D1 · Operational Risk Management Regulation (Circular C 1/2026) 11
ORM-3
Article 3: Operational resilience
Dubai ISRIEC 62443ADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
ORM-4
Article 4: Board of directors
Dubai ISRIEC 62443CJISBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
ORM-5
Article 5: Senior management
Dubai ISRIEC 62443CJISBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
ORM-6
Article 6: Operational risk function
Dubai ISRIEC 62443CJISBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
ORM-7
Article 7: Internal control system
Dubai ISRIEC 62443Bahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRADHICSPCI DSS 4.0.1
ORM-8
Article 8: ICT and cybersecurity management
Dubai ISRIEC 62443CJISBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
ORM-9
Article 9: Incident management
Dubai ISRIEC 62443Bahrain NCSCKuwait NCFOman NCFCJISADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
ORM-10
Article 10: Risk data and systems
Dubai ISRIEC 62443CJISBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
ORM-11
Article 11: Business continuity planning
Dubai ISRIEC 62443ADHICSBahrain NCSCKuwait NCFOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
ORM-12
Article 12: Change management
Dubai ISRIEC 62443Oman NCFUAE IANCA OTCCQatar NIAISO 27001NCA CCCNCA ECC-2PCI DSS 4.0.1
ORM-13
Article 13: Third party risk management
Dubai ISRIEC 62443CJISBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
D2 · Retail Payment Services and Card Schemes Regulation, Article 13 (payment service providers) 1
RPSCS-13
Article 13: Technology risk and information security (payment service providers)
Dubai ISRIEC 62443CJISBahrain NCSCKuwait NCFOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRCyber EssentialsCyber Essentials Plus
D3 · Related CBUAE instruments 1
REL
Related CBUAE instruments (summary)