Gulf Cooperation Council
External attack surface management across the GCC
All six GCC states now regulate the internet-facing estate, but in different ways. Saudi Arabia names it in its controls, Qatar puts a remediation clock on it, Bahrain expects weekly external assessments for banks, Kuwait tiers banks by it, and the UAE asks CII entities to map the assets behind every critical service. This page compares them and links to each country guide.
Serving organisations in Dubai, Abu Dhabi, Riyadh, Doha, Muscat, Manama, Kuwait City.
What the rules in the GCC expect
Email authentication is now written into rules
Saudi Arabia requires SPF, DKIM and DMARC under ECC 2-4-3-5 and, for private companies under NCNICC, registration of the email domain on the Haseen platform. Bahrain’s NCSC baseline asks for DMARC enforced on inbound and outbound mail. Qatar requires SPF under NIAS and SPF and DKIM for banks under QCB rules. Spoofable domains are one of the easiest findings to see from outside, and one of the easiest to fix.
Discovery, not just inventory
Several GCC instruments go beyond keeping a register. SAMA expects the asset process to discover new assets, Qatar’s guidelines call for a live, automated inventory, and the UAE CIIP Policy asks entities to identify the components behind each critical service. Continuous external discovery is the practical way to meet that expectation.
Accuracy matters in this region
Some widely repeated claims are wrong. ECC-2:2024 sets no numeric scanning frequency, the UAE Information Assurance Standard is not public, Bahrain’s critical sector standards are circulated privately, and the UAE federal PDPL has no fixed breach clock yet. Each country guide below states what the rules say and flags what cannot be verified.
Country guides
Attack surface management in United Arab Emirates
EASM for the UAE and Dubai: evidence for the CIIP Policy, DESC rules, CBUAE Operational Risk Regulation C 1/2026 and ADGM, from an outside-in view.
Attack surface management in Saudi Arabia
EASM for Saudi Arabia: evidence for NCA ECC-2:2024, NCNICC-1:2025 external application scanning, Haseen email records and SAMA asset discovery.
Attack surface management in Qatar
EASM for Qatar: NCSA 2026 guidelines put external-facing assets in a 3 to 7 day fix window. Know which assets are exposed, plus QCB and NIAS rules.
Attack surface management in Bahrain
EASM for Bahrain: support for CBB OM-5.5 weekly external assessments, NCSC Decision 36/2026 risk assessments and DMARC enforcement, from outside.
Attack surface management in Kuwait
EASM for Kuwait: support for the CBK Cyber and Operational Resilience Framework, the NCSC National Basic Cybersecurity Controls and CITRA data rules.
Attack surface management in Oman
EASM for Oman: support for the Central Bank of Oman cyber resilience framework, PDPL security duties and government security assessments.
What each rule asks for, and what EASMLens shows you
| Rule | What it asks for | What EASMLens shows you |
|---|---|---|
| Saudi Arabia | ECC, NCNICC and SAMA: internet-facing test scope, external application scanning, asset discovery | Every internet-provided service and new asset, continuously |
| UAE | CIIP Policy and CBUAE C 1/2026: assets behind critical services; exposure reported to the board | Critical service assets and exposure trends |
| Qatar | NCSA guidelines and QCB: external-facing assets in the 3 to 7 day tier; domain monitoring | Which assets are external-facing; domain and email posture |
| Bahrain | CBB OM-5.5 and NCSC Decision 36/2026: weekly external assessment; annual risk assessment | A complete public-facing asset list for every assessment |
| Kuwait | CBK CORF and NBCC: exposure-based tiering; asset management; digital risk protection | The size and trend of your public-facing attack surface |
| Oman | CBO CS&RF and PDPL: technology and third-party controls; breach notice | Internet-facing assets and supplier exposure |
Reporting clocks
Qatar Central Bank and Central Bank of Bahrain
1 hour
Qatar NIAS
2 hours to the NCSA for critical incidents
Central Bank of the UAE
4 hours, then a summary within 24 hours
Personal data (Saudi Arabia, Qatar, Bahrain, ADGM)
72 hours
Questions for the board
- 1Across our GCC operations, do we have one current view of every internet-facing asset, or one list per country and subsidiary?
- 2Are all our domains in every GCC country protected against spoofing, as Saudi, Bahraini and Qatari rules now expect?
- 3Could each GCC entity meet its local incident clock if the incident began on an asset nobody had inventoried?
How EASMLens supports these obligations
- One view of the internet-facing estate across every GCC entity and subsidiary
- Country-by-country evidence for asset discovery, exposure and email security rules
- Supplier and cloud exposure monitoring across the region
- Deployment and data residency discussions for regulated Gulf organisations
EASMLens discovers your attack surface from DNS, certificate transparency, internet-wide scan datasets and public records, then runs non-destructive checks against the assets in your scope. It never attempts exploitation. It provides discovery, monitoring and evidence. It does not certify an organisation against any framework, and no product can.
Frequently asked questions
- Which GCC country has the most prescriptive attack surface rules?
- Saudi Arabia names internet-facing services most directly, through ECC, NCNICC and SAMA. Qatar sets the tightest external remediation expectation, and Bahrain the most frequent external assessment for banks.
- Does one EASMLens tenant cover several GCC countries?
- Yes. A group can monitor all its entities in one place and report by country or subsidiary.
Primary sources
Regulatory content reviewed on . General information only, not legal advice.