Security testing rules in Oman.

Issued under Banking Law 114/2000 and National Payment Systems Law 8/2018. Implementation deadline July 31, 2024; controls not applied need a CBO waiver (§2.2). Controls use ‘should’, but the text calls them mandated.

“All licensed institutions that are regulated by CBO will be required to adopt these minimum standards for addressing cyber risks/threats.”

§1.1; §1.3; §2.2

All banks in Oman and their foreign branches, finance and leasing companies, money exchange companies and payment service providers. Foreign banks give CBO a letter of comfort.

“All Banks operating in the Sultanate of Oman and their foreign branches.”

§1.4

Penetration test frequency is risk-based; internet-facing systems at least annually or on significant change. No red team requirement.

“For the internet facing systems, penetration testing should be conducted at least annually or whenever there are significant changes to the systems or update.”

§3.3.11 Controlling Measure 2

§3.3.12 requires a threat intelligence process that feeds risk management, but nothing links it to test design.

No tester qualification or accreditation. An annual third-party cyber security assessment is listed among project management controls that ‘should be considered’.

“Ensure a that a third-party cyber security assessment is conducted at least annually.”

§3.1.6 Controlling Measure 5

No rule on who performs penetration tests.

A baseline phishing campaign is listed among steps the institution ‘should consider’ for its awareness program.

“Understand the business context and conduct an initial baseline phishing campaign.”

§3.1.5 (a)

§3.3.3 sets physical security controls with no testing.

Cloud agreements must give the institution audit, examination and review rights at the provider, including cyber security audits and access to the provider’s VA&PT reports. Outsourcing agreements must allow audit by the institution and inspection by CBO (§3.4.3). No rule puts providers in the institution’s own test scope.

“The audit, examination and review rights of the licensed institution at CPS including conducting cyber-security and/or forensic audits, access to reports of third-party audits and Vulnerability Assessment and Penetration Testing (VA&PT).”

§3.4.2 Controlling Measure 12(k); §3.4.3

Scope includes ATMs, CDMs and POS devices (§1.3) but nothing on OT testing.

§3.5.1 covers payment system controls (fraud monitoring, encryption) with no testing. §3.6.2 requires compliance with SWIFT CSP and PCI DSS where applicable.

Due diligence on a cloud provider must confirm the efficacy of its vulnerability assessment and penetration testing, and agreements must give access to its VA&PT reports (12(k)). This covers the provider’s own tests, not tests by the institution.

“robustness of information security processes including cyber-security framework and efficacy of Vulnerability Assessment/Penetration testing)”

§3.4.2 Controlling Measures 6 and 12(k)

Foreign branches of Omani banks are in scope (§1.4), so the framework’s testing duties reach them. Material arrangements with global cloud providers need prior CBO approval, including the data storage location (§3.4.2 Measure 8(f)), a data location rule that would not count alone. Nothing on multi-jurisdiction tests.

“All Banks operating in the Sultanate of Oman and their foreign branches.”

§1.4; §3.4.2 Controlling Measure 8

§3.3.11 Measure 5 asks for regular scenario-based cyber simulation exercises. No purple teaming or replay.

Remediation processes and validation of fixes. VA&PT findings go to the IT and Risk Management committee (Measure 4). No deadline.

“The licensed institutions should establish processes for vulnerabilities remediation that have been identified in the Vulnerability Assessment & Penetration Testing (VA&PT) and to conduct validation of the remediated vulnerabilities to assess and ensure that gaps are fully addressed.”

§3.3.11 Controlling Measures 3 and 4

Test results stay internal. CBO received an external audit of CS&RF implementation by December 31, 2024 and has inspection rights over outsourced services (§3.4.3).

“The licensed institutions should ensure that the CS&RF implemented by the licensed institutions is subjected to external audit, on or before September 30, 2024, and the audit report and the action taken thereon are forwarded to CBO by December 31, 2024.”

§3.6.3 (Control Measures for External Audit); §3.4.3

The maturity model mentions automation of cyber security processes in general. Nothing on automated or AI-driven testing or testing AI.

