RM-A.1.1

This Module contains requirements relating to the management of risk by investment firm licensees. It expands on certain high level requirements contained in other Modules. In particular, Section AU-2.6 of Module AU (Authorisation) specifies requirements regarding systems and controls that have to be met as a license condition; Principle 10 of the Principles of Business (ref. PB-1.10) requires investment firm licensees to have systems and controls sufficient to manage the level of risk inherent in their business; and Module HC (High-level Controls) specifies various requirements relating to the role and composition of Boards, and related high-level controls.

RM-A.1.2

This Module obliges investment firm licensees to recognise the range of risks that they face and the need to manage these effectively. Their risk management framework is expected to have the resources and tools to identify, monitor and control all material risks. The adequacy of a licensee's risk management framework is subject to the scale and complexity of its operations, however. In demonstrating compliance with certain Rules, licensees with very simple operational structures and business activities may need to implement less extensive or sophisticated risk management systems, compared to licensees with a complex and/or extensive customer base or operations.

RM-A.1.3

The requirements contained in this Module apply to Category 1 investment firms and Category 2 investment firms only.

RM-A.1.4

This Module contains the Central Bank of Bahrain's ('CBB') Directive (as amended from time to time) regarding Risk Management requirements applicable to investment firm licensees, and is issued under the powers available to the CBB under Article 38 of the Central Bank of Bahrain and Financial Institutions Law 2006 ('CBB Law').

RM-A.1.5

For an explanation of the CBB's rule-making powers and different regulatory instruments, see section UG-1.1.

RM-A.2.1

This Module was first issued in July 2007, as part of the second phase release of Volume 4's contents. It is dated July 2007. All subsequent changes to this Module are annotated with the end-calendar quarter date in which the change was made: UG-3 provides further details on Rulebook maintenance and version control.

RM-A.2.2

A list of recent changes made to this Module is provided below:

RM-A.2.3

This Module does not replace any regulations or circulars in force prior to July 2007.

RM-A.2.4

Further guidance on the implementation and transition to Volume 4 (Investment Business) is given in Module ES (Executive Summary).

RM-B.2.1

Bahraini investment firm licensees must ensure that, as a minimum, the same or equivalent provisions of this Module apply to their branches, whether located inside or outside the Kingdom of Bahrain, such that these are also subject to an effective risk management framework. In instances where local jurisdictional requirements are more stringent than those applicable in this Module, the local requirements are to be applied.

RM-B.2.2

Bahraini investment firm licensees must satisfy the CBB that their subsidiaries and other group members (where relevant) are subject to appropriate arrangements such that they too effectively manage their risks.

RM-B.2.3

Where an investment firm licensee is unable to satisfy the CBB that its subsidiaries and other group members are subject to appropriate risk management arrangements, the CBB will assess the potential impact of risks — both financial and reputational — that this poses to the investment firm licensee. The CBB recognises that different types of activity require different approaches to risk management, and it does not necessarily expect arrangements to be in place elsewhere in a group equivalent to those contained in this Module. However, where the CBB assesses that risk management weaknesses in subsidiaries and other group members pose material risks to the investment firm licensee, the CBB may impose restrictions on dealings between the licensee and other group members. Where such weaknesses are assessed by the CBB to pose a major threat to the stability of the investment firm licensee, then its authorisation may be called into question.

RM-B.2.4

Overseas investment firm licensees must satisfy the CBB that the same or equivalent arrangements to those contained in this Module are in place at the head office level, as well as ensuring that there is effective risk management of activities conducted under the Bahrain license.

RM-B.2.5

In assessing compliance with Paragraph RM-B.2.4, the CBB will take into account regulatory requirements applicable to the head office, i.e. the company of which the Bahrain branch is part, as well as the risk management framework applied to the Bahrain operation. With the exception of specific requirements that explicitly apply to overseas investment firm licensees, overseas investment firm licensees should consider the contents of this Chapter as guidance, in judging whether risk management controls applied to the branch satisfy RM-B.2.4.

RM-1.1.1

The Board of Directors of investment firm licensees must take responsibility for the establishment of an adequate and effective framework for identifying, monitoring and managing risks across all its operations.

