Law / Bahrain

Cyber Security Risk Management for Conventional Bank Licensees (Rulebook Volume 1, Module OM, Section OM-5.5)

Conventional Banks Cyber Security Risk Management Rules Central Bank of Bahrain Rulebook Volume 1, Module OM, paragraphs OM-5.5.22 to OM-5.5.56

In force.

A sector security regimes rule binding private bodies.

Instrument type: a regulation made under an act
Obligation class: Security, Governance

As of 27 October 2026.

What it requires

This binds a conventional bank licensee of the Central Bank of Bahrain (reached by declaring that you are a bank). The section was added in July 2021.
Conduct periodic assessments of cyber threats and of the maturity, coverage and effectiveness of your cyber security controls, and regular technical assessments to identify vulnerabilities in systems, applications and network devices (OM-5.5.22, OM-5.5.23 and OM-5.5.25).
Implement cyber security incident management processes for timely detection, response and recovery, including a Security Information and Event Management system, and establish a Security Operations Centre (OM-5.5.31 and OM-5.5.35).
Identify the critical systems and services that must be recovered on a priority basis, and make sure they can recover from a cyber security breach within your defined recovery time objective (OM-5.5.45 and OM-5.5.48).
Arrange to seek cyber risk insurance cover from a suitable insurer after a risk-based assessment (OM-5.5.53).
Make sure all employees receive adequate cyber security training on a regular basis, and give role-specific training to the executive board, senior management, cyber security roles and IT staff (OM-5.5.55 and OM-5.5.56).
Report cyber security incidents to the Central Bank of Bahrain on the clocks stated in the separate incident reporting row (OM-5.5.57 and OM-5.5.58).

These lines are LexLint's reading of the law's text, as of 27 October 2026.

Who enforces it

Settledness

As of: 27 October 2026
Open questions: What financial penalty does the Central Bank of Bahrain apply to a conventional bank licensee that breaches Section OM-5.5?

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Rule OM-5.5.22 requires conventional bank licensees to conduct periodic assessments of cyber threats. Rule OM-5.5.25 requires conventional bank licensees to conduct regular technical assessments to identify potential security vulnerabilities for systems, applications and network devices.

Rule OM-5.5.31 requires conventional bank licensees to implement cyber security incident management processes for timely detection, response and recovery, including a Security Information and Event Management system. Rule OM-5.5.35 requires conventional bank licensees to establish a Security Operations Centre. Rule OM-5.5.45 requires conventional bank licensees to identify the critical systems and services that must be recovered on a priority basis.

Rule OM-5.5.53 requires conventional bank licensees to arrange to seek cyber risk insurance cover from a suitable insurer. Rule OM-5.5.55 requires the licensee to ensure that all employees receive adequate training on a regular basis in relation to cyber security and the threats they could encounter.

When LexLint raises it

When your app profile says your app is a bank.

Back to the example · Lint your app