Ministerial circular to all units of the State Administrative Apparatus, which it directs to comply. Translation by Bendings.

“تلفت هذه الوزارة عناية جميع وحدات الجهاز الإداري للدولة الإلتزام بما يلي”

Circular 11/2022, p. 1

Government websites, portals, service windows, platforms and electronic applications connected to the internet. GC_S1 covers providers serving government units and CNI organizations.

“القيام بإجراءات التقييم الأمني قبل تدشين المواقع، البوابات، النوافذ، المنصات، والتطبيقات (الأنظمة) الإلكترونية الحكومية المرتبطة بالإنترنت”

Circular 11/2022, p. 1, first bullet; GC_S1 ‘Audience’

Before launch, then every one or two years, and on any addition or change. ‘Security assessment’ covers penetration testing and technical assessments (GC_S1 §3). Translation by Bendings.

“القيام بإجراءات التقييم الامني بشكل دوري (كل سنة أو سنتين) أو عند القيام بأي إضافة أو تعديل”

Circular 11/2022, p. 1, second bullet

No provision in the circular or GC_S1.

GC_S1 sets the provider rules: ISO 27001, 12 months of service history, security clearance for the firm and team, lead assessor evidence, and a listed certification for each assessor (for example CREST, OSCP, GPEN, CEH), with accreditation for three years and an annual review (§8). From August 9, 2026 the Cyber Defence Centre runs this accreditation in place of MTCIT (Ministerial Circular No. (15/2026) of August 23, 2026). The circular does not say whether CDC keeps the GC_S1 criteria.

“The assessor(s) must possess at least one of the certifications in the table below for each level and area of assessment.”

GC_S1 §1, §2, §5.4 A, §8; Ministerial Circular No. (15/2026), para. 2 (https://mtcit.gov.om/web/content/62889?unique=1dcefe284fabea308f17a81383f6e2360165eaba)

Neither document says whether a government unit may test itself. GC_S1 Appendix A has the unit ‘select an independent 3rd party assessor’.

GC_S1 covers penetration testing and technical assessments only (§3).

GC_S1 §5.1 lists physical security as a knowledge area for assessors but does not put physical testing in scope.

No provision on testing suppliers.

No provision.

No provision.

The circular’s third bullet requires units hosting systems with MTCIT-accredited cloud providers to request data protection. It does not address testing cloud-hosted systems.

Assessors should be physically present at the government premises and should not use remote access unless asked. Providers and team members need national security clearance (§2). This limits offshore testing.

“Remote Access should not be used for conducting the security assessment unless specifically requested by the requesting organisation”

GC_S1 §4.1; §2

No provision.

Findings must be fixed before launch, and periodic assessments must confirm all vulnerabilities are remediated. No deadline or retest rule. Translation by Bendings.

“ومعالجة الملاحظات الفنية (إن وجدت) قبل التدشين”

Circular 11/2022, p. 1, first and second bullets

Neither document requires results to go to MTCIT. MTCIT accredited providers and reviewed them yearly under GC_S1 §8; from August 9, 2026 the Cyber Defence Centre runs that accreditation (Ministerial Circular No. (15/2026)). No text sends test results to either body.

Providers must not let automated tools cause missed vulnerabilities and must analyse automated tool findings (§6.1). Nothing on AI.

“The service providers are responsible to ensure that technical controls are thoroughly checked to ensure that existing vulnerabilities on the given scope are not overlooked, especially when using an automated tool.”

GC_S1 §4.1; §6.1

A CBO circular to all banks and finance and leasing companies, with a deadline of June 30, 2026 to finalize a BCM framework. The cover calls it supervisory guidance and expectations. The TLPT clause uses ‘shall’; many other clauses use ‘should’.

“to provide supervisory guidance and set clear expectations regarding the establishment, implementation, and ongoing maintenance of effective business continuity capabilities in licensed institutions.”

Circular BM 1225, para. 6 and 7; Annexure §6.4.5(iii)(c)

All licensed domestic banks and finance and leasing companies, with their subsidiaries, foreign branches and representative offices, plus foreign banks’ overseas entities that serve their Oman branches. Payment service providers and money exchanges are not named.