RM-1.1.2

The CBB expects the Board to be able to demonstrate that it provides suitable oversight and establishes, in relation to all the risks the investment firm licensee is exposed to, a risk management framework that includes setting and monitoring policies, systems, tools and controls.

RM-1.1.3

Although authority for the management of a firm's risks is likely to be delegated, to some degree, to individuals at all levels of the organisation, the overall responsibility for this activity should not be delegated from its governing body and relevant senior managers.

RM-1.1.4

An investment firm licensee's failure to establish, in the opinion of the CBB, an adequate risk management framework will result in it being in breach of Condition 6 of the Licensing Conditions of Section AU-2.6. This failure may result in the CBB withdrawing or imposing restrictions on the licensee, or the licensee being required to inject more capital.

RM-1.1.5

The Board of Directors must also ensure that there is adequate documentation of the licensee's risk management framework.

RM-1.1.6

The risk management framework of investment firm licensees must provide for the establishment and maintenance of effective systems and controls as are appropriate to their business, so as to identify, measure, monitor and manage risks.

RM-1.1.7

An effective framework for risk management should include systems to identify, measure, monitor and control all major risks on an on-going basis. The risk management systems should be approved and periodically reviewed by the Board as outlined in HC-1.2.10.

RM-1.1.8

The systems and controls required by RM-1.1.6 must be proportionate to the nature, scale and complexity of the firm's activities.

RM-1.1.9

The processes and systems required must enable the licensee to identify the major sources of risk to its ability to meet its liabilities as they fall due, including the major sources of risk in each of the following Categories:

RM-1.1.10

A Bahraini investment firm licensee must have a risk management function commensurate with the nature, scale and complexity of its business.

RM-1.1.11

Where a licensee maintains a risk management function, this function must be independent of risk-taking units. The duties of the risk management function include but are not limited to:

RM-1.1.12

The CBB will only consider a licensee not having a risk management function, where its investment activities are limited in scale and complexity, and appropriate mitigating controls are in place.

RM-1.1.13

Unless otherwise agreed in writing with the CBB, the risk management function of a Bahraini investment firm licensee, may not be outsourced to a third party.

RM-1.1.14

An overseas investment firm licensee may establish a risk management function commensurate with the nature, scale and complexity of its business. The risk management function may be combined with another function. The CBB will consider an overseas investment firm licensee not having a local risk management function, provided that it seeks CBB's approval to outsource this function to its Head Office, in accordance with Section RM-7.3 (Intra-group Outsourcing). In such case, the CBB must be satisfied that equivalent arrangements to those contained in this Module are in place at the Head Office level, and that such arrangements would entail effective risk management of activities conducted by the overseas investment firm licensee.

RM-2.1.5

Investment firm licensees must implement an effective system for monitoring counterparty risk which should be described in a credit risk policy.

RM-2.1.6

Investment firm licensees must meet the Counterparty Risk Requirements in Module CA-3.3. The licensee must monitor its exposures and must notify the CBB if its total exposure to an individual counterparty exceeds 25% of aggregate counterparty exposures and/or 25% of the licensee's regulatory capital.

RM-2.1.7

Individual credit facilities and overall limits should be periodically reviewed, in order to check their appropriateness for both the current circumstances of the counterparty and the firm's current internal and external economic environment. The frequency of review should be appropriate to the nature of the facility, but in any event should take place at least once a year.

RM-2.1.8

Investment firm licensees must maintain appropriate records of:

RM-2.1.9

For the purposes of this Module, connected counterparties means all undertakings with which the licensee has close links; the Directors (and their family) of the licensee; and the Directors (and their family) of undertakings with which the licensee has close links.

RM-3.1.5

Investment firm licensees must identify significant concentrations within their asset portfolios. This should be done in relation to:

RM-3.1.6

Investment firm licensees must identify on and off balance sheet impacts on its liquidity.

RM-3.1.7

For the purposes of RM-3.1.6, the licensee should take into account:

RM-3.1.8

An investment firm licensee must establish and maintain a process for the measurement, monitoring and controlling of liquidity risk, using a robust and consistent method which should be described in its liquidity risk policy statement.

