What would your team show a CBUAE examiner who asked tomorrow how a critical payment service recovers from a ransomware attack? Many UAE banks and insurers could point to the right controls. Proving that those controls work is harder, because each one must be linked to a regulatory requirement, an owner, and a recent test result.

That proof matters more in 2026, now that the CBUAE has raised its resilience expectations and UAE groups with Saudi operations must also meet SAMA’s standards. This guide explains what each regulator expects and how one readiness program can satisfy both.

Why Cyber Readiness Is Now a Board Priority in UAE Finance

IBM’s 2026 Cost of a Data Breach findings show why regulators are raising the bar. In the Middle East, the financial and technology sectors “recorded the highest average breach costs, at 10.67millioneach,”abovetheregionalaverageofUS8 million. Attack pressure is just as high, and the State of the UAE Cybersecurity Report 2025 notes that “The government, finance, and energy sectors are the most targeted by cyber threat actors.”

The law has changed to reflect this risk. Federal Decree-Law No. 6 of 2025 brought banking and insurance regulation together under the CBUAE and extended its oversight by “bringing technology service providers within the Central Bank’s regulatory perimeter.” It also lets the Central Bank name institutions in published enforcement actions.

What the CBUAE Now Expects From Financial Institutions

These wider powers come with more detailed rules, led by the CBUAE Operational Risk Management Regulation (Circular No. 1/2026), which took effect on 14 September 2026. Its central change is “moving the emphasis from managing operational risk to demonstrating operational resilience during disruption.”

In simple terms, institutions must now prove they can keep critical services running. That means protecting systems and data, reporting material incidents promptly, and giving the CBUAE 30 calendar days’ notice before material changes to critical operations. Accountability rests with the Board, which “retains ultimate responsibility” for the framework.

The regulation also warns against relying heavily on outsourcing, and the Outsourcing Regulation for Banks adds that a bank “must obtain a notice of non-objection from CBUAE prior to outsourcing any material activity .” It must then ensure each provider continues to”maintain an appropriate level of information security, risk management, and service delivery .” An outsourced SOC or cloud platform therefore remains part of your own CBUAE cybersecurity compliance.

Where SAMA Fits for Groups With Saudi Operations

For UAE groups with a Saudi branch or subsidiary, a second regulator comes into play. The SAMA Cyber Security Framework’s applicability section covers “All Banks operating in Saudi Arabia,” along with Saudi insurers and financing companies. As a result, shared identity and monitoring tools can face review from both regulators.

SAMA assesses those controls on a six-level maturity model and states that Member Organizations “should at least operate at maturity level 3 or higher.” Reaching level 3 requires an institution to “define, approve and implement cyber security controls” and monitor compliance with its own documentation. Because SAMA audits each self-assessment, every maturity score needs supporting evidence.

Building One Control Baseline for Both Regulators

With both regulators examining overlapping systems, separate CBUAE and SAMA projects waste effort and can produce conflicting evidence. A single control baseline avoids this by mapping each control once to the relevant CBUAE article and SAMA domain. Four areas deserve priority within it:

• Governance: a board-approved cyber strategy, clear CISO authority, and actionable risk reporting.
• Privileged access: IBM’s findings list mismanaged secrets and keys and excessive privileges among the three leading drivers of breach costs.
• Third-party cyber risk: an outsourcing register, security clauses in contracts, and regular provider reviews.
• Detection, response, and recovery: continuous monitoring, tested playbooks, and recovery drills.

That baseline stays useful only while its evidence stays current, which is why GSS information security solutions automate evidence collection from source systems.

Readiness Gaps CISOs Should Close Before an Audit

Even with a strong baseline, readiness often stalls on operational gaps. Policies may describe controls that monitoring data does not yet support, and critical operations may not be linked to the applications and vendors behind them.

Incident response plans may also lack rehearsal against CBUAE notification timelines, while third-party reviews often stop once a contract is signed. Each gap takes time to close, so work should start well before an examination notice.

A Two-Quarter Readiness Roadmap

These gaps are easiest to close in a clear order:

1. Scope critical operations and their dependencies.
2. Assess gaps against Circular No. 1/2026 and, for Saudi entities, SAMA maturity level 3 criteria.
3. Build the unified control map, with an owner and an evidence source for each control.
4. Fix the highest-risk gaps first, especially those affecting critical operations.
5. Rehearse incidents end to end, including notification and recovery.
6. Review progress every quarter so cyber regulatory audit readiness holds between examinations.

