Cyber security compliance in Bahrain
Bahrain's National Cyber Security Center gained the power to issue mandatory standards and controls in July 2025, which turned its published baseline and critical infrastructure controls into obligations for designated sectors. The Central Bank of Bahrain runs its own cyber module for licensees, and the Personal Data Protection Law has been in force since 2019. This page sets out who must meet what.
- Frameworks listed5
- Issuing bodies3
- Framework pages3
- Platform languagesEnglish and Arabic
- DeploymentSaaS, private cloud or on-premises
Cybersecurity and data protection frameworks in Bahrain
Who issues each one and who must comply. Open a framework for its structure, obligations and how GRCLens runs it.
Baseline Cyber Security Controls
Designated critical national infrastructure, with other organisations encouraged to adopt them
Open the framework page →CNI Cybersecurity Controls
Critical sectors, with sector standards for government, healthcare, financial, oil, gas and electricity, telecommunications and transportation
Cyber Trust Program
Organisations seeking NCSC recognition across four maturity levels
CBB Rulebook Module OM-5.5, Cyber Security Risk Management
CBB licensees, with Appendix C cyber security control guidelines
Open the framework page →Personal Data Protection Law (Law 30/2018)
Organisations processing personal data in Bahrain. In force since 1 August 2019, with ten implementing orders
Open the framework page →Which cybersecurity frameworks apply in Bahrain?
The National Cyber Security Center publishes Baseline Cyber Security Controls, CNI Cybersecurity Controls with sector standards, a Cyber Trust Program and a national cybersecurity risk management framework. Royal Order 17/2025 of July 2025 empowers it to issue mandatory policies, standards and controls, with the critical sectors named by the Cabinet. Financial institutions add the Central Bank of Bahrain's OM-5.5 module.
Who is Bahrain's cybersecurity authority?
The National Cyber Security Center, established in 2020 and moved under the Supreme Defence Council by Royal Order 30/2024. Sources placing it under the Ministry of Interior, or calling it the NCC, describe an earlier arrangement or use the wrong name. The Cyber Trust Program is now the NCSC's, not the Information and eGovernment Authority's.
What does CBB require of licensees?
The CBB Rulebook's OM-5.5 section on Cyber Security Risk Management, added in January 2020 and amended in July 2021, together with Appendix C's cyber security control guidelines. References to OM-6.6 point to the archived pre-2020 text. CBB also circulated cyber security requirements to licensees in July 2025.
What does Bahrain's PDPL require?
Law 30/2018 has been in force since 1 August 2019 and is supported by ten implementing orders issued in 2022, in Arabic and English. Order 43/2022 sets technical and organisational measures, including 72-hour breach notification, impact assessments and penetration testing, and Order 42/2022 governs transfers.
How GRCLens runs Bahraini frameworks together
The NCSC baseline, the CBB module and the PDPL share one control model in GRCLens, so a bank designated as critical infrastructure evidences each control once for all three, with testing cadences and CBB incident reporting clocks tracked as their own indicators. The platform runs in English and Arabic and can be hosted in Bahrain or fully on-premises.
Official portals and publications
Cyber compliance in Bahrain: common questions
Are NCSC controls mandatory in Bahrain?
Royal Order 17/2025 of July 2025 empowers the NCSC to issue mandatory policies, standards and controls, with critical sectors named by the Cabinet. Its baseline and CNI controls bind those designated entities.
Which CBB Rulebook section covers cyber security?
OM-5.5, Cyber Security Risk Management, with Appendix C's control guidelines. OM-6.6 is the archived pre-2020 text.
How quickly must a personal data breach be reported in Bahrain?
Within 72 hours, under Order 43/2022 issued under the Personal Data Protection Law.
Who oversees Bahrain's National Cyber Security Center?
The Supreme Defence Council, since Royal Order 30/2024.
Sources
Checked against the issuing bodies' own publications in September 2026. Regulations change, so confirm current requirements with the relevant regulator before relying on them.
Run Bahrain's frameworks on one platform
See GRCLens with your own frameworks loaded.