Bahriya Tersane

Convoys · Compliance and Assurance · QCB

Qatar Central Bank: technology risks for banks. Coming soon

Expected Q1 2027. Qatar. Regulator: Qatar Central Bank (QCB).

The convoy's regime for banks in Qatar. It will hold every numbered statement of the Qatar Central Bank's technology risk circular, enforce and check those a Kubernetes cluster can show, and list the rest as the bank's own evidence, in a dated report in QCB's numbering.

This regime is in preparation. The counts below are taken from the circular; how each statement will be evidenced is planned, and is confirmed when the regime is released.

Who it applies to

Banks regulated by the Qatar Central Bank.

The Qatar Central Bank's technology risk circular, issued in January 2018, binds the banks it regulates in Qatar, and each bank reports its compliance to QCB every year. QCB regulates payment service providers, financial services operators and insurers under instruments of their own, which this regime does not cover.

The circular favours infrastructure under the bank's own control: it treats a private facility the bank controls as the alternative to keeping critical data in a cloud it does not. A cluster on the bank's premises, with the convoy's evidence kept inside it, is that arrangement.

Structure

Ten sections, 516 numbered statements.

The circular is arranged by the part of the bank responsible, from governance and the departments that support it to IT operations, the security of the enterprise's infrastructure and data, and its business applications. Its statements are numbered to four levels. The convoy maps each numbered statement, the smallest unit QCB numbers, so the report gives a result for each one, under QCB's own number. The descriptions below are Mamluk's; the circular's text is not reproduced.

  1. 1 Cyber security governance and its organisation 21
  2. 2 People: personnel security and staff competence 20
  3. 3 Legal and compliance 15
  4. 4 Procurement 6
  5. 5 Risk management 16
  6. 6 Business continuity and recovery 16
  7. 7 Reporting compliance to QCB 4
  8. 8 IT operations 138
  9. 9 Infrastructure, network and data security 209
  10. 10 Business applications 71
The circular's ten sections, described by Mamluk, with the number of statements in each: 516 in all.

Evidence, as planned

What the cluster will show, and what remains the bank's.

Each statement will be classed as for every regime: enforced by an admission policy, checked in the cluster, provided by the platform, or the bank's own evidence. The classes are planned and their counts are published when the regime is released.

  • Enforced, checked and platform (planned). The technical statements are concentrated in IT operations and infrastructure security: change and patch management, logging and its retention, backup, cloud use, access control including privileged and remote access, network segmentation, virtualisation, database hardening, and vulnerability management. Many of them are partly technical, and the report will ask for the bank's evidence of the rest.
  • The bank's evidence (planned). Governance, people, legal and compliance, procurement, risk, business continuity and the annual report to QCB are the bank's to evidence, and the report will list each as such.
  • QCB's own thresholds. Where the circular sets a figure, the convoy will judge against it: event logs kept for at least six months, rather than the twelve NCA ECC requires.
An example of the report format: the opening of the convoy's report for NCA ECC-2:2024, with the run's date and cluster, the statement that the report records technical evidence and does not state compliance, and the requirements counted by result.
An example of the report format, from the convoy's first regime, NCA ECC-2:2024, on a test cluster. The QCB report will take the same form, in QCB's numbering.

The mapping

Mamluk's mapping, keyed to NIST.

Each requirement is mapped to the NIST SP 800-53 Rev. 5 controls it corresponds to, and each NIST control to the checks that evidence it in the cluster. The checks and their NIST mapping are shared by every regime, so a cluster is scanned once and each regime selected is reported from the same evidence, in its regulator's own numbering.

The circular states that it draws on Qatar's National Information Assurance Policy, the NIST Cybersecurity Framework and ISO/IEC 27001, but it maps none of its statements to them.

The regulator publishes no official crosswalk to NIST, so the mapping is Mamluk's own. Before the regime is released, it is checked against the regulator's text a second time, by a reviewer other than its author.

The mapping is Mamluk's, and the report says so. It records the technical evidence the cluster provides; it does not make an organisation compliant, and compliance is determined by your assessor.

Regimes

One convoy, every regime.

Every regime runs in the same installation of the convoy. An organisation that answers to two regulators selects both, and each is licensed separately. The convoy is experimental; the regimes not yet available are coming soon.

Price and availability

Each regime is licensed at USD 24,000 per organisation, per year, with the Tersane core licence; there is no base fee. The convoy needs Kubernetes 1.36 or later, which BKE provides from 2.2.0. See the Compliance and Assurance Convoy for how it works, and its documentation for installation.

Discuss QCB

To discuss the regimes your organisation must meet, or the convoy's licensing, contact Mamluk.

Contact Mamluk