United Arab EmiratesADGM General Rulebook, Cyber Risk Management Framework
ADGM General Rulebook (GEN), Rules 3.5.1 to 3.5.17
In force since .
A sector security regimes rule binding private bodies.
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds an Authorised Person under the Abu Dhabi Global Market General Rulebook, a firm authorised by the ADGM Financial Services Regulatory Authority (reached by declaring that you hold a financial-services license), from .
- Establish and maintain a written Cyber Risk Management Framework approved by your Governing Body, with systems and controls proportionate to the nature, scale and complexity of your activities, and review it regularly and at least annually (Rule 3.5.1).
- Keep a current inventory of your ICT Assets and assess the Cyber Risk associated with them regularly and no less than annually (Rule 3.5.4).
- Establish a process for software updates that addresses security vulnerabilities in your ICT Assets, applies updates in a timely manner and prioritises critical updates (Rule 3.5.10).
- Implement appropriate encryption techniques to protect the confidentiality and integrity of information in transit, at rest, and at end of life (Rule 3.5.11).
- Monitor the effectiveness of your cyber systems and controls, run a comprehensive programme to test the resilience of your IT Systems and Networks regularly and, for internet-facing systems, at least annually, and prioritise and remedy adverse testing outcomes (Rule 3.5.14).
- Continuously monitor your IT Systems and Networks to detect Cyber Incidents and anomalies, and keep a process for escalating actual or potential Cyber Incidents (Rule 3.5.15).
- Establish and maintain a written Cyber Incident Response Plan, test its conditions and procedures regularly, and review it at least annually (Rule 3.5.16).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Financial Services Regulatory Authority of Abu Dhabi Global Market, the Regulator to which an Authorised Person reports a material Cyber Incident.
What this law does
Rule 3.5.1 of the ADGM General Rulebook requires an Authorised Person to establish and maintain a Cyber Risk Management Framework to identify, assess and manage its Cyber Risks effectively. Rule 3.5.1 also requires the framework to be in writing and approved by the Governing Body of the Authorised Person. Rule 3.5.4 requires an Authorised Person to carry out an assessment of the Cyber Risk associated with its ICT Assets regularly and no less than annually.
Rule 3.5.10 requires an Authorised Person to establish a process for the management of software updates that addresses security vulnerabilities in its ICT Assets. Rule 3.5.11 requires an Authorised Person to implement appropriate encryption techniques to protect the confidentiality and integrity of information in transit, at rest, and at end of life.
Rule 3.5.14 requires an Authorised Person to have a comprehensive programme to test the resilience of its IT Systems and Networks, carried out regularly and, for internet-facing systems, at least annually. Rule 3.5.16 requires an Authorised Person to establish and maintain a robust Cyber Incident Response Plan providing for measures to respond to and limit the consequences of a Cyber Incident.
The ADGM Financial Services Regulatory Authority states that the Cyber Risk Management Rules under GEN 3.5 come into effect on .
When LexLint raises it
When your app profile says your app provides financial services.