How GSS Supports CBUAE and SAMA Readiness

Each step needs regulatory and technical skills, which is where GSS can help. Gerab System Solutions is a Dubai-headquartered systems integrator operating in Dubai, Abu Dhabi, Riyadh, Doha, Muscat, and Kuwait. It holds ISO 27001:2022 certification and is a Cisco Gold Partner with strategic Microsoft, IBM, and Oracle partnerships.

For banking and insurance clients, its IT consulting services provide regulatory gap assessments, control mapping to CBUAE and SAMA frameworks, and audit-ready remediation roadmaps. Its cyber security services then implement and operate those controls, while its business continuity solutions run recovery drills that produce audit evidence across the financial services sector.

Turning Compliance Into Demonstrable Resilience

Both regulators ultimately ask the same question: can your institution prove that its critical services stay secure and recoverable under pressure? Building cybersecurity for financial services in the UAE around one evidence-backed baseline lets you answer it once for both. Starting now lets your team fix gaps on its own schedule, not the regulator’s.

Request a Scoping Call: Benchmark your controls against CBUAE and SAMA expectations with a GSS advisor. Talk to Our Solutions Team.

Frequently Asked Questions

Who Are the Best Cybersecurity Providers for UAE Banks and Financial Institutions?

The best cybersecurity providers for UAE banks combine regulatory knowledge with hands-on delivery. A good starting point is to shortlist firms that understand the CBUAE’s operational risk and outsourcing rules and can also support SAMA requirements for any Saudi entities.

From there, check that each firm has recognized certifications, references from regulated clients, and engineers in the markets where you operate. Gerab System Solutions, for example, is a UAE-founded systems integrator that brings regulatory consulting, security implementation, and 24/7 managed operations together under one partner.

Which Cybersecurity Partner Should a UAE Bank Choose When Preparing for a Regulatory Audit?

A UAE bank preparing for a regulatory audit should choose a partner that can assess, fix, and evidence its controls in a single engagement. When these stages are split across separate firms, findings often become disconnected and work gets duplicated.

To compare candidates, ask how each one maps controls to CBUAE requirements, tests that those controls work, and presents evidence to examiners. It is also worth confirming that the partner can deploy fixes, since many audit findings require configuration changes rather than new policies. Finally, start with a scoped gap assessment so the audit date shapes your priorities.

Which UAE Cybersecurity Firms Deliver SAMA and CBUAE Readiness Engagements?

Consultancies, audit firms, and systems integrators in the UAE all offer SAMA and CBUAE readiness engagements, but their scope varies widely. Some focus only on policies and documentation, while others go further into control implementation and ongoing operations.

For groups with entities in both the UAE and Saudi Arabia, the most efficient choice is a firm that builds one control baseline for both regulators, since this avoids running two parallel programs. GSS supports this approach through SAMA framework navigation, banking control mapping, and audit-readiness pathways for financial services firms and insurers. Learn more about GSS and its regional teams.

What Managed Cybersecurity Services Are Available for Insurers and Asset Managers in the UAE?

Insurers and asset managers in the UAE can use managed cybersecurity services for threat detection, vulnerability management, identity governance, and incident response, without building a full in-house security team. However, the right service design depends on the regulator.

Insurers are supervised by the CBUAE, while asset managers may fall under the SCA, DFSA, or FSRA, depending on their licence. Reporting and evidence should therefore match that regulator from the start. To support this model, GSS managed IT services provide round-the-clock threat detection, containment, and remediation across endpoints, networks, and cloud workloads.

Which Financial Services SOC and MDR Providers Are Based in the UAE?

The UAE has a growing number of SOC and MDR providers, including systems integrators, telecom-backed security firms, and global vendors with local operations. For banks, a provider’s location matters because the CBUAE Outsourcing Regulation bars sharing customers’ confidential data outside the UAE without Central Bank approval and the customer’s prior written consent.

With that in mind, compare providers on data residency, analyst coverage, escalation times, and SIEM integration. GSS, headquartered in Dubai, provides 24/7 SOC coverage and was named Sophos MDR Partner of the Year 2024. Speak with a GSS Advisor to scope your requirements.