“This framework is applicable to all licensed domestic banks and FLCs including their subsidiaries, foreign branches and representative offices.”

Annexure §2.1; §2.2

Critical systems need TLPT or an equivalent red team exercise at least once every three years. BCP and DR tests are annual (§9.3.1). The text does not define critical systems or say when the first TLPT is due.

“Critical systems shall undergo Threat-Led Penetration Testing (TLPT) or equivalent red-team exercises at least once every three years.”

Annexure §6.4.5(iii)(c)

The test is threat-led by name, and the glossary defines a red team exercise as intelligence-led. The text does not say who supplies the threat intelligence or how scenarios are chosen.

“A controlled, intelligence-led simulation of sophisticated cyberattacks conducted by authorized testers to assess the institution’s ability to detect, respond to, and recover from real-world threats, in accordance with recognized standards.”

Annexure §6.4.5(iii)(c); Glossary, ‘Red-Team Exercise’

No accreditation, certification or independence rule for TLPT or red team providers. The glossary says only ‘authorized testers’ working to ‘recognized standards’.

Silent on whether in-house teams may run the TLPT.

Phishing appears only as a threat (§8.6.3). No social engineering testing.

Physical items concern alternate sites and redundancy for continuity, not intrusion testing.

The framework covers outsourced activities (§2.3). BCM strategy tests must include third-party service providers, and critical providers must have tested continuity plans (§8.11.5). The text does not say whether TLPT must cover supplier-run critical systems.

“The effectiveness of the BCM Strategy shall be verified through integrated testing (business, IT, third-party service providers).”

Annexure §2.3; §6.4.5(iv)(a); §8.11.5

No provision.

BCP tests should use scenarios such as disruption of payment and settlement systems (§9.1.1(i)). That is a continuity test, not a security test. The TLPT clause does not name payment systems.

§8.6.2 notes reliance on cloud providers. No cloud testing rule.

Foreign branches of Omani banks and foreign banks’ overseas entities that serve Oman branches are in scope. Nothing on multi-jurisdiction or mutually recognized tests.

“Licensed foreign banks and their overseas entities who provide the services to the foreign branches operating in the Sultanate of Oman.”

Annexure §2.1; §2.2

TLPT results must inform recovery architecture and incident response procedures (§6.4.5(iii)(d)). No purple teaming or replay.

Gaps found in tests must be fixed within agreed timelines and retested. TLPT results must feed recovery architecture and incident response. Failed BCP tests are retested within three months (§9.2.2).

“Gaps identified during tests shall be addressed within agreed remediation timelines and re-tested for closure.”

Annexure §6.4.5(iii)(d); §6.4.5(iv)(b); §9.2.2

Business continuity and disaster recovery test reports go to the CBO Surveillance Department within six weeks, and action plans within three months. These are not security test results. The text does not say whether TLPT reports go to CBO.

§8.6.1 mentions automation only as a source of exposure. Nothing on automated testing or testing AI.

Applicants must meet Annexure 3 to get a license, and licensees must keep meeting it. Its vulnerability management bullets sit under ‘Organizations are required to adopt the following practices’.

“The provisions in Annexure [3] on [Open Banking Data and Information Security Specification] shall be complied with by the Applicant for obtaining of License.”

§5; Annexure 3 §13.3.1(d)

Licensing covers account information and payment initiation service providers. Annexure 3 says its controls apply to all open banking participants, which include banks as API providers.

“establish a standardized and a clear set of actionable security controls applicable to all participants involved within Oman's Open Banking ecosystem.”

§1.1.1; Annexure 3 §13.2

No interval. Security testing is periodic, on significant change, and before new deployments go live. A penetration test and vulnerability assessment report is part of the license application (§2.5.9(m)).