RM-3.1.9

An investment firm licensee's monitoring framework must include a system of management reporting which provides clear, concise, timely and accurate liquidity risk reports to relevant functions within the firm. These reports must alert management when the investment firm licensee approaches, or breaches, predefined thresholds or limits, including quantitative limits imposed by the CBB.

RM-3.1.10

Reports on liquidity risk should be provided on a timely basis to the investment firm licensee's governing body, senior management and other appropriate personnel. The appropriate content and format of reports depends on a licensee's liquidity management practices and the nature, scale and complexity of the licensee's business. Reports to the investment firm licensee's governing body may be less detailed and less frequent than reports to senior management with responsibility for managing liquidity risk.

RM-3.1.11

For the purposes of testing liquidity risk, licensees must carry out appropriate stress testing and scenario analysis, including taking reasonable steps to identify an appropriate range of realistic adverse circumstances and events in which liquidity risk might occur or crystallise. Licensees should normally consider scenarios based on varying degrees of stress and both firm-specific and market-wide difficulties. In developing any scenario of extreme market-wide stress that may pose systemic risk, it may be appropriate for an investment firm licensee to make assumptions about the likelihood and nature of CBB intervention.

RM-3.1.12

A scenario analysis in relation to liquidity risk should include a cash-flow projection for each scenario tested, based on reasonable estimates of the impact (both on and off balance sheet) of that scenario on the firm's funding needs and sources.

RM-3.1.13

Investment firm licensees must set limits in accordance with the nature, scale and complexity of their activities. The structure of limits should reflect the need for investment firm licensees to have systems and controls in place to guard against a spectrum of possible risks, from those arising in day-to-day liquidity risk management to those arising in stressed conditions.

RM-3.1.14

The CBB would normally expect a licensee to consider setting limits on:

RM-3.1.15

Investment firm licensees must maintain contingency funding plans for taking action to ensure, so far as they can, that they can access sufficient liquid financial resources to meet liabilities as they fall due. These plans must also include what events or circumstances may lead to action under the plan being triggered.

RM-3.1.16

The contingency funding plan should contain administrative policies and procedures that will enable the licensee to manage the plan's implementation effectively, including:

RM-4.1.4

Investment firm licensees must have in place appropriate risk reporting systems that enable them to identify the types and amount of market risk to which they are (or potentially could be) exposed to. The information that systems should capture may include but is not limited to position data which may consist of raw time series of position rates, index levels and prices and derived time series of benchmark yield curves, spreads, implied volatilities, historical volatilities and correlations.

RM-4.1.5

Investment firm licensees must carry out stress testing to access the resilience of their financial resources to any identified areas of material market risk under reasonably foreseeable circumstances. This stress testing may take into account the rating and geographical spread of its assets, the duration of their maturity relative to the licensee's liabilities and the fluctuation of interest and currency rates.

RM-4.1.6

The licensee should consider potential market risk events that may affect its solvency. These include the following:

RM-4.1.7

Where the licensee considers that the nature of its assets and the matching of its liabilities result in no significant market risk exposure (eg. its investments consist entirely of cash and bank deposits), it will not be expected to carry out stress testing. The CBB will expect it to document the reasons for its decision and be prepared to discuss these during an onsite visit.

RM-4.1.8

Wherever possible, a licensee must mark to market the value of its financial instruments, based on readily available close out prices from independent sources.

RM-4.1.9

Where marking to market is not possible, a firm must use mark to model in order to measure the value of its financial instruments. Marking to model is any valuation which has to be benchmarked, extrapolated or otherwise calculated from a market input.

RM-4.1.10

A licensee must ensure that its Board of Directors and senior management are aware of the positions which are subject to mark to model and understand the materiality of the uncertainty this creates in the reporting of the performance of the business of the firm and the risks to which it is subject.

RM-4.1.11

In addition to marking to market or marking to model, a licensee must perform independent price verification, such that market prices or model inputs are regularly verified for accuracy and independence.

RM-4.1.12

Systems and controls regarding valuations should include the following:

RM-4.1.13

The investment firm licensee's risk reporting and monitoring system should be independent of the employees who are responsible for exposing the licensee to risk.

