Compliance & Regulations

GCC Cybersecurity Regulations Compared: UAE, KSA, Qatar & More

A side-by-side comparison of GCC cybersecurity regulations: regulators, frameworks, who must comply and how compliance is audited in six countries.

GCC cybersecurity regulations share the same aim but differ in who enforces them and how compliance is proven. The UAE combines the federal UAE IA Regulation with emirate rules such as Dubai’s DESC regime; Saudi Arabia applies the NCA’s ECC; Qatar certifies against its NIA standard; Kuwait, Oman and Bahrain rely on national centres and sector regulators.

UAE: the TDRA designates critical entities under the UAE CIIP Policy to implement the UAE IA Regulation; Dubai adds its own law and Information Security Regulation.
Saudi Arabia: ECC-2:2024 reduced the Essential Cybersecurity Controls from 114 to 108 and applies to government entities and private operators of Critical National Infrastructure.
Qatar: the NCSA runs NIA certification, which involves an accredited auditor and a compliance audit.
Kuwait: NCSC Decision No. 2 of 2026 made the National Basic Cybersecurity Controls a mandatory minimum baseline.
Oman: the Cyber Defence Centre, set up by Royal Decree 64/2020, oversees the 2026 to 2030 national strategy.
Bahrain: the National Cyber Security Center sits within the Ministry of Interior; the Central Bank of Bahrain sets detailed cyber rules for banks.

For a group operating in two or more of these countries, the practical challenge is not reading each framework but running one programme that satisfies all of them. Our regulatory compliance advisory for UAE, GCC and EU frameworks is built around that problem. This article compares the regimes side by side and links to our detailed guides rather than repeating them.

Why are GCC cybersecurity regulations hard to compare?

Each country layers its rules differently. Some obligations come from a national cyber authority, some from an emirate or city authority, and some from sector regulators such as central banks or health departments. A Dubai bank, for example, can face federal, emirate and central bank requirements at the same time. The scope tests also differ: some frameworks bind government bodies and designated critical entities, others bind every licensee of a sector regulator, and a few reach private suppliers through contracts and certification rules.

Proof of compliance varies too. Qatar runs a formal certification scheme. Saudi Arabia’s ECC builds periodic independent review into the controls themselves. Kuwait’s new baseline relies on annual self-assessment. Knowing which model applies tells you what evidence an auditor or regulator will ask for.

How do GCC cybersecurity regulations compare country by country?

The table summarises the national-level picture. Each row cites the source we checked; where a published source did not state something, we say so rather than guess.

Country	Regulator	Key framework	Who must comply	Audit or certification	Source
UAE	TDRA (federal); DESC (Dubai)	UAE IA Regulation; Dubai Information Security Regulation under Law No. 15 of 2024	Critical entities designated by the TDRA under the UAE CIIP Policy; in Dubai, Government Entities and Critical Non-government Entities	In Dubai, DESC develops audit measures, assesses compliance and certifies electronic security activities (Law 15/2024, Art. 6)	u.ae; Dubai Law 15/2024
Saudi Arabia	National Cybersecurity Authority (NCA)	Essential Cybersecurity Controls, ECC-2:2024 (108 controls, 4 main domains)	Government entities and their affiliates inside and outside KSA; private entities owning, operating or hosting Critical National Infrastructure	Controls require periodic review of implementation and periodic audit by parties other than the cybersecurity department (ECC 1-8-1, 1-8-2)	NCA implementation guide; Clyde & Co
Qatar	National Cyber Security Agency (NCSA)	National Information Assurance (NIA) Policy / Standard	Agencies and their information assets unless exempted by statute or regulation; described as applicable to all business segments	NIA certification under the National Information Security Compliance Framework: accredited auditor, compliance audit, certification decision	Microsoft Learn: Qatar NIA
Oman	Cyber Defence Centre (under the Internal Security Service); MTCIT for government guidance	National Cybersecurity Strategy 2026 to 2030; MTCIT Basic Cybersecurity Controls	MTCIT basic controls are directed at government units; the strategy’s sources do not define a compliance population	Not stated in the published sources we reviewed	TechAfrica News; MEA Tech Watch
Bahrain	National Cyber Security Center (Ministry of Interior); Central Bank of Bahrain for financial licensees	CBB Rulebook cyber security risk management modules (e.g. OM-5.5 for conventional banks)	CBB licensees under the relevant rulebook volume	Conventional banks: penetration testing at least twice a year, external testers changed at least every two years (OM-5.5.28)	Decree No. 65 of 2020; CBB Rulebook
Kuwait	National Cyber Security Center (NCSC)	National Basic Cybersecurity Controls (NBCC), adopted by Decision No. 2 of 2026	Civil government agencies, military authorities, security agencies and critical private sector institutions	Annual self-assessments, evidence retention and an 18-month compliance deadline	RSM Kuwait

