D1 · National Basic Cybersecurity Controls (NCSC Decision 2/2026) 8
A0
NCSC Decision No. 2 of 2026 (scope and rules)
A1
Govern (GOV-1 to GOV-6)
Dubai ISRIEC 62443ADHICSOman NCFCJISCIS ControlsGDPR (EU)ISO 27001NCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLQatar NIAPDPL – Federal Decree-Law 45/2021UAE IAUK GDPRNCA CCCCBUAE CSFBahrain NCSCDORAHIPAA Security RuleNIS2SAMA CSF
A2
Identify (ID-1 to ID-3)
Dubai ISRIEC 62443ADHICSBahrain NCSCOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
A3
Protect (PR-1 to PR-6)
Dubai ISRIEC 62443Bahrain NCSCOman NCFADHICSCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IACBUAE CSFGDPR (EU)HIPAA Security RulePDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021UK GDPR
A4
Detect (DE-1 to DE-2)
Dubai ISRIEC 62443ADHICSBahrain NCSCOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
A5
Respond (RS-1 to RS-2)
Dubai ISRIEC 62443CBUAE CSFBahrain NCSCOman NCFCJISADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
A6
Recover (RC-1 to RC-2)
Dubai ISRIEC 62443ADHICSCBUAE CSFBahrain NCSCOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
A7
Appendix A: Cloud security (CLD-1 to CLD-16)
Dubai ISROman NCFADHICSCJISCIS ControlsISO 27001NCA CCCNCA ECC-2Qatar NIASAMA CSFUAE IA
D2 · CBK Cyber and Operational Resilience Framework v1.0 (banks) 26
B0
CBK CORF: applicability
B1-4
Governance, Risk, and Compliance (Ch.4 Cyber Resilience Baselines)
Dubai ISRIEC 62443CJISCBUAE CSFBahrain NCSCOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
B1-5
Technology and Operations (Ch.4 Cyber Resilience Baselines)
Dubai ISRIEC 62443ADHICSBahrain NCSCOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRCBUAE CSFCyber EssentialsCyber Essentials Plus
B1-6
Third-Party Risk Management and Supply Chain Management (Ch.4 Cyber Resilience Baselines)
Dubai ISRIEC 62443CJISCBUAE CSFBahrain NCSCOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
B1-7
Emerging Technologies (Ch.4 Cyber Resilience Baselines)
Dubai ISROman NCFADHICSCJISCIS ControlsISO 27001NCA CCCNCA ECC-2Qatar NIASAMA CSFUAE IAIEC 62443GDPR (EU)HIPAA Security RuleNCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021UK GDPR
B1-8
Payments Security (Ch.4 Cyber Resilience Baselines)
Dubai ISRIEC 62443ADHICSCBUAE CSFBahrain NCSCOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRDORANCA CCC
B1-9
Operational Resilience (Ch.4 Cyber Resilience Baselines)
Dubai ISRIEC 62443ADHICSCBUAE CSFBahrain NCSCOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPRPCI DSS 4.0.1SAMA CSF
B2-3
Governance and Oversight (Ch.5 Operational Resilience Baselines)
Dubai ISRIEC 62443ADHICSCBUAE CSFBahrain NCSCOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPRSAMA CSFPCI DSS 4.0.1
B2-4
Risk and Threat Management (Ch.5 Operational Resilience Baselines)
Dubai ISRIEC 62443CJISCBUAE CSFBahrain NCSCOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
B2-5
Business Continuity Management (Ch.5 Operational Resilience Baselines)
Dubai ISRIEC 62443ADHICSCBUAE CSFBahrain NCSCOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
B2-6
Technology Resilience (Ch.5 Operational Resilience Baselines)
Dubai ISRIEC 62443ADHICSCBUAE CSFBahrain NCSCOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
B2-8
Incident and Crisis Management (Ch.5 Operational Resilience Baselines)
Dubai ISRIEC 62443CBUAE CSFBahrain NCSCOman NCFCJISADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRNCA CCC
B2-10
Training, Testing and Continuous Improvement (Ch.5 Operational Resilience Baselines)
Dubai ISRIEC 62443ADHICSCBUAE CSFBahrain NCSCOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPRPCI DSS 4.0.1SAMA CSF
B3-3
Governance Structure and Oversight (Ch.6 Third-Party Risk Management Baselines)
Dubai ISRIEC 62443CJISCBUAE CSFBahrain NCSCOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
B3-4
Risk Management Framework (Ch.6 Third-Party Risk Management Baselines)
Dubai ISRIEC 62443CJISCBUAE CSFBahrain NCSCOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
B3-5
Contractual Agreements Considerations (Ch.6 Third-Party Risk Management Baselines)
Dubai ISRIEC 62443CJISCBUAE CSFBahrain NCSCOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
B3-6
Risk Assessment and Monitoring (Ch.6 Third-Party Risk Management Baselines)
Dubai ISRIEC 62443CJISCBUAE CSFBahrain NCSCOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
B3-7
Business Continuity Management & Disaster Recovery (Ch.6 Third-Party Risk Management Baselines)
Dubai ISRIEC 62443ADHICSCBUAE CSFBahrain NCSCOman NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPRPCI DSS 4.0.1SAMA CSF
B3-8
Incident Management (Ch.6 Third-Party Risk Management Baselines)
Dubai ISRIEC 62443CBUAE CSFBahrain NCSCOman NCFCJISADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRNCA CCC
B3-9
Data Protection and Confidentiality (Ch.6 Third-Party Risk Management Baselines)
Dubai ISRIEC 62443Oman NCFUAE IACJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUK GDPRCBUAE CSFBahrain NCSCDORA
B3-10
Sub-Contracting (Ch.6 Third-Party Risk Management Baselines)
Dubai ISRIEC 62443CJISCBUAE CSFBahrain NCSCOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
B3-11
Exit Strategy (Ch.6 Third-Party Risk Management Baselines)
Dubai ISRIEC 62443CJISCBUAE CSFBahrain NCSCOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
B3-12
Storage of Data (Ch.6 Third-Party Risk Management Baselines)
Dubai ISRIEC 62443ADHICSCBUAE CSFBahrain NCSCOman NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRDORANCA CCC
B3-13
Cross-Border Transaction (Ch.6 Third-Party Risk Management Baselines)
Dubai ISRUK GDPRADHICSGDPR (EU)PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021
B3-14
Usage of Cloud Services (Ch.6 Third-Party Risk Management Baselines)
Dubai ISROman NCFADHICSCJISCIS ControlsISO 27001NCA CCCNCA ECC-2Qatar NIASAMA CSFUAE IAIEC 62443CBUAE CSFBahrain NCSCDORAGDPR (EU)HIPAA Security RuleNCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021UK GDPR
B3-15
Inter-Affiliates (Ch.6 Third-Party Risk Management Baselines)
Dubai ISRIEC 62443CJISCBUAE CSFBahrain NCSCOman NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR