "2026-10-30" }, "om-cbo-bcm-framework": { "title": "Business Continuity Management Framework (Annexure to Circular BM 1225 of 6 January 2026), Central Bank of Oman (CBO)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2025/2026-01-06%20%20BM%201225%20-%20Annexure%20-%20Business%20Continuity%20Management%20Framework.pdf", "checked": "2026-10-30" }, "om-cbo-open-banking": { "title": "Open Banking Regulatory Framework, with Annexure 3 Open Banking Data and Information Security Specification (issued with Circular BM 1219 of 4 June 2025), Central Bank of Oman (CBO)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Open%20Bank_Oman.pdf", "checked": "2026-10-30" }, "om-cbo-psp-licensing": { "title": "Licensing Policy for Payment Service Providers (PSPs) & Ancillary Payment Service Activities in the Sultanate of Oman (Version 1.01, June 2023), issued with Circular BM 1192, Central Bank of Oman (CBO)", "url": "https://cbo.gov.om/sites/assets/Documents/English/Circulars/2023/2023-06-13%20%20BM%20%201192%20-%20Licensing%20Policy%20for%20Payment%20Service%20Providers%20and%20Ancillary%20Payment%20Service%20Activities.pdf", "checked": "2026-10-30" }, "om-cbo-bnpl": { "title": "Licensing & Regulatory Framework for Buy Now Pay Later (BNPL) in the Sultanate of Oman, Central Bank of Oman (CBO)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/BNPL%20Framework%20EN%20Version.pdf", "checked": "2026-10-30" }, "om-cbo-digital-banks": { "title": "Regulatory Framework for Digital Banks in the Sultanate of Oman, Central Bank of Oman (CBO)", "url": "https://cbo.gov.om/sites/assets/Documents/English/LawRegulations/Regulatory%20Framework%20for%20Digital%20Bank_Oman.pdf", "checked": "2026-10-30" }, "om-fsa-infosec-guidelines": { "title": "Circular No. E/1/2022 Issuing Information Security Guidelines for Public Joint Stock Companies, Financial Services Authority (FSA); issued by its predecessor, the Capital Market Authority", "url": "https://e.fsa.gov.om/LegislationEncyclopedia/DisplayLegislationDetails?isHome=True&id=52&type=4&searchType=1§or=&isExactMatch=False&searchWord=", "checked": "2026-10-30" }, "om-cdc-external-cloud": { "title": "Policy and controls for using external cloud computing services, with Annex 1, minimum security and technical requirements (Version 1, 27 March 2025), Cyber Defence Centre (CDC)", "url": "https://cdc.gov.om/files/CloudPolicy.pdf", "checked": "2026-10-30" }, "om-mtcit-managed-services": { "title": "Ministerial Circular No. (7/2025) on Administrative Standards for Managed Services (Technical Support, Infrastructure, Information Systems), Ministry of Transport, Communications and Information Technology (MTCIT)", "url": "https://mtcit.gov.om/web/content/mtcit.content/755/attachment?download=True", "checked": "2026-10-30" }, "om-mtcit-gov-mobile-apps": { "title": "Ministerial Circular No. (19/2023) on Basic Standards for Developing Government Applications on Mobile and Smart Devices 2023, Ministry of Transport, Communications and Information Technology (MTCIT)", "url": "https://mtcit.gov.om/web/content/mtcit.content/396/attachment?download=True", "checked": "2026-10-30" }, "qa-qcb-technology-risks-banks": { "title": "Technology Risks (QCB cyber security circular for banks), Qatar Central Bank (QCB)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risks%20Regulation%20Banks.pdf", "checked": "2026-10-30" }, "qa-qcb-insurance-cyber": { "title": "Insurance Sector Cyber Security Regulation, Qatar Central Bank (QCB)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Insurance%20Sector%20Cyber%20Security%20Regulation.pdf", "checked": "2026-10-30" }, "qa-qcb-psp-cyber-2022": { "title": "Information and Cyber Security Regulation for Payment Service Providers, Qatar Central Bank (QCB)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Information%20and%20Cyber%20Security%20Regulation%20for%20PSPs.pdf", "checked": "2026-10-30" }, "qa-qcb-fso-tech-risk-2022": { "title": "Technology Risk Instructions for Financial Services