Operating across borders? We run a multi-country gap assessment that maps your current controls once against the UAE IA Regulation, NCA ECC and any sector rules that apply to you, and gives a single remediation plan. Ask for a GCC regulatory gap assessment.

What applies in the UAE?

At federal level, the TDRA developed the UAE Information Assurance Regulation, which sets management and technical security controls. According to the UAE Government portal, the TDRA designates critical entities under the UAE CIIP Policy to implement it. Many practitioners still call it the NESA standard; our guide to the UAE IA (NESA) standard explains the control structure and how compliance works.

Emirate rules sit on top. In Dubai, Law No. 15 of 2024 sets out the powers of the Dubai Electronic Security Centre, including developing the Information Security Regulation and overseeing compliance by Government Entities and Critical Non-government Entities. Our article on DESC ISR certification in Dubai covers the certification steps. In Abu Dhabi, the Department of Health launched the ADHICS standard in 2019 for all public and private healthcare facilities in the emirate; see our ADHICS compliance guide for Abu Dhabi healthcare providers.

Financial institutions also answer to the Central Bank of the UAE. Its Operational Risk Management Regulation (C 1/2026), in force from 14 September 2026, requires notice within 4 hours of events that significantly affect Critical Operations.

What applies in Saudi Arabia?

The NCA’s Essential Cybersecurity Controls are the national baseline. The NCA implementation guide organises them into four main domains: cybersecurity governance, cybersecurity defence, cybersecurity resilience, and third-party and cloud computing cybersecurity. Clyde & Co reports that ECC-2:2024 reduced the number of controls from 114 to 108 and confirmed that relevant government entities include those established inside and outside the Kingdom. Our NCA ECC compliance guide explains the domains in detail.

Two 2024 changes affect regional groups. Bird & Bird notes that ECC-2:2024 removed the in-country data hosting requirement, although cloud regulations and some sector rules may still require local infrastructure, and that it requires cybersecurity positions to be filled by full-time, qualified Saudi professionals. Financial institutions also follow the SAMA Cyber Security Framework, which applies to all member organisations regulated by SAMA; our SAMA cybersecurity framework guide covers it.

What applies in Qatar, Oman, Bahrain and Kuwait?

Qatar

The NCSA has endorsed the National Information Assurance Policy, which sets an information classification method and guides the choice of controls. To achieve compliance, an organisation implements an information security management system based on the NIA requirements. Certification runs in four stages: scope preparation and documentation, audit planning with an accredited auditor, the compliance audit, and the certification decision.

Oman

The Cyber Defence Centre was established by Royal Decree 64/2020 under the Internal Security Service. It prepared the National Cybersecurity Strategy for 2026 to 2030 and oversees its implementation. For government bodies, the Ministry of Transport, Communications and Information Technology has published guidance including basic cybersecurity controls and a cybersecurity governance guideline. Oman’s central bank has issued a cyber security and resilience framework for licensed banks, finance and leasing companies, payment service providers and money exchanges.

Bahrain

Decree No. 65 of 2020 added the National Cyber Security Center to the Ministry of Interior’s structure, with directorates covering cyber protection, national response and cyber policies. For the financial sector, the Central Bank of Bahrain’s rulebook contains detailed cyber security risk management sections, including testing, incident detection and reporting to the CBB.

Kuwait

According to RSM Kuwait, the NCSC issued Decision No. 2 of 2026 on 5 April 2026, adopting the National Basic Cybersecurity Controls as Kuwait’s mandatory national minimum baseline. It applies to civil government agencies, military and security bodies, and critical private sector institutions, with annual self-assessments and an 18-month deadline.

