← All frameworks
GCC GCC · 8 Policy & Process · Bahrain

Bahrain NCSC

Bahrain NCSC Framework / CBB Cyber Risk Module

Decision 36/2026; CBB OM-5.5 (May 2026)

19 controls · 2 domains
Mandatory for: Gov + critical; banks via CBB
Start assessment in platform →

About this framework

Bahrain's national cybersecurity rules, including the Central Bank's Cyber Risk Module, set baseline security expectations for organisations operating in the Kingdom, with a strong focus on the financial sector.

Who needs this

For organisations operating in Bahrain, particularly regulated financial firms.

Cross-framework coverage

Controls in Bahrain NCSC also cover:

NCA OTCC 15 shared
NCA ECC-2 14 shared
UAE IA 14 shared
Dubai ISR 13 shared
IEC 62443 13 shared

See how Bahrain NCSC connects to the rest → the Security Universe

Control domains

D1 · NCSC Decision No. 36 of 2026 and the sector standards 7
D36
NCSC Decision 36/2026: scope, notification, maturity and risk assessment
Dubai ISRIEC 62443CJISCBUAE CSFKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
STD-GOV
Sector standard: Government services (domain level; the control text is not public)
Dubai ISRIEC 62443CBUAE CSFKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRADHICSPCI DSS 4.0.1
STD-HLT
Sector standard: Healthcare (domain level; the control text is not public)
Dubai ISRIEC 62443CBUAE CSFKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRADHICSPCI DSS 4.0.1Cyber EssentialsCyber Essentials Plus
STD-FIN
Sector standard: Financial services (domain level; the control text is not public)
Dubai ISRIEC 62443CBUAE CSFKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRADHICSPCI DSS 4.0.1
STD-OGC
Sector standard: Oil, gas and critical industry (domain level; the control text is not public)
IEC 62443NCA OTCCDubai ISRKuwait NCFOman NCFADHICSCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAISO 27001NCA CCCNCA ECC-2NIS2NIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IACBUAE CSFGDPR (EU)HIPAA Security RulePDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021UK GDPR
STD-TEL
Sector standard: Telecommunications (domain level; the control text is not public)
Dubai ISRIEC 62443CBUAE CSFKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRADHICSPCI DSS 4.0.1
STD-TRN
Sector standard: Transportation (domain level; the control text is not public)
Dubai ISRIEC 62443CBUAE CSFKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRADHICSPCI DSS 4.0.1
D2 · CBB Rulebook OM-5.5: Cyber security risk management (banks) 12
OM-1
Role of the Board
Dubai ISRIEC 62443CJISCBUAE CSFKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
OM-2
Role of senior management
Dubai ISRIEC 62443CBUAE CSFKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRADHICSPCI DSS 4.0.1
OM-3
Cyber security strategy
Dubai ISRIEC 62443CBUAE CSFKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRADHICSPCI DSS 4.0.1
OM-4
Cyber security policy
Dubai ISRCJISADHICSKuwait NCFOman NCFCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
OM-5
Approach, tools and methodology
Dubai ISRIEC 62443CJISCBUAE CSFKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
OM-6
Prevention controls
Dubai ISRIEC 62443ADHICSCBUAE CSFKuwait NCFOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRNCA CCC
OM-7
Cyber risk identification and assessments
Dubai ISRIEC 62443Kuwait NCFOman NCFADHICSCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IACBUAE CSFGDPR (EU)HIPAA Security RulePDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021UK GDPR
OM-8
Cyber incident detection and management
Dubai ISRIEC 62443CBUAE CSFKuwait NCFOman NCFCJISADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRNCA CCC
OM-9
Recovery
Dubai ISRIEC 62443ADHICSCBUAE CSFKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
OM-10
Cyber security insurance
OM-11
Training and awareness
Dubai ISRIEC 62443Kuwait NCFOman NCFCJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IAUK GDPR
OM-12
Reporting to CBB
Dubai ISRIEC 62443CBUAE CSFKuwait NCFOman NCFCJISADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR

Ready to assess against Bahrain NCSC?

Start free trial →

Where to go next

Related reading

See it priced

Map Bahrain NCSC on any plan — active frameworks scale by tier.

Pricing →

Talk to us

Book a walkthrough with someone who knows the platform.

Book a walkthrough →