Security testing rules in Kuwait.

Issued under Article 15 of Law No. 32 of 1968. CBK’s press statement says local banks and financial institutions must implement the framework from its issue date. Controls use ‘shall’. Translation by Bendings.

“ويتعين على البنوك والمؤسسات المالية المحلية تنفيذ متطلبات الإطار المشار إليه اعتباراً من تاريخه”

CORF Ch. 1 §1; CBK press statement December 3, 2025 (Arabic PDF), p. 3

Kuwaiti banks, foreign banks in Kuwait, exchange companies, finance companies, e-payment companies, credit information companies and open banking providers. Controls apply per a CBK-approved Statement of Applicability; CBK tiers entities for supervision.

“The SoA must be submitted by all entities regulated by the CBK. This includes: Kuwaiti Banks; Foreign Banks operating in the State of Kuwait; Exchange Companies; Finance Companies; E-Payment of Funds Companies; Credit Information Companies; and Open Banking Service Providers.”

CORF Ch. 3 (Toolkit) §4, §4.1; Ch. 1 §10.1

Red teaming at least once a year. Annual penetration testing of IoT/OT (5.14.2.3). Other vulnerability assessments and penetration tests are periodic or on significant change (5.13.1.2).

“Red teaming exercises shall be conducted at least once a year or as required based on changes to the threat landscape, critical systems, or regulatory requirements.”

CORF Ch. 4 5.13.2.7; 5.14.2.3; 5.13.1.2

Threat intelligence must shape red team scenarios. A threat intelligence platform is also required (5.15.1.4).

“Threat intelligence shall be incorporated into red teaming exercises to ensure scenarios reflect real-world adversary TTPs and emerging threats.”

CORF Ch. 4 5.13.2.6

A dedicated, qualified team with specialized expertise. No certification or accreditation scheme is named. The CBK-approved assessor requirement applies to the annual CORF assessment, not to testing.

“Regulated Entities shall engage a dedicated qualified team with specialized expertise to conduct red teaming exercises.”

CORF Ch. 4 5.13.2.8; Ch. 3 §5.3

5.13.2.8 does not say whether the team is in-house or external. 5.13.2.9 requires the exercise to run without prior knowledge of monitoring, incident response and asset owner teams.

Red teaming must assess people as well as systems (5.13.2.5). Awareness programs must be measured with simulated social engineering attacks.

“Regulated Entities shall assess and monitor the effectiveness of the security awareness and training programs through knowledge assessments and simulated social engineering attacks (e.g., mock phishing attacks/phishing simulations).”

CORF Ch. 4 4.5.2.8; 5.13.2.5

Physical and environmental controls must be tested at least quarterly. The text reads as control and maintenance testing, not adversarial intrusion. The red team clauses do not mention physical access.

“The implemented physical and environmental controls shall be appropriately and periodically tested, at least quarterly.”

CORF Ch. 4 5.14.1.11

No rule puts third parties in the security testing scope. Cloud risk assessments must weigh limits on the right to conduct security assessments of the provider; contracts must give a right to audit third parties and subcontractors (Ch. 6 5.2.1.2(a)). Third parties must test their own business continuity plans (Ch. 6 7.3.2.1).

“limitations to right to audit, right to conduct security assessments and right to inspect (onsite and offsite)”

CORF Ch. 4 7.2.2.2(g); Ch. 6 5.2.1.2(a); Ch. 6 7.3.2.1

IoT/OT devices and networks need quarterly vulnerability assessments and annual penetration tests. Examples given are CCTV and building management systems (5.14.2.1).

“IoT/OT devices and their associated networks shall be subject to security assessments, including quarterly vulnerability assessments and annual penetration testing.”

CORF Ch. 4 5.14.2.3

Annual and ad-hoc independent security audits of electronic payment systems using the testing sub-domain procedures. SWIFT CSCF attestation and PCI DSS certification required (4.3.1.3). Digital wallet APIs and gateways need periodic VA/PT (8.3.3.5).

“Regulated Entities shall conduct annual and ad-hoc independent security audits of the electronic payment systems in accordance with: a) the assessment procedures outlined in the Cybersecurity Testing and Threat Management Sub-Domain”

CORF Ch. 4 8.1.1.3; 4.3.1.3; 8.3.3.5

The cloud risk assessment must consider the entity’s right to conduct security assessments of the provider. Otherwise cloud assurance rests on certifications and SOC reports (7.2.3.1, 7.2.3.4(d)). No rule requires testing cloud tenancy.

“limitations to right to audit, right to conduct security assessments and right to inspect (onsite and offsite)”

CORF Ch. 4 7.2.2.2(g); 7.2.3.4(d)

Similar controls must apply to foreign affiliates. Cloud risk assessments must weigh data location and residency (7.2.2.2(d)). DFIR arrangements must cover cross-border investigations (5.12.4.10(b)). Nothing is specific to tests.