How do financial-sector cyber rules compare across the GCC?

Banks and payment firms usually face the most detailed requirements, because central banks add their own rules to the national baseline. The table covers the instruments we verified from published texts for this article.

Country	Regulator	Instrument	Example requirement	Source
UAE	Central Bank of the UAE	Operational Risk Management Regulation (C 1/2026)	Notice within 4 hours of events significantly affecting Critical Operations; independent penetration testing of Critical Functions	CBUAE Rulebook
Saudi Arabia	SAMA	SAMA Cyber Security Framework	Applies to all member organisations regulated by SAMA	SAMA Rulebook
Bahrain	Central Bank of Bahrain	Rulebook Volume 1, OM-5.5 Cyber Security Risk Management	Penetration testing at least twice a year, grey box and black box; red team results to the CBB within one month if required	CBB Rulebook
Oman	Central Bank of Oman	Cyber security and resilience framework	Minimum requirements across six control domains, including third-party supply chain and online financial services	Oman Observer

How should a multi-country organisation run one compliance programme?

Build one control library. Write each control once and map it to every framework that applies. Most overlap sits in governance, risk assessment, access control, incident management and continuity.
Start where proof is formal. Prioritise frameworks with certification or external audit (Qatar NIA, Dubai ISR) and regulator-set testing frequencies (CBB), because the evidence bar is fixed.
Keep a separate notification register. Incident reporting deadlines and recipients differ by country and sector; one register avoids missed clocks.
Check data location rules per country. Saudi Arabia’s ECC no longer requires in-country hosting, but other rules may. The CBUAE requires the Master System of Record to be kept in the UAE.
Watch staffing rules. ECC-2:2024’s Saudi-ization requirement affects how you staff the Saudi security function.
Track change. Kuwait’s baseline, Oman’s strategy and the CBUAE regulation are all from 2026. Review your mapping at least annually.

This article is general information, not legal advice. Scope decisions, such as whether a private company counts as critical infrastructure, depend on designation by the relevant authority.

Need one plan for several GCC regulators? We map your controls against each applicable framework, identify the overlap and the gaps, and give you a single prioritised roadmap. Contact us to scope a GCC cybersecurity compliance assessment.

Frequently Asked Questions

Which GCC cybersecurity regulation is the strictest?

There is no single answer, because the frameworks bind different organisations. Saudi Arabia’s ECC applies broadly to government and Critical National Infrastructure, Qatar’s NIA uses formal certification, and the Central Bank of Bahrain sets a fixed penetration testing frequency for banks. The right question is which rules apply to your entities and what evidence each regulator expects.

Does the UAE IA Regulation apply to private companies?

The UAE Government portal says the TDRA designates critical entities under the UAE CIIP Policy to implement the regulation. A private company is in scope if it is designated, and others often adopt it voluntarily or meet it through contracts. Dubai adds separate obligations under Law No. 15 of 2024 for Government Entities and Critical Non-government Entities.

Is ISO 27001 enough to comply with GCC cybersecurity regulations?

ISO 27001 certification is a strong foundation, and Microsoft notes that Qatar’s NIA is designed to ease certification against standards such as ISO 27001. But national frameworks add their own controls, scope rules, reporting duties and staffing or data location requirements. Treat ISO 27001 as the backbone and map each national framework on top.

Which GCC countries have mandatory cybersecurity certification?

Qatar’s NCSA runs NIA certification, involving an accredited auditor and a compliance audit, and Dubai’s DESC certifies electronic security activities and oversees ISR compliance. Saudi Arabia’s ECC requires periodic independent audit of control implementation rather than a certificate. Kuwait’s new baseline relies on annual self-assessment.

How often do GCC cybersecurity regulations change?

Often. Saudi Arabia updated its ECC in 2024, Kuwait made its national baseline mandatory in April 2026, Oman launched a new national strategy for 2026 to 2030, and the Central Bank of the UAE replaced its 2018 operational risk rules in September 2026. Multi-country organisations should review their framework mapping at least once a year.

Sources

Ready to Strengthen Your Security Posture?

We help UAE organizations assess, secure, and stay compliant — with security operations built around your actual risk, not a generic checklist.

Talk to Our Team