“Security assessment activities such as vulnerability assessment, baseline security configuration reviews, application security testing, penetration testing and source code reviews of network, systems and applications shall be conducted on periodic basis or whenever significant changes occur to the environment”

Annexure 3 §13.3.1(d)

Penetration tests should consider ‘methods and tools employed by attackers’ (Annexure 3 §13.3.1(d)), and Annexure 3 recommends consulting threat intelligence among other sources for the latest security guidance (§13.1). Neither ties test scenarios or scope to threat intelligence about who targets the firm. Coded as FSA E/1/2022 (‘replicate current attacks’) and NCA CSCC-2.

No tester qualification rule. The license application needs a risk assessment by an independent third-party expert (§2.5.9(f)), which is not a security test.

Silent on who runs penetration tests.

No provision.

Physical items concern disaster recovery redundancy only.

Outsourcing agreements must give CBO, external auditors and internal audit unrestricted access to the provider’s information on the outsourced activity. No rule puts providers in the licensee’s test scope.

“the SLA shall allow the Central Bank, external auditors, and the Licensee's internal audit and compliance officer unrestricted access to all relevant information and documents held by the outsourcing service provider concerning the outsourced activities.”

§6.7.4

No provision.

The tested systems are the web applications and APIs behind payment initiation and account information services. Open APIs must also go through penetration and security testing (Annexure 2 §12.4(b)(iv)).

“Regular Penetration testing should be conducted covering the critical web applications and API infrastructure serving the open banking services.”

Annexure 3 §13.3.1(d); Annexure 2 §12.4(b)(iv)

No cloud testing rule.

Customer data may leave Oman only with CBO approval (§3.9.1), outsourcing within or outside Oman must be notified (§6.7.2), and cross-border outsourcing must not impede CBO supervision (§6.7.5). These are data transfer and outsourcing conditions. A licensee must keep an operational office in Oman with at least two key personnel ordinarily residing there (§2.3.3), a local presence rule that does not limit where others with system access sit. Nothing reaches foreign entities, sets cross-border tests or limits where testers sit.

Annual cyber incident drills test incident response (Annexure 3 §13.3.1(f)). No purple teaming or replay.

Vulnerability management must cover discovery, prioritization and remediation. APIs are fixed and retested before deployment (Annexure 2 §12.4(c)(i), Phase 5). No deadline.

“The process shall include vulnerability discovery, prioritization, and remediation.”

Annexure 3 §13.3.1(d); Annexure 2 §12.4(c)(i)

The license application must include a penetration testing and vulnerability assessment report. After licensing, the text does not require test reports to go to CBO.

“Information technology and information security policy document providing details of the proposed information technology, information security, penetration testing & vulnerability assessment report for the information technology systems”

§2.5.9(m)

Automated SAST, DAST and software composition analysis should run through the development lifecycle. API tests should be automated where possible (Annexure 2 §12.4(c)(i), Phase 4). Nothing on testing AI.

“Automated security scanning and testing controls should be performed throughout the SDLC/DevOps”

Annexure 3 §13.3.1(b); Annexure 2 §12.4(c)(i)

A CBO circular in effect from issue; existing licensees had until December 31, 2023 to comply. The penetration test must be done before a license is granted and then every year.

“All licensed institutions and other stakeholders shall take due note of this policy and ensure compliance accordingly.”

Circular BM 1192, p. 2; Policy §9.3(a)

Payment service providers and entities offering ancillary payment services. The test clause names the applicant; the annual repeat applies after licensing.

“This Policy Document shall define the licensing and other related requirements for Payment Services Providers (PSPs) and entities offering Ancillary Payment Services, operating in the Sultanate of Oman.”

Policy §3.1; §9.3(a)

Before the license is granted, then every year. Vulnerability assessment frequency is risk-based (§9.3(b)).

“This does not need to be completed prior to application but must be completed prior to the grant of License and then on an annual basis.”

Policy §9.3(a)

No provision.

No qualification or accreditation rule for the tester. Only the validation of fixes must be independent (coded under remediation_retest).

Silent on who runs the penetration test.

No provision.

No provision.

Outsourcing needs prior CBO approval and is limited to non-core activities (§10.5). No supplier testing or audit rights tied to testing.

No provision.

The regime governs payment services. The tested online services are the payment service provider’s own.

