← All frameworks
GCC GCC · 8 Policy & Process · Oman

Oman NCF

Oman National Cybersecurity Framework

RD 64/2020; ISMP v1.0; BSC v1.0; CBO framework

26 controls · 4 domains
Mandatory for: Public sector + CNI
Start assessment in platform →

About this framework

Oman's National Cybersecurity Framework sets baseline security requirements across governance, protection, and incident response for government bodies and critical sectors in the Sultanate.

Who needs this

For Omani government entities and operators of critical national systems.

Cross-framework coverage

Controls in Oman NCF also cover:

Dubai ISR 21 shared
NCA ECC-2 21 shared
Qatar NIA 21 shared
ISO 27001 20 shared
UAE IA 20 shared

See how Oman NCF connects to the rest → the Security Universe

Control domains

D1 · Cyber Defence Centre law (Royal Decree 64/2020) 1
CDC-0
Cyber Defence Centre law (Royal Decree 64/2020)
D2 · Information Security Management Policy (government units) 7
ISMP-5.1
Governance
Dubai ISRIEC 62443CBUAE CSFBahrain NCSCKuwait NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRADHICSPCI DSS 4.0.1
ISMP-5.2
Risk management
Dubai ISRIEC 62443CJISCBUAE CSFBahrain NCSCKuwait NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
ISMP-5.3
Data classification
Dubai ISRIEC 62443ADHICSKuwait NCFCJISCIS ControlsGDPR (EU)ISO 27001NCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLQatar NIAPDPL – Federal Decree-Law 45/2021UAE IAUK GDPRNCA CCC
ISMP-5.4
Training and awareness
Dubai ISRIEC 62443Bahrain NCSCKuwait NCFCJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IAUK GDPR
ISMP-5.5
Incident management
Dubai ISRIEC 62443CBUAE CSFBahrain NCSCKuwait NCFCJISADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
ISMP-5.6
IT continuity
Dubai ISRIEC 62443ADHICSCBUAE CSFBahrain NCSCKuwait NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIAUAE IAUK GDPR
ISMP-6
Responsibility and schedule
Dubai ISRIEC 62443CBUAE CSFBahrain NCSCKuwait NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRADHICSPCI DSS 4.0.1
D3 · Basic Security Controls (government units) 11
BSC-AC
Access controls (AC)
Dubai ISRIEC 62443ADHICSCBUAE CSFBahrain NCSCKuwait NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
BSC-SAT
Security awareness and training (SAT)
Dubai ISRIEC 62443Bahrain NCSCKuwait NCFCJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IAUK GDPR
BSC-IR
Incident response (IR)
Dubai ISRIEC 62443CBUAE CSFBahrain NCSCKuwait NCFCJISADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
BSC-MP
Media protection (MP)
Dubai ISRIEC 62443ADHICSBahrain NCSCKuwait NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
BSC-CM
Configuration management (CM)
Dubai ISRIEC 62443ADHICSBahrain NCSCKuwait NCFCJISCIS ControlsCyber EssentialsCyber Essentials PlusDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRCBUAE CSF
BSC-RA
Risk assessment (RA)
Dubai ISRIEC 62443CJISCBUAE CSFBahrain NCSCKuwait NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
BSC-SCP
System and communications protection (SCP)
Dubai ISRIEC 62443ADHICSBahrain NCSCCJISCIS ControlsCyber EssentialsCyber Essentials PlusNCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIAUAE IAISO 27001Kuwait NCFDORANIS2SAMA CSF
BSC-SAA
Security assessment and authorisation (SAA)
Dubai ISRIEC 62443CJISCBUAE CSFBahrain NCSCKuwait NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
BSC-PEP
Physical and environmental protection (PEP)
Dubai ISRIEC 62443ADHICSHIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIST CSFPCI DSS 4.0.1Qatar NIASAMA CSFUAE IA
BSC-PS
Personnel security (PS)
Dubai ISRIEC 62443NCA ECC-2NCA OTCCNIS2Qatar NIAUAE IAADHICSISO 27001NCA CCCPCI DSS 4.0.1SAMA CSF
BSC-AA
Audit and accountability (AA)
Dubai ISRIEC 62443ADHICSBahrain NCSCKuwait NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
D4 · CBO Cyber Security and Resilience Framework (financial institutions) 7
CBO-S
Scope and timing
CBO-D1
Domain 1 Governance
Dubai ISRIEC 62443CBUAE CSFBahrain NCSCKuwait NCFCJISCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPRADHICSPCI DSS 4.0.1
CBO-D2
Domain 2 Compliance and audit
Dubai ISRCJISADHICSBahrain NCSCKuwait NCFCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
CBO-D3
Domain 3 Technology and operations
Dubai ISRIEC 62443Kuwait NCFUAE IACJISADHICSCIS ControlsGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUK GDPRCBUAE CSFBahrain NCSCCyber EssentialsCyber Essentials Plus
CBO-D4
Domain 4 Third-party and supply chain management
Dubai ISRIEC 62443CJISCBUAE CSFBahrain NCSCKuwait NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR
CBO-D5
Domain 5 Online financial services
Dubai ISRIEC 62443UAE IACJISCIS ControlsNCA ECC-2ADHICSISO 27001NCA CCCPCI DSS 4.0.1Qatar NIASAMA CSFKuwait NCFCyber EssentialsCyber Essentials PlusHIPAA Security RuleNCA OTCCNIS2NIST CSF
CBO-D6
Domain 6 Risk management
Dubai ISRIEC 62443CJISCBUAE CSFBahrain NCSCKuwait NCFADHICSCIS ControlsDORAGDPR (EU)HIPAA Security RuleISO 27001NCA CCCNCA ECC-2NCA OTCCNIS2NIST CSFPCI DSS 4.0.1PDPLData-protection rulesPDPPLPDPL – Federal Decree-Law 45/2021Qatar NIASAMA CSFUAE IAUK GDPR

Ready to assess against Oman NCF?

Start free trial →

Where to go next

Related reading

See it priced

Map Oman NCF on any plan — active frameworks scale by tier.

Pricing →

Talk to us

Book a walkthrough with someone who knows the platform.

Book a walkthrough →