Oman, Bahrain strengthen cyber risk governance

By Editorial September 7, 2026

GCC cyber risk governance and critical infrastructure cybersecurity

Oman and Bahrain are strengthening national cyber risk frameworks as GCC states move toward more structured cybersecurity governance.

In late August, Oman launched its National Cybersecurity Strategy 2026-2030. The strategy sets out a five-year framework to strengthen national cyber resilience and protect essential services. It also aims to support a secure digital economy. It is built around five pillars: cybersecurity governance, cyber resilience, capacity building and awareness, cyber cooperation, and the cyber economy. Priorities include stronger public-private cooperation, updated legislation and improved national preparedness.

Oman’s 2026-2030 strategy puts cyber resilience, governance and national preparedness among its core priorities.

Bahrain introduces annual cyber risk assessments

In Bahrain, the National Cyber Security Center (NCSC) introduced new cybersecurity requirements for government and private-sector entities designated by the NCSC within the country’s critical sectors on August 19. The decision introduces mandatory annual cyber risk assessments and a national program for measuring cybersecurity maturity.

Under Bahrain’s National Cyber Security Strategy 2025-2028, the country’s Critical National Infrastructure sectors include government, transportation, financial services, media, healthcare, ICT, commercial and tourism, and energy and critical manufacturing.

The August decision requires designated organizations to assess risks affecting their systems and services, identify and prioritize mitigation measures, prepare remediation plans and submit assessment results to the NCSC. Additional assessments may be required following a cyber incident, major system changes or the emergence of new threats.

Bahrain requires designated organizations in critical sectors to conduct annual cybersecurity risk assessments.

At the regional level, GCC states also adopted two new cybersecurity control frameworks on August 27. The decision came at the fifth GCC Ministerial Committee for Cybersecurity meeting in Bahrain. The meeting also reviewed implementation of initiatives under the GCC Cybersecurity Strategy 2024–2028.