“To manage the technology risk and risk of online financial services, the applicant performs a penetration test of its proposed online services, remediate all high-risk findings identified, and conduct independent validation on the effectiveness of the remediation actions.”

Policy §9.3(a)

No provision.

‘Cross border’ appears only as a type of payment service (remittance). Nothing on testing across borders.

No provision.

High-risk findings must be fixed and the fixes validated independently. No deadline.

“remediate all high-risk findings identified, and conduct independent validation on the effectiveness of the remediation actions.”

Policy §9.3(a)

CBO may examine licensees’ books and records and order special examinations at the licensee’s cost (§12.4). The text does not require test reports to be sent to CBO.

“The Central Bank of Oman reserves the right to appoint examiners, who shall be its own employees or others appointed by the Central Bank to examine the books of accounts and records of the licensee”

Policy §12.1; §12.4

No provision.

Applies to any legal person providing BNPL in Oman, read with Regulation No. BM/2026/2/61, which CBO announced on February 22, 2026. The penetration test is a license condition and then annual.

“This instruction shall apply to any Legal person providing a BNPL service in the Sultanate of Oman.”

§1.6; §3.1; §8.4

Non-bank BNPL providers licensed by CBO. Banks and finance and leasing companies are excluded.

“This Licensing and Regulatory framework is applicable to BNPL Provider only and not applicable to licensed Banks and Finance & Leasing Companies in the Sultanate of Oman.”

§3.3

Before the request for grant of license, then every year. Vulnerability assessment frequency is risk-based (§8.5).

“must be completed prior to submitting the request for grant of License and then on an annual basis.”

§8.4

No provision.

No qualification or accreditation rule for the tester. Only the validation of fixes must be independent (coded under remediation_retest).

Silent on who runs the penetration test.

No provision.

No provision.

Internal audit may be outsourced with CBO approval (§9.2). No supplier testing.

No provision.

The tested online services are BNPL credit platforms. The text does not name payment systems, cards or SWIFT in test scope.

No provision.

Services to non-residents are banned (§5.3). Nothing on cross-border testing.

No provision.

High-risk findings must be fixed and the fixes validated independently. No deadline.

“remediate all high-risk findings identified, and conduct independent validation on the effectiveness of the remediation actions.”

§8.4

Providers must tell CBO at once of any vulnerability they find. CBO examiners may review IT governance, cybersecurity and resilience (§16.1). The text does not require test reports as such.

“The BNPL provider shall inform the Central Bank immediately about any vulnerabilities that comes to their attention during the conduct of business.”

§8.6; §16.1

AI and machine learning are encouraged for credit assessment (§6.10). Nothing on automated testing or testing AI.

Issued under Article 9 of the Banking Law and the CBO Statute; in effect from June 1, 2025. The only testing clause is a CBO power to require a third-party VAPT.

“The applicant and/or licensed digital bank shall comply with any additional requirements as specified by the Central Bank”

§3.1; §4.1; §11.2; §11.3

Applicants for, and holders of, a digital bank license, including branches of foreign banks.

“Pursuant to Article (9) of the Banking Law, and Articles (8) and (17) of CBO Statute, this framework is applicable to Digital Bank license in the Sultanate of Oman”

§3.1; §5.1

No set cycle. CBO may require the assessment at licensing or at later stages.

“Such assessment can be performed at different stages of its operations.”

§11.3

No provision.

When CBO requires it, the test is run by a qualified and experienced third party at the applicant’s cost. No named certification.

“The Central Bank may require the applicant to appoint a qualified and experienced third-party entity (“assessor”) to perform Vulnerability Assessment & Penetration Testing”

§11.3

The framework’s only testing provision calls for a third-party assessor, so an in-house team cannot meet it. CS&RF duties still apply separately (§11.1(d)).

“The Central Bank may require the applicant to appoint a qualified and experienced third-party entity (“assessor”) to perform Vulnerability Assessment & Penetration Testing”

§11.3

No provision.

No provision.

Digital banks must comply with the outsourcing guidelines and cloud rules (§11.1(g)). No supplier testing.

No provision.

No provision.

§11.1(g) points to the CBO cloud rules (BM 1185), which give audit rights over providers. No cloud testing here.

Foreign bank branches may hold a digital bank license with home supervisor approval (§5.1; §5.4.5). Nothing on cross-border testing.

No provision.

No provision.

CBO may order a third-party VAPT as part of licensing and ongoing supervision. The text does not say the report goes to CBO or that CBO oversees the test.

“after having regard to specific risk profile or business model of a licensed digital bank and the Central Bank’s ongoing supervisory monitoring and assessments of the licensed digital bank.”

§11.2; §11.3

The business plan must describe the strategy for technologies such as artificial intelligence (§6.1(n)). Nothing on automated testing or testing AI.

Listed companies had three months to align their policies (Article 2). The circular took effect on issue. It is still listed in the FSA legislation index.

“SAOG companies that are listed on Muscat Securities Exchange (MSX) (Listed Companies for short) must implement this guideline as minimum requirements.”

Articles 2 and 3; §2.1

All listed SAOG companies, which include listed banks and insurers. Where a sector regulator such as CBO sets conflicting rules, the sector rules prevail.

“If however, the requirements are in conflict with each other, the requirements specified by its sector regulator or any other competent authority shall be implemented”

§2.1

Assessments and testing at least yearly and on change or perceived threats. Every website and mobile app must also have a penetration test (§13; §14), with no interval.

“Information security assessments and testing shall, at a minimum, be carried out annually or more frequently whenever changes are made that could have an impact on the business or perceived threats.”

§10.2; §13; §14

Penetration tests must ‘replicate current attacks’ (§10.2), but the text does not mention threat intelligence.

Regular VAPT must involve an independent third-party provider. Websites must clear a security audit by a ‘certificate agency’ (§13), which the text does not define.

“Regular Vulnerability Assessment and Penetration Testing (VAPT) with an independent third-party provider”

§10.2(c); §13

Scans and network boundary penetration tests (§10.2(a) to (b)) have no rule on who tests, so in-house teams can run them. Regular VAPT must also involve an independent third party.

“Regular Vulnerability Assessment and Penetration Testing (VAPT) with an independent third-party provider”

§10.2(a) to (c)

Periodic assessments must cover people and processes. No phishing or social engineering method is named. Regular cyber drills are required (§9).

“Listed Companies shall conduct a periodic information security assessment of all systems, applications, networks, electronic websites, databases, and physical security systems, people, and processes to identify and address security vulnerabilities and sources of information security threats on a timely basis.”

§10.2

Physical security systems are in the assessment scope. No physical intrusion test is named.

“Listed Companies shall conduct a periodic information security assessment of all systems, applications, networks, electronic websites, databases, and physical security systems, people, and processes to identify and address security vulnerabilities and sources of information security threats on a timely basis.”

§10.2

Contracts must carry security terms (non-disclosure, incident communication, policy compliance) but no audit or test rights (§7.7).

Companies must follow ICS and SCADA requirements and an ISMS that can cover OT (§6.2; §7). No OT testing rule.

SWIFT CSP and PCI DSS compliance is required where relevant (§6.2). No payment system testing.

Data hosting must follow Omani rules (§7.6). No cloud testing.

Only the data hosting rule (§7.6). Nothing on testing across borders.

Regular cyber drills (§9). No purple teaming or replay.

Assessments must identify and address vulnerabilities on a timely basis. No deadline or retest rule.

“to identify and address security vulnerabilities and sources of information security threats on a timely basis.”

§10.2

The audit or risk committee checks implementation each quarter and the annual report confirms compliance (§2). Nothing requires test results to go to the FSA.

No provision.

CDC sets these as conditions for using cloud services outside Oman. Approval lasts two years and can be revoked for non-compliance (Art. 3(12); 3(16)). The document does not state its legal basis. Translation by Bendings.

“السياسات والضوابط التي يجب الالتزام بها من قبل الوحدة المستفيدة للاستفادة من الخدمات السحابية خارج سلطنة عُمان”

Art. 3

State administrative units and institutions or companies that handle classified or sensitive data. Sensitive data includes financial information. Translation by Bendings.