“Regulated entities shall ensure similar controls and governance are adhered to in the case of foreign affiliates apart from considering geo-political relations between countries.”

CORF Ch. 6 15.3.1.1; Ch. 4 7.2.2.2(d); 5.12.4.10(b)

Purple teaming appears only as a Level 4 (Advanced) maturity descriptor, not as a baseline control. Entities are scored on maturity.

“Red teaming, purple teaming, or simulated attacks (e.g., phishing, lateral movement) are used to assess detection and response readiness.”

CORF Ch. 3 (Toolkit), maturity model, Technology & Operations, sub-domain Cybersecurity Testing and Threat Management, Level 4 (CORF p. 163)

Red team findings need a remediation plan with timelines tracked to closure (5.13.2.11). Remediated vulnerabilities must be validated.

“Regulated Entities shall conduct validation after remediating the vulnerabilities to assess and confirm whether the gaps addressed are in line with documented risk mitigation decisions.”

CORF Ch. 4 5.13.2.11; 5.13.1.5

Red team findings go to senior management, not to CBK (5.13.2.10). CBK receives annual self-assessments and annual CBK-approved third-party assessments, and runs its own CORF assessments by supervisory tier.

“Furthermore, CBK will conduct CORF assessments for the Regulated Entities based on the frequency corresponding to the supervisory tier in which the Entity is categorized”

CORF Ch. 3 §5.3; Ch. 4 5.13.2.10

AI and ML models must be defended against adversarial attacks. Emerging technology must be tested before and after deployment (7.1.1.6). Maturity Level 4 cites Breach and Attack Simulation; Level 5 cites AI/ML attack path simulation and fully automated testing.

“Regulated Entities shall implement adequate defenses against adversarial attacks (e.g., evasion, data poisoning, inference attacks) targeting AI models.”

CORF Ch. 4 7.1.2.2; 7.1.1.6; Ch. 3 maturity model Levels 4 and 5

Entities in NCSC’s remit must implement the mandatory requirements; exceptions need a documented, time-limited, risk-based approval (Art. 4). Other entities are encouraged to adopt it voluntarily.

“This baseline defines the national minimum cybersecurity controls that Entities MUST implement.”

Decision 2/2026 Art. 4; Annex 1 §4

Civil, military and security government bodies and private-sector institutions in Kuwait within NCSC’s competence, plus entities NCSC designates under Decree 37/2022. Translation by Bendings.

“الجهات الحكومية المدنية والعسكرية والأمنية ومؤسسات القطاع الخاص داخل دولة الكويت ذات الصلة باختصاصات المركز”

Decision 2/2026 Art. 1 (definition of ‘concerned entities’); Art. 3; Annex 1 §3

No penetration test requirement. Automated vulnerability scans monthly for internet-facing systems, quarterly for other important internal systems, and after major changes.

“Run automated vulnerability scans on key systems: at least monthly for internet-facing systems, at least quarterly for other important internal systems, and after major changes.”

Annex 1 PR-1.2

No provision in the reproduced text.

No tester rules. Cloud providers must hold independent certifications (CLD-2).

No provision.

Annual awareness training must cover social engineering and phishing (PR-3). No simulated phishing or social engineering testing.

PR-6 sets physical protections for critical IT areas. No testing.

Correction added by the verifier. GOV-6 counts cloud providers among the service providers an entity must govern. CLD-3 makes a contract right to audit those providers mandatory, exercised through their third-party audit reports. That is supplier assurance under the assurance_only definition. No provider system is placed inside a test. Source is the law-firm reproduction (secondary).

“Contracts MUST include a “Right to Audit. ” To protect the security of multi-tenant environments, this right is exercised by the Entity reviewing the CSP’s independent Third-Party Audit Reports (e.g., SOC 2, C5) rather than conducting physical data center visits.”

Annex 1, Appendix A, CLD-3; GOV-6

Corrected October 30, 2026 from Not addressed. Correction added by the verifier. GOV-6 counts cloud providers among the service providers an entity must govern. CLD-3 makes a contract right to audit those providers mandatory, exercised through their third-party audit reports. That is supplier assurance under the assurance_only definition. No provider system is placed inside a test. Source is the law-firm reproduction (secondary).

IoT/OT devices appear only in the hardware inventory control.

No provision.

Correction, not a change in the text. CLD-3 makes a right to audit the cloud provider a contract term, exercised by reviewing the provider’s independent third-party audit reports. CLD-2 requires review of the provider’s certifications before selection. This is assurance_only as defined in harmonize.json and as applied to CBK CORF. The harmonization pass that added assurance_only recoded only cells first coded required or permitted, so this cell was never reviewed. Cloud systems stay outside any test, and the NBCC sets no penetration test. Source is the law-firm reproduction (secondary).

“Contracts MUST include a “Right to Audit. ” To protect the security of multi-tenant environments, this right is exercised by the Entity reviewing the CSP’s independent Third-Party Audit Reports (e.g., SOC 2, C5) rather than conducting physical data center visits.”