Operators, Qatar Central Bank (QCB)", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risk%20Instructions%20for%20Financial%20Services%20Operators.pdf", "checked": "2026-10-30" }, "qa-qfcra-ctrl-ict-risk": { "title": "Governance and Controlled Functions Rules 2020 (CTRL), Part 8.5 ICT and information security risks (with Parts 8.3 and 8.4), Qatar Financial Centre Regulatory Authority (QFCRA)", "url": "https://qfcra-en.thomsonreuters.com/entiresection/15237", "checked": "2026-10-30" }, "qa-ncsa-nia-standard": { "title": "National Information Assurance Standard [IAS-NAT-INFA], National Cyber Security Agency (NCSA), National Cyber Governance and Assurance Affairs", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/9727/1.0~c6f84b60-72b0-40cc-b6cd-052aefab50e1?mimetype=application%2Fpdf&filename=NCSA_CSGA_%20National_Information_Assurance_Standard_En_V2.1%20%283%29.pdf", "checked": "2026-10-30" }, "qa-ncsa-niscf-pentest-accreditation": { "title": "National Information Security Compliance Framework (NISCF) Accreditation Penetration Testing Standard [NCSA-NISCF-ACCR-PNT-STND], National Cyber Security Agency (NCSA), National Cyber Governance and Assurance Affairs", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/3861/1.0~1fca5e63-9fff-4172-82c5-422b356ef221?mimetype=application/pdf&filename=SD.pdf", "checked": "2026-10-30" }, "qa-qfma-ncsa-nia-fmp": { "title": "Compliance Controls of the National Information Assurance (NIA) for Financial Market Participants [IAS-FIN-NFMP], Qatar Financial Markets Authority (QFMA) and National Cyber Security Agency (NCSA)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/11056/1.0~b491aafc-6973-4ae1-b879-6c9ff6cf0fea?mimetype=application%2Fpdf&filename=NCSA_QFMA_EN.pdf", "checked": "2026-10-30" }, "qa-ncsa-vuln-mgmt-guidelines": { "title": "Qatar National Vulnerability Management Guidelines [IAG-NAT-VMG] V1.0, National Cyber Security Agency (NCSA)", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/10183/1.0~68c3bc7d-d9ba-4db6-a840-e6c7fd400481?mimetype=application%2Fpdf&filename=NCSA_CS_Guidelines_for_Vulnerability_Management_EN_V1.0%20%281%29.pdf", "checked": "2026-10-30" }, "ae-cbuae-oprisk-2026": { "title": "Operational Risk Management Regulation (Circular C 1/2026), Central Bank of the UAE (CBUAE)", "url": "https://rulebook.centralbank.ae/en/rulebook/operational-risk-management-regulation", "checked": "2026-10-30" }, "ae-cbuae-retail-payments": { "title": "Retail Payment Services and Card Schemes Regulation, Article (13) Technology Risk and Information Security, Central Bank of the UAE (CBUAE)", "url": "https://rulebook.centralbank.ae/en/rulebook/article-13-technology-risk-and-information-security", "checked": "2026-10-30" }, "ae-joint-enabling-tech-guidelines": { "title": "Guidelines for Financial Institutions Adopting Enabling Technologies, CBUAE, Securities and Commodities Authority (SCA), DFSA and ADGM FSRA (joint issuance)", "url": "https://rulebook.centralbank.ae/en/rulebook/guidelines-financial-institutions-adopting-enabling-technologies", "checked": "2026-10-30" }, "ae-dfsa-gen-5-5": { "title": "DFSA Rulebook General Module (GEN) section 5.5 Cyber risk management, Dubai Financial Services Authority (DFSA), Dubai International Financial Centre", "url": "https://dfsaen.thomsonreuters.com/entiresection/26146", "checked": "2026-10-30" }, "ae-adgm-fsra-gen-3-5": { "title": "FSRA General Rulebook (GEN) Rule 3.5 Cyber Risk Management, with the FSRA Information Technology Risk Management Guidance, Financial Services Regulatory Authority (FSRA), Abu Dhabi Global Market", "url": "https://en.adgm.thomsonreuters.com/entiresection/28467", "checked": "2026-10-30" }, "ae-csc-ia-standard-v2-1": { "title": "UAE Information Assurance Standard, UAE Cyber Security Council (CSC)", "url": "https://csc.gov.ae/en/w/uae-information-assurance-standard", "checked": "2026-09-28" }, "ae-desc-isr": { "title": "Dubai Government Information Security Regulation (ISR), Dubai Electronic Security Center (DESC)", "url": "https://www.desc.gov.ae/regulations/standards-policies/", "checked": "2026-10-30" }, "ae-cma-vasp-regulation-2026": { "title": "The Regulation Concerning Virtual Assets Service Providers and the Alternative Trading System Operator (Chairman's Resolution No. (04/Chairman) of 2026), Capital Market Authority (CMA), formerly the Securities and Commodities Authority (SCA)", "url": "https://legislation.uaecma.gov.ae/en/article-51-protection-ict-assets-cybersecurity-incidents", "checked": "2026-10-30" }, "ae-cbuae-retail-payment-systems": { "title": "Retail Payment Systems Regulation (C 10/2020), Article (8): Ongoing Requirements of Designated Retail Payment Systems, Central Bank of the UAE (CBUAE)", "url": "https://rulebook.centralbank.ae/en/entiresection/1509", "checked": "2026-10-30" }, "ae-cbuae-e-insurance-regulation": { "title": "Insurance Authority Board of Directors' Resolution No. (18) of 2020 Concerning the Electronic Insurance Regulations, Central Bank of the UAE (CBUAE); issued by the former Insurance Authority", "url": "https://rulebook.centralbank.ae/en/entiresection/1002", "checked": "2026-10-30" }, "uk-cbest": { "title": "CBEST Threat Intelligence-Led Assessments, Bank of England, Prudential Regulation Authority and Financial Conduct Authority", "url": "https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/cbest-threat-intelligence-led-assessments-implementation-guide", "checked": "2026-10-30" }, "eu-tiber-eu": { "title": "TIBER-EU: European framework for Threat Intelligence-based Ethical Red Teaming, European Central Bank and Eurosystem national central banks (approved by the ECB Governing Council)", "url": "https://www.ecb.europa.eu/paym/cyber-resilience/tiber-eu/html/index.en.html", "checked": "2026-10-30" }, "eu-dora-tlpt": { "title": "Regulation (EU) 2022/2554 (Digital Operational Resilience Act) Articles 24 to 27, with Commission Delegated Regulation (EU) 2025/1190 (RTS on threat-led penetration testing), European Parliament and Council (DORA); European Commission (RTS, drafted by EBA, EIOPA and ESMA in agreement with the ECB)", "url": "https://eur-lex.europa.eu/eli/reg_del/2025/1190/oj/eng", "checked": "2026-10-30" }, "hk-hkma-icast": { "title": "Intelligence-led Cyber Attack Simulation Testing (iCAST) under the Cyber Resilience Assessment Framework (C-RAF 2.0), Cybersecurity Fortification Initiative 2.0, Hong Kong Monetary Authority (HKMA)", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20241202-2-EN/TM-C-1.pdf", "checked": "2026-10-30" }, "hk-hkma-pcicso-cop": { "title": "Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653), with the Code of Practice for Authorized Institutions designated by the Monetary Authority as Critical Infrastructure Operators, Legislative Council of Hong Kong (Ordinance); Monetary Authority as designated authority (Code of Practice)", "url": "https://brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20260527-25-EN/20260527-25-EN.pdf", "checked": "2026-10-30" }, "sg-abs-aase": { "title": "Red Team: Adversarial Attack Simulation Exercise Guidelines for the Financial Industry in Singapore, The Association of Banks in Singapore (ABS), Standing Committee for Cyber Security", "url": "https://www.abs.org.sg/docs/library/abs-red-team-adversarial-attack-simulation-exercises-guidelines----september-2024.pdf", "checked": "2026-10-30" }, "sg-mas-trm-testing": { "title": "Guidelines on Risk Management Practices: Technology Risk (Technology Risk Management Guidelines), Section 13 Cyber Security Assessment, Monetary Authority of Singapore (MAS)", "url": "https://www.mas.gov.sg/-/media/mas/regulations-and-financial-stability/regulatory-and-supervisory-framework/risk-management/trm-guidelines-18-january-2021.pdf", "checked": "2026-10-30" }, "sg-csa-ccop-2026": { "title": "Cybersecurity Code of Practice for Critical Information Infrastructure 2026 (CCoP 2026, Release 1), Cyber Security Agency of Singapore (Commissioner of