“الوحدة المستفيدة: وحدات الجهاز الإداري للدولة أو المؤسسات أو الشركات التي تتعامل مع البيانات أو المعلومات المصنفة أو الحساسة.”

Art. 1, ‘beneficiary unit’

Annex 1 requires a penetration test with no interval. Technical audit reports go to CDC every six months (Art. 3(6)).

“إجراء الفحص الفني (Penetration Testing) وتحليل المخاطر (Risk Assessment).”

Annex 1, item 5 (https://cdc.gov.om/files/MinimumReqCloud.pdf); Art. 3(6)

No provision.

No rule on who tests. The certification rules in Chapter 4 apply to the cloud provider, not to testers.

Silent on who runs the test.

No provision.

No provision.

Cloud providers must prove valid certifications such as ISO 27001 and SOC 2, give the unit an audit log platform, and report security incidents to CDC. No rule on testing the provider’s own systems. Translation by Bendings.

“على مقدم الخدمة إثبات حصوله على الشهادات ومعايير الجودة العالمية سارية المفعول، على سبيل المثال لا الحصر:”

Chapter 4, items 6, 7 and 10

No provision.

No provision.

A penetration test is a minimum requirement for using cloud services hosted outside Oman. Article 3(6) makes Annex 1 binding. The checklist does not define the test scope.

“إجراء الفحص الفني (Penetration Testing) وتحليل المخاطر (Risk Assessment).”

Annex 1, item 5; Art. 3(6)

The policy sets the conditions for state units and firms with sensitive data that use cloud services hosted outside Oman, and a penetration test is one of its minimum requirements (Art. 3(6); Annex 1, item 5). The testing duty therefore reaches systems hosted abroad. CDC must approve hosting in locations it has not approved (Art. 3(4)), a data location rule that would not count alone. Nothing on where testers sit. Translation by Bendings.

“السياسات والضوابط التي يجب الالتزام بها من قبل الوحدة المستفيدة للاستفادة من الخدمات السحابية خارج سلطنة عُمان”

Art. 3 (chapeau); Art. 3(4); Art. 3(6); Annex 1, item 5 (https://cdc.gov.om/files/MinimumReqCloud.pdf)

No provision.

No provision.

Units send CDC technical audit reports every six months; their content is not defined, and the text does not say they must include penetration test results.

“يتولى القسم المعني بأمن المعلومات في الوحدة المستفيدة مهمة التأكد من تطبيق أفضل الممارسات والضوابط الأمنية والفنية وتزويد المركز بتقارير التدقيق الفنية بشكل دوري كل ستة أشهر إلكترونيا.”

Art. 3(6)

AI appears only as a permitted cloud use (Art. 3(8)) and a ban on providers feeding unit data to AI (Chapter 4, item 8). No testing of AI.

Ministerial circular directing state administrative units to hold their IT service providers to the standards, including the minimum technical standards in Annex 1. Translation by Bendings.

“وعلى وحدات الجهاز الإداري للدولة التأكد من التزام مزودي خدمات تقنية المعلومات عند التعاقد معهم لتقديم خدمات البنى الأساسية، الدعم الفني، ونظم المعلومات بالمعايير التالية:”

Circular 7/2025, p. 1 to 2

IT service providers that run infrastructure, technical support or information systems for state administrative units. Translation by Bendings.

“وعلى وحدات الجهاز الإداري للدولة التأكد من التزام مزودي خدمات تقنية المعلومات عند التعاقد معهم لتقديم خدمات البنى الأساسية، الدعم الفني، ونظم المعلومات بالمعايير التالية:”

Circular 7/2025, p. 1

Periodic assessments and penetration tests, with no interval. Translation by Bendings.

“إدارة وتقييم الثغرات الأمنية (Vulnerability Management and Assessment): تنفيذ تقييمات دورية واختبارات اختراق لتحديد ومعالجة الثغرات الأمنية المحتملة في البنى الأساسية.”

