Law / Bahrain

Cyber Security Risk Management for Insurance Licensees (Rulebook Volume 3, Module RM, Section RM-9.1)

Insurance Cyber Security Risk Management Rules, Central Bank of Bahrain Rulebook Volume 3, Module RM, paragraphs RM-9.1.1 to RM-9.1.57

In force.

A sector security regimes rule binding private bodies.

Instrument type: a regulation made under an act
Obligation class: Security, Governance

As of 27 October 2026.

What it requires

This binds an insurance licensee of the Central Bank of Bahrain (reached by declaring that you are an insurer). The section was added in October 2019 and amended in January 2022.
Have your Board ensure a robust cyber security risk management framework, developed in accordance with the NIST Cyber security framework, that covers a cyber security strategy, policy and risk management approach, tools and methodology (RM-9.1.1 to RM-9.1.3).
Implement cyber security incident management processes for timely detection, response and recovery, and assign the roles and resources to detect, investigate and respond to cyber incidents (RM-9.1.32 and RM-9.1.36).
Identify the critical systems and services that must be recovered on a priority basis (RM-9.1.46).
Arrange to seek cyber risk insurance cover from a suitable insurer after a risk-based assessment (RM-9.1.54).
Make sure all employees receive adequate cyber security training on a regular basis (RM-9.1.56).
Report cyber security incidents to the Central Bank of Bahrain on the clocks stated in the separate incident reporting row (RM-9.1.58 and RM-9.1.59).

These lines are LexLint's reading of the law's text, as of 27 October 2026.

Who enforces it

Settledness

As of: 27 October 2026
Open questions: What financial penalty does the Central Bank of Bahrain apply to an insurance licensee that breaches Section RM-9.1?

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Rule RM-9.1.1 requires the Board of insurance licensees to ensure that the licensee has a robust cyber security risk management framework to manage its cyber security risk and vulnerabilities. Rule RM-9.1.3 requires the cyber security risk management framework to be developed in accordance with the NIST Cyber security framework. Rule RM-9.1.32 requires licensees to implement cyber security incident management processes for timely detection, response and recovery.

Rule RM-9.1.46 requires licensees to identify the critical systems and services that must be recovered on a priority basis. Rule RM-9.1.54 requires licensees to arrange to seek cyber risk insurance cover from a suitable insurer. Rule RM-9.1.56 requires the licensee to ensure that all employees receive adequate training on a regular basis in relation to cyber security and the threats they could encounter.

When LexLint raises it

When your app profile says your app is an insurer.

Back to the example · Lint your app