Pass your next CBB inspection with fewer surprises. A plain guide to what the Central Bank of Bahrain expects on governance, controls, penetration testing and incident reporting, and how to close the gaps.
The CBB cybersecurity requirements are the cyber security rules in the Central Bank of Bahrain Rulebook for banks, insurers, investment firms, payment providers and other licensees. The framework must follow the NIST Cybersecurity Framework. For banks, the board approves the policy, a qualified CISO leads an independent cyber risk function, and the licensee must run endpoint, email, privileged access and data leakage controls, vulnerability assessments, penetration tests at least twice a year, a SOC with SIEM, and cyber insurance. Serious incidents must be reported to the CBB within one hour under the Volume 2 rules. XS4Arabia helps licensees and their suppliers in Bahrain and the GCC close these gaps.
People search for it under several names: CBB cyber security rules, the CBB Rulebook cyber module or the CBB NIST framework. They all point to the same four building blocks.
The Central Bank of Bahrain publishes its binding rules in a Rulebook split into volumes by licence type, from conventional and Islamic banks to insurance, investment business, specialised licensees and capital markets.
Each volume has a cyber security risk management section. For Islamic banks it is OM-5.5 in the Operational Risk Management module, covering governance, controls, testing, incidents, insurance and training.
The Rulebook requires the cyber risk framework to follow the NIST Cybersecurity Framework and its functions of identify, protect, detect, respond and recover.
An appendix of cyber security control guidelines summarises the framework and gives licensees a reference list to build their strategy and policy on.
Every licensee is covered, but the rules sit in a different place for each licence type and some details differ. Start by finding your own volume.
| Rulebook volume | Who it covers | Where the cyber rules sit |
|---|---|---|
| Volume 1 | Conventional banks | Operational Risk Management module |
| Volume 2 | Islamic banks | Operational Risk Management module, section OM-5.5 |
| Volume 3 | Insurance licensees | Risk Management module, cyber security chapter |
| Volume 4 | Investment business firms | Risk Management module, cyber security chapter |
| Volume 5 | Specialised licensees such as payment and open banking providers | Varies by licence category |
| Volume 6 | Capital markets, including crypto asset licensees | Varies by module, with cyber security control guidelines |
The rule numbers and deadlines in this guide are quoted from the Volume 2 module for Islamic banks, which mirrors the banking rules in Volume 1. Always confirm the current text for your own volume.
The CBB treats cyber security as a board issue, not an IT task. Under the banking rules:
The banking rules list preventive measures that must be in place at a minimum. This is where most gap assessments find work to do.
Testing is the requirement with the clearest calendar, and the one the CBB checks most directly because the reports are submitted to it.
For test types and how to choose a provider, read our guide to penetration testing and VAPT in Bahrain.
The reporting clock is short, so detection and escalation have to be ready before anything happens. Under the Volume 2 rules:
We build software, run infrastructure and secure networks, so we can fix the gaps a compliance review finds instead of only listing them. We read the Rulebook with you, turn each requirement into a task with an owner, and deliver the controls, documents and evidence your compliance team needs.
This is the order we follow with licensees and their suppliers. It turns a long module into a plan you can track.
The duty sits with CBB licensees, but the work reaches everyone who builds or runs their systems.
The most detailed rules, from board reporting and a CISO to twice yearly penetration tests, a SOC, cyber insurance and incident reporting within one hour.
Their volumes carry their own cyber security chapters in the risk management module, with testing and reporting duties that fit their business.
Payment service providers and open banking providers must test their systems, protect customer data and secure the APIs that connect them to banks.
Software houses, hosting and outsourcing providers are not licensed, but their connections are assessed and monitored, and their contracts will ask them to meet the same standard.
If you sell software, apps or IT services to a bank or payment company in Bahrain, expect these points in the tender, the contract or the security review:
On hosting location and cloud rules, see our guide to data residency in Bahrain.
There is no honest fixed price, because a small payment company and a large bank start from very different places. These are the cost lines to compare in any proposal:
For managed protection and monitoring, see our cyber security services in Bahrain.
Serving Bahrain and the Gulf — including Manama, Muharraq and Sitra — since 1995.
Work backwards from the reporting deadlines. A one hour report to the CBB is only possible if your SOC can spot the incident, your playbook names who calls, and the Section A template is already filled in with everything except the details. Rehearse it once with a table top exercise before you need it, and keep your privileged accounts under control with proper identity and access management.
Tell us your licence type, your main systems and your next deadline. We will map where you stand against the CBB cyber security module, fix the gaps with you and send a clear plan and quote.
They are the cyber security rules in the Central Bank of Bahrain Rulebook that apply to banks, insurers, investment firms, payment providers and other CBB licensees. They cover board oversight, a CISO and an independent cyber risk function, a written strategy and policy, technical controls, vulnerability assessments, penetration testing, a SOC with SIEM, incident reporting to the CBB, recovery, cyber insurance and staff training.
It is the section of each Rulebook volume that deals with cyber security risk management. For Islamic banks it is section OM-5.5 of the Operational Risk Management module in Volume 2. Other volumes place the equivalent rules in their own operational risk or risk management modules, so check the volume for your licence.
Yes. The Rulebook requires the cyber security risk management framework to be developed in line with the NIST Cybersecurity Framework, which is summarised in the cyber security control guidelines appendix. Its core functions are identify, protect, detect, respond and recover.
At least twice a year under the banking rules. Tests must follow a recognised methodology such as NIST or OWASP, include grey box and black box testing, be done by certified professionals, and use internal and external independent testers who are changed at least every two years. The report goes to the CBB within two months after the end of the month of the test.
Under the Volume 2 rules for Islamic banks, an incident that compromises customer information or disrupts critical services must be reported to the CBB within one hour, Section A of the incident report must follow within two hours, and Section B with the full root cause analysis within 10 calendar days, with weekly updates until the incident is resolved. Check the exact timelines in the volume for your licence.
Yes. The board must make sure the cyber security risk function is headed by a suitably qualified Chief Information Security Officer with the authority to carry out the strategy. That function must be independent of the IT department and report to the risk management function or an equivalent.
Yes, under the banking rules. Licensees must implement a Security Information and Event Management system and establish a Security Operations Centre tailored to their needs. The rules also say SIEM logs should be kept for five years or longer to support investigations.
The rules bind CBB licensees, including licensed payment and open banking providers. Technology vendors that are not licensed are affected indirectly, because licensees must manage third party risk, include vendor connections and APIs in their vulnerability assessments, and monitor suppliers. In practice your contract and your software will be tested against these rules.
The banking rules require licensees to seek cyber risk insurance cover from a suitable insurer after a risk based assessment of their cyber security risk. The cover can include crisis management costs, claim expenses and loss of revenue from an attack, depending on the assessment.
They are separate and both apply. The Personal Data Protection Law covers how any business handles personal data, while the CBB rules add sector specific cyber security, testing and reporting duties for licensees. A licensee that meets one still has to check the other.
There is no fixed price. The cost depends on the size of your systems, the controls you already have, whether you run your own SOC or use a managed one, the number of applications to test twice a year, and how much documentation and training is missing. We start with a gap assessment so every cost line is clear before you commit.
Message XS4Arabia on WhatsApp at +973 13335333 and tell us your licence type, your main systems and your next CBB deadline. We will review where you stand against the cyber security module and send a clear plan and quote.