RM-4.1.14

The market risk policy of a licensee may require the production of market risk reports at various levels within the licensee. These reports should provide sufficiently accurate market risk data to relevant functions within the licensee, and should be timely enough to allow any appropriate remedial action to be proposed and taken, for example:

RM-4.1.15

Risk monitoring reports and systems must be subject to periodic independent review by suitably qualified staff.

RM-4.1.16

Risk control is the independent monitoring, assessment and supervision of business units within the defined policies and procedures of the market risk policy. This may be achieved by:

RM-4.1.17

In relation to market risk, an investment firm licensee must retain appropriate prudential records of:

RM-4.1.18

A licensee should keep a data history to enable it to perform back testing of methods and assumptions used for stress testing and scenario analysis and for VaR models.

RM-5.1.14

When monitoring their operational risk, investment firm licensees must:

RM-5.1.15

Investment firm licensees must retain an appropriate record of their operational risk management activities.

RM-5.1.16

RM-5.1.15 may, for example, include records of:

RM-8.1.6

The investment firm licensee must have adequate, sound and appropriate risk management processes and internal control mechanisms for the purpose of assessing and managing its own exposure to group risk, including sound administrative and accounting procedures.

RM-8.1.7

For the purposes of RM-8.1.6, the question of whether the risk management processes and internal control mechanisms are adequate, sound and appropriate should be judged in the light of the nature, scale and complexity of the group's business and the level of interaction between the investment firm and the group.

RM-8.1.8

Where a licensee is part of a larger financial services group, it may rely on the systems and controls that the group (or its parent company) has put in place. The Board in these circumstances should establish what systems and controls are in place and should ensure that it is provided with sufficient and timely information on the financial position of the group. This should be evidenced in the prudential records retained in Bahrain.

RM-8.1.9

The internal control mechanisms referred to in RM-8.1.6 must include:

RM-8.1.10

In assessing group risk systems and controls, the investment firm licensee must give consideration to:

RM-8.1.11

A licensee should not be subject to material influence by other entities of the group through informal or undocumented channels. The overall governance, high-level controls and reporting lines within the group should be clearly documented.

RM-8.1.12

Where the investment firm licensee's group or parent reports its own capital adequacy position to its regulatory authority (on a group or 'solo' basis), a copy of this calculation must be provided to the CBB within 30 calendar days from the due date to the other regulatory authority.

RM-9.1.1

The Board of investment firm licensees must ensure that the licensee has a robust cyber security risk management framework to comprehensively manage the licensee’s cyber security risk and vulnerabilities. The Board must establish clear ownership, decision-making and management accountability for risks associated with cyber-attacks and related risk management and recovery processes.

RM-9.1.2

Licensees must ensure that the cyber security risk management framework encompasses, at a minimum, the following components:

RM-9.1.3

The cyber security risk management framework must be developed in accordance with the National Institute of Standards and Technology (NIST) Cyber security framework which is summarized in Appendix A – Cyber security Control Guidelines. At the broader level, the Cyber security framework should be consistent with the licensee’s risk management framework.

RM-9.1.4

Senior management, and where appropriate, the board should receive comprehensive reports covering cyber security issues such as the following:

RM-9.1.5

The Board must ensure that the cyber security risk management framework is evaluated for scope of coverage, adequacy and effectiveness every three years or when there are significant changes to the risk environment, taking into account emerging cyber threats and cyber security controls.

RM-9.1.6

Licensees must have in place arrangements, commensurate with their size and risk profile, to handle cyber security risk management responsibilities. Licensees may assign the responsibilities to a qualified Chief Information Security Officer (CISO) reporting to an independent risk management function or incorporate the responsibilities of cyber security risk into the risk management function. Overseas investment firm licensees must be governed under a framework of cyber security risk management policies which ensure that an adequate level of oversight is exercised by the regional office or head office.

RM-9.1.7

Licensees should ensure that appropriate resources are allocated to the cyber security risk management function for implementing the cyber security framework.

RM-9.1.8

Licensees must ensure that the cyber security risk management function is headed by suitably qualified Chief Information Security Officer (CISO), with appropriate authority to implement the Cyber Security strategy.

RM-9.1.9

Licensees may establish a cyber security committee that is headed by an independent senior manager from a control function (like CFO / CRO), with appropriate authority to approve policies and frameworks needed to implement the cyber security strategy, and act as a governance committee for the cyber security function. Membership of this committee should include senior management members from business functions, IT, Risk and Compliance.

