The Central Bank of the UAE’s Information Security Regulation applies to every licensed financial institution operating in the UAE. First-time filers routinely underestimate the control depth it demands. Here is what we see fail, and what to do about it.
Who it applies to
The CBUAE Information Security Regulation applies to all CBUAE-licensed entities — banks, finance companies, exchange houses, payment service providers, stored value facility issuers, and finance companies. If you hold a CBUAE licence, you file. There is no size threshold.
What it demands
The regulation sets expectations across governance, risk management, access control, cryptography, third-party management, incident response, business continuity, and reporting. It aligns broadly with ISO 27001 Annex A but adds sector-specific obligations that ISO alone does not cover.
The five areas where first-time filers get stuck
1. Board-level accountability, not board-level signoff
CBUAE expects the board to actively oversee information security, not merely approve a policy annually. That means minuted board discussions on cyber risk at least quarterly, an independent reporting line for the CISO, and board-approved risk appetite statements with quantified thresholds. A single annual sign-off page in the board pack will not pass review.
2. Third-party due diligence depth
Vendor questionnaires are table stakes. CBUAE expects documented risk assessments proportionate to the service, independent assurance evidence (SOC 2, ISO 27001 certificates) where relevant, right-to-audit clauses in contracts, and documented offboarding of data on contract termination. A SaaS inventory with no mapped risk tier is a finding.
3. Cryptographic key management
Cryptography appears in the regulation as a short section, but the control detail CBUAE assessors ask for is substantial. Expect to produce: a key inventory with ownership and lifecycle status, documented key ceremonies for HSM-held keys, segregation of duties enforced on key management roles, and quantum-readiness posture statements. A statement that “all data is encrypted in transit and at rest” does not satisfy this.
4. Incident reporting timelines
CBUAE expects notification of material incidents within specified windows — typically within 2 hours of determination for incidents affecting services, with a formal report within 24 hours. Your incident response plan must name the person authorized to notify CBUAE and define materiality thresholds. We frequently see IR plans that cover technical containment well but have no CBUAE notification playbook.
5. Independent assurance
CBUAE expects periodic independent assurance of the information security program. This is not the same as internal audit, and it is not the same as ISO 27001 certification. It is a scoped assessment by an independent third party against CBUAE’s own control expectations, with findings reported to the board.
How first-time filers should sequence their work
- Gap assessment against the regulation — not against ISO 27001. The mapping is not 1:1.
- Governance uplift first. Policies, board papers, risk appetite, CISO reporting line. These are visible on day one of any CBUAE assessment.
- Technical controls second. Access management, encryption, logging, vulnerability management.
- Third-party program and incident response third. These are process-heavy and take months to mature.
- Independent assurance last. Only after the above is operational — a premature assessment just produces a finding list you already knew about.
What to do this quarter
Run a scoped gap assessment against the current CBUAE Information Security Regulation. Sequence remediation by regulatory enforcement risk, not control-domain tidiness. Plan the independent assurance engagement for 9–12 months after remediation begins, not sooner.
The Risk Labs supports CBUAE-licensed institutions through gap assessment, remediation, and independent assurance. Scope an engagement.