Cybersecurity)", "url": "https://isomer-user-content.by.gov.sg/36/8b555ddb-16ab-486c-9fda-e12197a4e320/Cybersecurity%20Code%20of%20Practice%20(2026).pdf", "checked": "2026-10-30" }, "sg-mas-ai-rm": { "title": "Guidelines on Artificial Intelligence Risk Management, Monetary Authority of Singapore (MAS)", "url": "https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf", "checked": "2026-10-30" }, "au-cfr-corie": { "title": "Cyber Operational Resilience Intelligence-led Exercises (CORIE) Framework, Program Guide for Financial Institutions (including Financial Market Infrastructure) in Australia, Council of Financial Regulators (APRA, ASIC, RBA, Treasury)", "url": "https://www.cfr.gov.au/publications/policy-statements-and-other-reports/2022/revised-corie-framework-rollout/pdf/corie-framework.pdf", "checked": "2026-10-30" }, "au-apra-cps-234": { "title": "Prudential Standard CPS 234 Information Security (testing control effectiveness), with Prudential Practice Guide CPG 234, Australian Prudential Regulation Authority (APRA)", "url": "https://www.apra.gov.au/sites/default/files/cps_234_july_2019_for_public_release.pdf", "checked": "2026-10-30" }, "au-apra-ai-letter-2026": { "title": "APRA Letter to Industry on Artificial Intelligence (AI), with attachment 'AI Supervisory Engagement Debrief: Observations for Executive Management', Australian Prudential Regulation Authority (APRA)", "url": "https://www.apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai", "checked": "2026-10-30" }, "au-homeaffairs-soci-sons": { "title": "Security of Critical Infrastructure Act 2018 (Cth), Part 2C Divisions 3 and 4: cyber security exercises and vulnerability assessments for systems of national significance, Department of Home Affairs (the Secretary gives notices); Minister for the Act declares systems of national significance (s. 52B)", "url": "https://www.legislation.gov.au/C2018A00029/latest/text", "checked": "2026-10-30" }, "seamReport": { "title": "The Seam Report 2026, Bendings, chapter 9: testing rules stop at the seams attackers cross, data as of September 28, 2026", "url": "https://bendings.com/research", "checked": "2026-10-30" }, "testingRulesData": { "title": "Security testing rules dataset, Bendings, reviewed October 30, 2026", "url": "https://bendings.com/testing-rules/data.json", "checked": "2026-10-30" }, "secSciWithdrawal": { "title": "Withdrawal of proposed regulatory actions, SEC Release 33-11377, June 12, 2025", "url": "https://www.sec.gov/files/rules/final/2025/33-11377.pdf", "checked": "2026-09-28" }, "ncaRfcs": { "title": "Regulatory Framework for Licensing Cybersecurity Services, Products and Solutions (RFCS-1:2026), public consultation draft, National Cybersecurity Authority, February 25, 2026", "url": "https://cdn.nca.gov.sa/api/files/public/upload/d93ad174-c2c2-4a00-91ce-9b6715bf5d0c_RFCS-2026-PublicConsultationEN.pdf", "checked": "2026-10-30" }, "ncaAicg": { "title": "Draft AI Cybersecurity Guidelines (AICG-1:2026), public consultation draft, National Cybersecurity Authority, July 5, 2026", "url": "https://cdn.nca.gov.sa/api/files/public/upload/cbf45381-f94f-40c7-9b8c-553fb01b6a3b_AI_Cybersecurity_Controls_EN.pdf", "checked": "2026-10-30" }, "cbuaeAiGuidance": { "title": "Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., Central Bank of the UAE, February 11, 2026", "url": "https://rulebook.centralbank.ae/en/entiresection/6963", "checked": "2026-10-30" }, "cbuaeExchangeHouses": { "title": "The Standards for the Regulations Regarding Licensing and Monitoring of Exchange Business (N 35/2018), 14.9 Audit and Testing, Central Bank of the UAE", "url": "https://rulebook.centralbank.ae/en/rulebook/149-audit-and-testing", "checked": "2026-10-30" }, "ncsaConference": { "title": "NCSA Organizes the Fifth Annual Cyber Governance and Assurance Conference, National Cyber Security Agency, Qatar, October 2026", "url": "https://ncsa.gov.qa/en/media/news/NCSA%20Organizes%20the%20Fifth%20Annual%20Cyber%20Governance%20and%20Assurance%20Conference-551750", "checked": "2026-10-30" } } }