RM-9.1.10

The senior management must be responsible for the following activities:

RM-9.1.11

The senior management must ensure that:

RM-9.1.12

With respect to Subparagraph RM-9.1.11(a), data classification entails analyzing the data the licensee retains, determining its importance and value, and then assigning it to a category. When classifying data, the following aspects of the policy should be determined:

The general guideline for data classification is that the definition of the classification should be clear enough so that it is easy to determine how to classify the data. In other words, there should be little (if any) overlap in the classification definitions. The owner of data (i.e. the relevant business function) should be involved in such classification.

RM-9.1.13

An organisation-wide cyber security strategy must be defined and documented to include:

RM-9.1.14

The cyber security strategy should be communicated to the relevant stakeholders and it should be revised as necessary and, at least, once every three years. Appendix A provides cyber security control guidelines that can be used as reference to support the licensee’s cyber security strategy and cyber security policy.

RM-9.1.15

Licensees must implement a written cyber security policy setting forth its policies for the protection of its electronic systems and client data stored on those systems, which must be reviewed and approved by the licensee’s senior management, as appropriate, at least annually. The cyber security policy areas including but not limited to the following must be addressed:

RM-9.1.16

Licensees must ensure that the cyber security policy is effectively implemented through a consistent risk-based approach using tools and methodologies that are commensurate with the size and risk profile of the licensee. The approach, tools and methodologies must cover all cyber security functions and controls defined in the cyber security policy.

RM-9.1.17

Licensees should establish and maintain plans, policies, procedures, process and tools (“playbooks”) that provide well-defined, organised approaches for cyber incident response and recovery activities, including criteria for activating the measures set out in the plans and playbooks to expedite the licensee’s response time. Plans and playbooks should be developed in consultation with business lines to ensure business recovery objectives are met and are approved by senior management before broadly shared across the licensee. They should be reviewed and updated regularly to incorporate improvements and/or changes in the licensee. Licensees may enlist external subject matter experts to review complex and technical content in the playbook, where appropriate. A number of plans and playbooks should be developed for specific purposes (e.g. response, recovery, contingency, communication) that align with the overall cyber security strategy.

RM-9.1.18 RM-9.1.18

A Licensee must develop and implement preventive measures across all relevant technologies to minimise the licensee’s exposure to cyber security risk. Such preventive measures must include, at a minimum, the following:

RM-9.1.23

Licensees must conduct periodic assessments of cyber threats. For the purpose of analysing and assessing current cyber threats relevant to the licensee, it should take into account the factors detailed below:

RM-9.1.24

Licensees must conduct periodic assessments of the maturity, coverage, and effectiveness of all cyber security controls. Cyber security control assessment must include an analysis of the controls’ effectiveness in reducing the likelihood and probability of a successful attack.

RM-9.1.25

Licensees should ensure that the periodic assessments of cyber threats and cyber security controls cover all critical technology systems. A risk treatment plan should be developed for all residual risks which are considered to be above the licensee’s risk tolerance levels.

RM-9.1.26

Licensees must conduct regular technical assessments to identify potential security vulnerabilities for systems, applications, and network devices. The vulnerability assessments must be comprehensive and cover internal technology, external technology, and connections with third parties. Assessments for external public facing services and systems must be more frequent.

RM-9.1.27

With respect to Paragraph RM-9.1.26, external technology refers to the licensee’s public facing technology such as websites, apps and external servers. Connections with third parties includes any API or other connections with fintech companies, technology providers, outsourcing service providers etc.

RM-9.1.28

Licensees must have in place vulnerability and patch management processes which include remediation processes to ensure that the vulnerabilities identified are addressed and that security patches are applied where relevant within a timeframe that is commensurate with the risks posed by each vulnerability.

RM-9.1.29

All licensees must perform penetration testing of their systems, applications, and network devices to verify the robustness of the security controls in place at least once a year. These tests must be used to simulate real world cyber-attacks on the technology environment and must:

RM-9.1.30

CBB may require additional third-party security reviews to be performed as needed.