Annex 1, §3 (Security and compliance)

No provision.

Providers must be registered and licensed in Oman and employ qualified staff, but these are general managed service rules, not tester rules.

Silent on whether the provider’s own staff or a separate firm runs the tests.

No provision.

No provision.

The duty falls on the supplier: managed service providers must test the government infrastructure they run. This puts supplier-operated systems in test scope. Translation by Bendings.

“إدارة وتقييم الثغرات الأمنية (Vulnerability Management and Assessment): تنفيذ تقييمات دورية واختبارات اختراق لتحديد ومعالجة الثغرات الأمنية المحتملة في البنى الأساسية.”

Annex 1, §3

No provision.

No provision.

No provision.

Providers must be registered and licensed in Oman, which limits offshore providers. Nothing on where testers sit. Translation by Bendings.

“يجب على مزودي خدمات تقنية المعلومات أن يكونوا مسجلين رسمياً لدى الجهات المختصة في سلطنة عُمان، ويجب أن يمتلكوا التراخيص اللازمة التي تسمح لهم بتقديم هذه الخدمات بشكل قانوني في سلطنة عُمان.”

Circular 7/2025, p. 1, first bullet

No provision.

Tests are to identify and remediate vulnerabilities. No deadline or retest rule. Translation by Bendings.

“إدارة وتقييم الثغرات الأمنية (Vulnerability Management and Assessment): تنفيذ تقييمات دورية واختبارات اختراق لتحديد ومعالجة الثغرات الأمنية المحتملة في البنى الأساسية.”

Annex 1, §3

Providers report to the government unit (Annex 1, §8). MTCIT has no stated role in tests.

No provision.

Ministerial circular with standards that units must follow; MTCIT monitors compliance. Translation by Bendings.

“تتولى وزارة النقل والاتصالات وتقنية المعلومات مراقبة التزام وحدات الجهاز الإداري للدولة بالمعايير الواردة في هذه الوثيقة.”

Standards, ‘Compliance’ section

Mobile and smart device applications of state administrative units. Translation by Bendings.

“تطبق هذه المعايير على وحدات الجهاز الإداري للدولة.”

Standards, ‘Scope’ section

A security assessment before any app launches. Later assessments fall under Circular 11/2022. Translation by Bendings.

“قبل تدشين أي تطبيق، على الوحدة التأكد من استيفاء المتطلبات الأمنية التالية: • الامتثال الى إنهاء إجراءات التقييم الأمني عن طريق إحدى الشركات المعتمدة”

Standards, ‘Security requirements’, item 6

No provision.

The assessment must go through an accredited company. The standard lists Circular 11/2022 among related documents but does not name the accrediting body. Translation by Bendings.

“قبل تدشين أي تطبيق، على الوحدة التأكد من استيفاء المتطلبات الأمنية التالية: • الامتثال الى إنهاء إجراءات التقييم الأمني عن طريق إحدى الشركات المعتمدة”

Standards, ‘Security requirements’, item 6

The assessment must go through an accredited company. The text gives no in-house route.

“قبل تدشين أي تطبيق، على الوحدة التأكد من استيفاء المتطلبات الأمنية التالية: • الامتثال الى إنهاء إجراءات التقييم الأمني عن طريق إحدى الشركات المعتمدة”

Standards, ‘Security requirements’, item 6

No provision.

No provision.

No provision.

No provision.

Apps must use Oman’s approved e-payment gateway (item 10). No payment testing.

No provision.

No provision.

No provision.

Security vulnerabilities must be fixed on a continuing basis. No deadline or retest rule. Translation by Bendings.

“إصلاح الثغرات الأمنية واستكشاف الأخطاء وإصلاحها باستمرار.”

Standards, ‘Security requirements’, item 8

MTCIT monitors units’ compliance with the standards. The text does not say test results go to MTCIT. Translation by Bendings.

“تتولى وزارة النقل والاتصالات وتقنية المعلومات مراقبة التزام وحدات الجهاز الإداري للدولة بالمعايير الواردة في هذه الوثيقة.”

Standards, ‘Compliance’ section

No provision.