5. Vulnerability Assessment, Penetration Testing and Security Testing

Regular testing of cybersecurity and technology controls is an important component of CBUAE compliance.

LFIs should periodically test their control environment, including relevant ICT systems and other Operational Risk vectors.

For Critical Functions, periodic testing must include penetration testing performed by an independent third party, with results presented to the Board.

A structured security-testing programme can include:

• Vulnerability Assessment
• Network Penetration Testing
• Web Application Penetration Testing
• Mobile Application Penetration Testing
• API Security Testing
• Cloud Security Assessment
• Security Configuration Review
• Vulnerability remediation
• Retesting and closure

Security testing should be connected to the organization’s broader risk-management and remediation programme so that vulnerabilities are identified, risk-assessed, treated, retested and formally closed.

Official CBUAE Reference: CBUAE Article 7 – Internal Control System

6. Cyber Incident Management and Response

CBUAE requires LFIs to maintain appropriate Incident Response and Recovery arrangements, including arrangements for ICT and cybersecurity incidents.

The incident-management framework should address the complete incident lifecycle, including:

• Incident identification
• Classification and severity assessment
• Escalation
• Roles and responsibilities
• Containment
• Investigation
• Response
• Recovery
• Internal and external communication
• Root Cause Analysis
• Corrective actions
• Lessons learned

Material incidents should undergo appropriate Root Cause Analysis, and corrective measures should be implemented to reduce the likelihood or impact of recurrence.

Incident-response and recovery capabilities should also be periodically tested.

Official CBUAE Reference: CBUAE Article 9 – Incident Management

7. Business Continuity and Disaster Recovery

Business Continuity and Disaster Recovery are fundamental components of Operational Resilience.

LFIs must establish appropriate Business Continuity and Disaster Recovery arrangements for Critical Operations.

Key requirements include:

• Business Impact Analysis (BIA)
• Identification of Critical Operations
• Dependency analysis
• Maximum tolerable disruption
• Recovery Time Objectives (RTO)
• Recovery Point Objectives (RPO)
• Business Continuity Plans
• Disaster Recovery Plans
• Crisis-management arrangements
• Communication arrangements
• Third-party dependencies
• BCP/DR exercises
• Severe-but-plausible scenarios
• Lessons learned and remediation

BCP and DR arrangements for Critical Operations should be periodically tested to demonstrate that the institution can recover within established tolerances.

Official CBUAE Reference: CBUAE Article 11 – Business Continuity Planning

8. Third-Party Risk and Outsourcing Management

Financial institutions increasingly depend on cloud providers, technology vendors, fintech companies, managed service providers and other third parties.

CBUAE requires LFIs to maintain a Board-approved Third-Party Risk Management strategy supported by appropriate policies and processes.

Before entering into relevant third-party arrangements, institutions must perform appropriate risk assessments and due diligence.

Key areas include:

• Third-party governance
• Vendor classification
• Third-party risk assessment
• Due diligence
• Cybersecurity assessment
• Operational Resilience assessment
• Contractual controls
• Data security
• Ongoing monitoring
• Performance and risk metrics
• Concentration risk
• Business Continuity
• Exit strategies
• Contingency planning

For arrangements affecting Critical Operations, the LFI must also assess whether the provider maintains an appropriate level of Operational Resilience.

Official CBUAE Reference: CBUAE Article 13 – Third Party Risk Management

Additional Requirements for Banks

Banks operating in the UAE are also subject to the dedicated CBUAE Outsourcing Regulation and Standards for Banks.

Banks must maintain appropriate outsourcing governance and conduct due diligence covering areas including governance, internal controls, financial capacity, cybersecurity, staffing and jurisdictional risk.

Material outsourcing arrangements require prior CBUAE non-objection.

Banks must also maintain an updated outsourcing register, monitor service providers and ensure that outsourced activities remain within the scope of internal audit and compliance.

Official CBUAE References: CBUAE Outsourcing Regulation for Banks C 14/2021 and CBUAE Outsourcing Standards for Banks

9. Data Protection, Data Residency and Information Security

Data protection is closely connected with cybersecurity, outsourcing and Operational Resilience.

Financial institutions should establish appropriate controls covering:

• Data ownership
• Data classification
• Confidentiality
• Access control
• Data security
• Data lifecycle management
• Data sharing
• Third-party access
• Data retention and destruction
• Data residency
• Regulatory access

CBUAE’s outsourcing requirements for banks require appropriate controls to prevent unauthorized access to bank and customer data.

Outsourcing agreements must also address ownership, access, confidentiality, data destruction and relevant UAE Information Assurance requirements.

The CBUAE Operational Risk Management Regulation additionally contains requirements concerning the Master System of Record and its maintenance within the UAE, subject to applicable provisions and exceptions.

Official CBUAE References: CBUAE Article 8 – ICT and Cybersecurity Management and CBUAE Outsourcing Regulation for Banks

10. Technology Change and System Migration Risk

New systems, cloud migrations, digital transformation, application changes and major technology upgrades can introduce Operational Risk, cybersecurity risk, compliance risk and resilience risk.

CBUAE requires LFIs to maintain an appropriate change-management process covering material changes to products, activities, processes and systems.

Risk assessment should consider areas such as:

• Operational Risk
• ICT and cybersecurity risk
• Compliance risk
• Legal risk
• Financial risk
• Customer impact
• Critical Operations
• Operational Resilience

Material changes may require enhanced testing, independent assurance, rollback planning and regulatory notification or non-objection depending on the circumstances.

This makes regulatory assurance particularly important during core banking migrations, cloud migrations, major system replacements and digital-transformation programmes.

Official CBUAE Reference: CBUAE Article 12 – Change Management and Changes in Operations

11. Internal Controls, Compliance and Internal Audit

Effective internal controls and independent assurance are fundamental components of financial-sector governance.

Banks are required to maintain strong internal-control frameworks together with permanent, independent and effective Compliance and Internal Audit functions.

Relevant areas include:

• Internal Control Framework
• Three Lines of Defence
• Risk and Control Matrix
• Segregation of duties
• Control ownership
• Compliance governance
• Compliance monitoring
• Compliance risk assessment
• Internal Audit
• Risk-based audit planning
• Control testing
• Independent assurance
• Audit findings
• Corrective Action Plans
• Board and Senior Management reporting

Internal Audit provides independent assurance over the effectiveness of governance, risk management, compliance and internal controls.

Official CBUAE References: CBUAE Internal Controls, Compliance and Internal Audit Standards

For outsourced activities, CBUAE also requires them to remain within the scope of the Bank’s internal audit and compliance responsibilities.

Outsourcing Reference: CBUAE Article 7 – Internal Audit and Compliance