Central Bank of the UAE: operational risk management. Coming soon

Central Bank of the UAE (CBUAE). The CBUAE licenses and regulates banks and other financial institutions in the United Arab Emirates. Its Operational Risk Management Regulation sets their requirements for information and communications technology and cybersecurity, and requires them to comply with the cybersecurity regulations of the other UAE authorities.

UAE Information Assurance Standard (UAE IA). The Information Assurance Standard is the UAE's federal standard of security controls, binding on federal government entities and on critical information infrastructure, banks among them. Version 2.1 holds 134 controls in fifteen families, and maps each control to NIST SP 800-53 itself.

The convoy classes each requirement by how its evidence is obtained: enforced by an admission policy, checked in the cluster, provided by the platform, or the organisation's own evidence. An admission policy is a rule Kubernetes applies to each object as it is created or changed, before the object is stored. It can warn about the object and record the result, or refuse the object. How a regulator's requirement becomes evidence follows one requirement from the regulator's text to the result in the report.

The regime covers the regulation's articles on ICT and cybersecurity, incident management and change management in full, and the clauses of other articles they draw on: 63 requirements in the Central Bank's own numbering. The regulation's other clauses, among them those on the duties of the board and senior management for ICT risk, are outside it.

Each requirement is mapped to the controls of NIST Special Publication 800-53, Revision 5 (SP 800-53), published by the National Institute of Standards and Technology (NIST), and each NIST control to the checks that evidence it in the cluster. NIST is the United States government's standards agency. Its security publications are free to use, and regulators and auditors outside the United States also use them as a common reference. SP 800-53 is a control catalogue: a numbered list of safeguards, each stating one thing an organisation should do, such as AC-6, least privilege, or AU-11, keeping audit records for a set period. Its controls are grouped in 20 families, and because the catalogue is detailed and open, it serves as a common language between regulations that are each written in their own terms.

The checks and their NIST mapping are shared by every regime, so a cluster is scanned once and each regime selected is reported from the same evidence, in its regulator's own numbering.

The Central Bank publishes no mapping of its regulation's requirements to NIST SP 800-53 or to any other catalogue.

The regulator publishes no official crosswalk to NIST, so the mapping is Mamluk's own. Before the regime is released, it is checked against the regulator's text a second time, by a reviewer other than its author.

The report states whose mapping it uses, in these words: “The Central Bank publishes no mapping of this regulation to NIST SP 800-53. The mapping in this report is Mamluk's own.” It records the technical evidence the cluster provides; it does not make an organisation compliant, and compliance is determined by your assessor.