RM-9.1.31

The tests referred to in Paragraph RM-9.1.29 must be conducted each year in June and the report on such testing must be submitted to the CBB before 30^th September. The penetration testing reports must include the vulnerabilities identified and a full list of ‘passed’ tests and ‘failed’ tests together with the steps taken to mitigate the risks identified.

RM-9.1.32

Licensees must implement cyber security incident management processes to ensure timely detection, response and recovery for cyber security incidents. This includes implementing a monitoring system for log correlation and anomaly detection.

RM-9.1.33

Licensees should receive data on a real time basis from all relevant systems, applications, and network devices including operational and business systems. The monitoring system should be capable of identifying indicators of cyber incidents and initiate alerts, reports, and response activities based on the defined cyber security incident management process.

RM-9.1.34

Licensees should retain the logs and other information from the monitoring system for detecting cyber incidents, including "low-and-slow" attacks, in order to facilitate incident investigations, for 12 months or longer.

RM-9.1.35

Once a cyber incident is detected, licensees should activate their containment measures, processes and technologies best suited to each type of cyber incident to prevent a cyber incident from inflicting further damage. This may involve, after considering the costs, business impact and operational risks, shutting down or isolating all or affected parts of their systems and networks as deemed necessary for containment and diagnosis.

RM-9.1.36

Licensees must define roles and responsibilities and assign adequate resources to detect, identify, investigate and respond to cyber incidents that could impact the licensee’s infrastructure, services and customers. Such responsibilities must include log correlation, anomaly detection and maintaining the licensee’s asset inventory and network diagrams.

RM-9.1.37

Licensees must regularly identify, test, review and update current cyber security risk scenarios and the corresponding response plan. This is to ensure that the scenarios and response plan remain relevant and effective, taking into account changes in the operating environment, systems or the emergence of new cyber security threats. If any gaps are identified, the monitoring system must be updated with new use cases and rule sets which are capable of detecting the current cyber incident scenarios.

RM-9.1.38

The cyber incident scenario tests should include high-impact-low-probability events and scenarios that may result in failure. Common cyber incident scenarios include distributed denial of service (DDoS) attacks, system intrusion, data exfiltration and system disruption. Licensees should regularly use threat intelligence to update the scenarios so that they remain current and relevant. Licensees should periodically review current cyber incident scenarios for the purpose of assessing the licensee’s ability to detect and respond to these scenarios if they were to occur.

RM-9.1.39

Licensees must ensure that critical cyber security incidents detected are escalated to an incident response team, management and the Board, in accordance with the licensee’s business continuity plan and crisis management plan, and that an appropriate response is implemented promptly. See also Paragraph RM-9.1.58 for the requirement to report to CBB.

RM-9.1.40

Licensees should clearly define the roles, responsibilities and accountabilities for cyber incident detection and response activities to one or more named individuals that meet the pre-requisite role requirements. Potential conflicts of interest are minimised by ensuring a separation of implementation and oversight roles where possible. The roles should include:

RM-9.1.41

For the purpose of managing a critical cyber incident, the licensee should operate a situation room, and should include in the incident management procedure a definition of the authorities and responsibilities of staff members, internal and external reporting lines, communication channels, tools and detailed working procedures. The situation room or a war room is a physical room or a virtual room where relevant members of the management gather to handle a crisis in the most efficient manner possible.

RM-9.1.42

Licensees should record and document in an orderly manner the incidents that have been handled and the actions that were taken by the relevant functions. In particular, the licensee should maintain an "incident log" in which all the notifications, decisions and actions taken, in relation to cyber incidents, are documented, as close as possible to the time of their occurrence. It should also include the status of the issue whether it is open or has been resolved and person in charge of resolving the issue/incident. The logs should be stored and preserved in a secure and legally admissible manner.

RM-9.1.43

Licensees should utilise pre-defined taxonomy for classifying cyber incidents according to, for example, the type of incident, threat actors, threat vectors and repercussions; and a pre-established severity assessment framework to help gauge the severity of the cyber incident. For example, taxonomies that can be used when describing cyber incidents:

The cyber incident severity may be classified as:

RM-9.1.44

Licensees should determine the effects of the cyber incident on customers and to the wider financial system as a whole and report the results of such an assessment to CBB if it is determined that the cyber incident may have a systemic impact.