Annex 1, Appendix A, CLD-3; CLD-2

Corrected October 30, 2026 from Not addressed. Correction, not a change in the text. CLD-3 makes a right to audit the cloud provider a contract term, exercised by reviewing the provider’s independent third-party audit reports. CLD-2 requires review of the provider’s certifications before selection. This is assurance_only as defined in harmonize.json and as applied to CBK CORF. The harmonization pass that added assurance_only recoded only cells first coded required or permitted, so this cell was never reviewed. Cloud systems stay outside any test, and the NBCC sets no penetration test. Source is the law-firm reproduction (secondary).

Cloud providers must be authorized in Kuwait (CLD-1) and cloud data handled per the National Data Classification Framework. Nothing on tests.

Only recovery tests and tabletop exercises (RC-2).

After each scan, review, list actions and fix the most serious issues first; keep records. No deadline beyond monthly patching as an aim.

“After each scan, review the report, produce a short action list, and fix the most serious issues first (for example, high and critical findings).”

Annex 1 PR-1.2

NCSC supervises compliance and may request self-assessment results, reports and evidence and examine compliance. Entities self-assess at least yearly (Art. 4, GOV-5). Translation by Bendings.

“يتولى المركز الإشراف على تنفيذ هذا القرار ومتابعة مدى الالتزام به، وله في سبيل ذلك طلب نتائج التقييم الذاتي”

Decision 2/2026 Art. 5; Art. 4; Annex 1 GOV-5

Automated vulnerability scanning is required. Nothing on AI.

“Run automated vulnerability scans on key systems”

Annex 1 PR-1.2

Approved by the CBK Board on June 26, 2023 under Article 28 of the e-payment instructions, which Board decision No. (45/471/2023) issued. Sent by circular on July 5, 2023. Controls use ‘shall’ and ‘must’. The circular is still listed in CBK’s Arabic e-payment circulars chapter, last modified May 2026. CBK publishes Arabic and English texts; quotes use CBK’s English text.

“E-Payment Service Providers and E-Money Service Providers shall abide by the following:”

Circular No. (2/PS/527/2023); Instructions, ‘Instructions Controls’

Current and new e-payment service providers and e-money service providers. Banks and e-payment system operators are not named. Since December 3, 2025 the same firms also fall under CBK CORF as e-payment of funds companies.

“These instructions apply to all E-Payment Service Providers and E-Money Service Providers, both current and newly established.”

Instructions, ‘Scope of Instructions’

One comprehensive security assessment test of each product or service before launch. No recurring cycle is set.

“Comprehensive security assessment tests for the product/service must be conducted by a third party – and all observations in the assessment report must be addressed according to a clear plan compatible with the service provider’s risk management prior to launch of service.”

Instructions, Control 4

No provision in the instructions.

The test must be run by an independent party. CBK’s Arabic text reads ‘من قبل طرف مستقل’ (by an independent party), and the Arabic governs (R4); its English text says ‘a third party’. No certification, accreditation or qualification is named.

“إجراء اختبارات التقييم الأمني الشامل للمنتج/الخدمة من قبل طرف مستقل”

Control 4 in CBK’s Arabic text (printed p. 22) and English text

CBK’s Arabic Control 4 says the pre-launch test is conducted ‘من قبل طرف مستقل’ (by an independent party). Its English Control 4 says ‘by a third party’. The Arabic Control 3 uses ‘طرف ثالث’ (third party) for the PCI DSS approver, so the change of term in Control 4 is in the Arabic itself. CBK does not say which text prevails, so the Arabic is coded (R4). The Arabic does not exclude an in-house team independent of the product; the English does.

“إجراء اختبارات التقييم الأمني الشامل للمنتج/الخدمة من قبل طرف مستقل”

Control 4 in CBK’s Arabic text (printed p. 22) and English text; Arabic Control 3

No provision in the instructions.

No provision in the instructions.

‘Third party’ appears only as the tester (Control 4) and as the PCI DSS approver (Control 3). Suppliers are not mentioned.

No provision in the instructions.

The test covers the e-payment or e-money product or service itself. Firms that store or process bank card data must also hold PCI DSS certification approved by a third party and renewed regularly (Control 3).

“Comprehensive security assessment tests for the product/service must be conducted by a third party”

Instructions, Controls 3 and 4

No provision in the instructions.

No provision. Circular No. (2/PS/528/2023) of the same date covers operating outside Kuwait and has no testing text.

No provision in the instructions.

Every finding in the assessment report must be addressed under a clear plan before the service launches. No retest is named.

“all observations in the assessment report must be addressed according to a clear plan compatible with the service provider’s risk management prior to launch of service.”

Instructions, Control 4

The text does not send test results to CBK. CBK must be notified only if PCI DSS certification is revoked or not renewed (Control 3).

No provision in the instructions.