CBB Rulebook Module OM-5.5 — Cyber Security Risk Management compliance software

Module OM-5.5, Cyber Security Risk Management, sits in Volume 1 (conventional banks) and Volume 2 (Islamic banks) of the Central Bank of Bahrain Rulebook, effective 1 July 2021 and most recently amended in May 2026. It binds every CBB-licensed bank, and the two volumes are textually near-identical — differing only in the entity noun used and, in one paragraph, the incident-report email address.

The module itself sets 62 numbered rules across twelve headings — the role of the Board and of Senior Management, strategy, policy, approach and methodology, prevention, risk identification and assessment, incident detection and management, recovery, insurance, training and reporting to CBB — and Appendix C adds 109 control guidelines organised into the five NIST-style functions: Identify, Protect, Detect, Respond, Recover. 171 controls in total across seventeen domains.

The reporting clocks are specific and unforgiving: CBB must be called within one hour of detecting a reportable incident and emailed within two hours, with a root-cause report due within ten calendar days and weekly updates until resolved. Penetration testing runs at least twice a year with the external tester rotated at least every two years, and SIEM logs must be retained at least five years. GRCLens carries every OM-5.5 rule and Appendix C guideline with its own deadline, so the reporting clock is a tracked control, not a note in a policy binder.