RM-9.1.45

Licensees should establish metrics to measure the impact of a cyber incident and to report to management the performance of response activities. Examples include:

RM-9.1.46

Licensees must identify the critical systems and services within its operating environment that must be recovered on a priority basis in order to provide certain minimum level of services during the downtime and determine how much time the licensee will require to return to full service and operations.

RM-9.1.47

Critical incidents are defined as incidents that trigger the BCP and the crisis management plan. Critical systems and services are those whose failure can have material impact on any of the following elements:

RM-9.1.48

Licensees must define a program for recovery activities for timely restoration of any capabilities or services that were impaired due to a cyber security incident. Licensees must establish recovery time objectives (“RTOs”), i.e. the time in which the intended process is to be covered, and recovery point objectives (“RPOs”), i.e. point to which information used must be restored to enable the activity to operate on resumption”. Licensees must also consider the need for communication with third party service providers, customers and other relevant external stakeholders as may be necessary.

RM-9.1.49

Licensees must ensure that all critical systems are able to recover from a cyber security breach within the licensee’s defined RTO in order to provide important services or some level of minimum services for a temporary period of time.

RM-9.1.50

Licensees should validate that recovered assets are free of compromise, fully functional and meet the security requirements before returning the systems to normal business operations. This includes performing checks on data to ensure data integrity. In some cases, licensees may need to use backup data kept in a disaster recovery site or plan for the reconstruction of data from external stakeholders such as business partners and customers.

RM-9.1.51

Licensees must define a program for exercising the various response mechanisms, taking into account the various types of exercises such as attack simulations, "war games" and "table top" exercises, and with reference to the relevant stakeholders such as technical staff, crisis management team, decision-makers and spokespersons.

RM-9.1.52

Licensees must define the mechanisms for ensuring accurate, timely and actionable communication of cyber incident response and recovery activities with the internal stakeholders, including to the board or designated committee of the board.

RM-9.1.53

Licensee must ensure its business continuity plan is comprehensive and includes a recovery plan for its systems, operations and services arising from a cyber security incident.

RM-9.1.54

Licensees must arrange to seek cyber risk insurance cover from a suitable insurer, following a risk-based assessment of cyber security risk is undertaken by the respective licensee and independently verified by the insurance company. The insurance policy may include some or all of the following types of coverage, depending on the risk assessment outcomes:

RM-9.1.55

Licensees must evaluate improvement in the level of awareness and preparedness to deal with cyber security risk to ensure the effectiveness of the training programmes implemented.

RM-9.1.56

The licensee must ensure that all employees receive adequate training on a regular basis, in relation to cyber security and the threats they could encounter, such as through testing employee reactions to simulated cyber-attack scenarios. All relevant employees must be informed on the current cyber security breaches and threats. Additional training should be provided to ‘higher risk staff’.

RM-9.1.57

The licensees must ensure that role specific cyber security training is provided on a regular basis to relevant staff including:

RM-9.1.58

Upon occurrence or detection of any cyber security incident, whether internal or external, that compromises customer information or disrupts critical services that affect operations, licensees must contact the CBB, immediately (within one hour), on 17547477 and submit Section A of the Cyber Security Incident Report (Appendix RM-1) to CBB’s cyber incident reporting email, incident.investment@cbb.gov.bh, within two hours.

RM-9.1.59

Following the submission referred to in Paragraph RM-9.1.58, the licensee must submit to CBB Section B of the Cyber Security Incident Report (Appendix RM-1) within 10 calendar days of the occurrence of the cyber security incident. Licensees must include all relevant details in the report, including the full root cause analysis of the cyber security incident, its impact on the business operations and customers, and all measures taken by the licensee to stop the attack, mitigate its impact and to ensure that similar events do not recur. In addition, a weekly progress update must be submitted to CBB until the incident is fully resolved.

RM-9.1.60

With regards to the submission requirement mentioned in Paragraph RM-9.1.58, the licensee should submit the report with as much information as possible even if all the details have not been obtained yet.

RM-9.1.61

The penetration testing report as per Paragraph RM-9.1.29, along with the steps taken to mitigate the risks must be maintained by the licensee for a five-year period from the date of the report.