{"id":30713,"date":"2026-09-27T00:22:43","date_gmt":"2026-09-26T21:22:43","guid":{"rendered":"https:\/\/www.xs4arabia.com\/?page_id=30713"},"modified":"2026-09-27T00:22:43","modified_gmt":"2026-09-26T21:22:43","slug":"%d9%85%d8%aa%d8%b7%d9%84%d8%a8%d8%a7%d8%aa-%d8%a7%d9%84%d8%a3%d9%85%d9%86-%d8%a7%d9%84%d8%b3%d9%8a%d8%a8%d8%b1%d8%a7%d9%86%d9%8a-%d8%a7%d9%84%d9%85%d8%b5%d8%b1%d9%81-%d8%a7%d9%84%d9%85%d8%b1%d9%83%d8%b2%d9%8a","status":"publish","type":"page","link":"https:\/\/www.xs4arabia.com\/ar\/cbb-cybersecurity-requirements-bahrain\/","title":{"rendered":"\u0645\u062a\u0637\u0644\u0628\u0627\u062a \u0627\u0644\u0623\u0645\u0646 \u0627\u0644\u0633\u064a\u0628\u0631\u0627\u0646\u064a \u0644\u0645\u0635\u0631\u0641 \u0627\u0644\u0628\u062d\u0631\u064a\u0646 \u0627\u0644\u0645\u0631\u0643\u0632\u064a: \u0648\u062d\u062f\u0629 \u0627\u0644\u0623\u0645\u0646 \u0627\u0644\u0633\u064a\u0628\u0631\u0627\u0646\u064a \u0641\u064a \u062f\u0644\u064a\u0644 \u0627\u0644\u0623\u0646\u0638\u0645\u0629 \u0648\u0627\u0644\u0645\u0648\u0627\u0639\u064a\u062f \u0627\u0644\u0646\u0647\u0627\u0626\u064a\u0629 \u0648\u0642\u0627\u0626\u0645\u0629 \u062a\u062d\u0642\u0642 \u0644\u0644\u0627\u0645\u062a\u062b\u0627\u0644"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

CBB Cybersecurity Requirements in Bahrain: The Rulebook Cyber Security Module, Deadlines and a Compliance Checklist<\/h1>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Pass your next CBB inspection with fewer surprises. A plain guide to what the Central Bank of Bahrain expects on governance, controls, penetration testing and incident reporting, and how to close the gaps.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\tTalk to Our Team<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
<\/i><\/span>
By the XS4Arabia Team<\/strong>Security and infrastructure engineers who have built and protected business systems for companies across Bahrain and the Gulf since 1995. Rule references are taken from the published CBB Rulebook. Practical guidance, not legal or regulatory advice. Reviewed for accuracy in 2026.<\/span><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
<\/i> QUICK ANSWER<\/span>

The CBB cybersecurity requirements are the cyber security rules in the Central Bank of Bahrain Rulebook for banks, insurers, investment firms, payment providers and other licensees. The framework must follow the NIST Cybersecurity Framework. For banks, the board approves the policy, a qualified CISO leads an independent cyber risk function, and the licensee must run endpoint, email, privileged access and data leakage controls, vulnerability assessments, penetration tests at least twice a year, a SOC with SIEM, and cyber insurance. Serious incidents must be reported to the CBB within one hour under the Volume 2 rules. XS4Arabia helps licensees and their suppliers in Bahrain and the GCC close these gaps.<\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
<\/i> THE BASICS<\/span>

What Is the CBB Cybersecurity Framework?<\/h2>

People search for it under several names: CBB cyber security rules, the CBB Rulebook cyber module or the CBB NIST framework. They all point to the same four building blocks.<\/p>

<\/i><\/span>

The CBB Rulebook<\/h3>

The Central Bank of Bahrain publishes its binding rules in a Rulebook split into volumes by licence type, from conventional and Islamic banks to insurance, investment business, specialised licensees and capital markets.<\/p><\/div>

<\/i><\/span>

The cyber security module<\/h3>

Each volume has a cyber security risk management section. For Islamic banks it is OM-5.5 in the Operational Risk Management module, covering governance, controls, testing, incidents, insurance and training.<\/p><\/div>

<\/i><\/span>

The NIST based framework<\/h3>

The Rulebook requires the cyber risk framework to follow the NIST Cybersecurity Framework and its functions of identify, protect, detect, respond and recover.<\/p><\/div>

<\/i><\/span>

Control guidelines<\/h3>

An appendix of cyber security control guidelines summarises the framework and gives licensees a reference list to build their strategy and policy on.<\/p><\/div><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
<\/i> COMPARE<\/span>

Which CBB Licensees Must Meet the Cybersecurity Requirements?<\/h2>

Every licensee is covered, but the rules sit in a different place for each licence type and some details differ. Start by finding your own volume.<\/p>

Rulebook volume<\/th>Who it covers<\/th>Where the cyber rules sit<\/th><\/tr><\/thead>
Volume 1<\/td>Conventional banks<\/td>Operational Risk Management module<\/td><\/tr>
Volume 2<\/td>Islamic banks<\/td>Operational Risk Management module, section OM-5.5<\/td><\/tr>
Volume 3<\/td>Insurance licensees<\/td>Risk Management module, cyber security chapter<\/td><\/tr>
Volume 4<\/td>Investment business firms<\/td>Risk Management module, cyber security chapter<\/td><\/tr>
Volume 5<\/td>Specialised licensees such as payment and open banking providers<\/td>Varies by licence category<\/td><\/tr>
Volume 6<\/td>Capital markets, including crypto asset licensees<\/td>Varies by module, with cyber security control guidelines<\/td><\/tr><\/tbody><\/table><\/div>

The rule numbers and deadlines in this guide are quoted from the Volume 2 module for Islamic banks, which mirrors the banking rules in Volume 1. Always confirm the current text for your own volume.<\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
<\/i> GOVERNANCE<\/span>

CBB Governance Requirements: Board, CISO and Cyber Security Committee<\/h2>

The CBB treats cyber security as a board issue, not an IT task. Under the banking rules:<\/p>