Market pack

Oman

A national cyber security framework, a central bank regime for financial institutions, and a data protection law now supported by executive regulations. The three are usually run as separate programmes; they do not need to be.

PRIMARY AUTHORITIES: OCERT-MTCIT, Central Bank of Oman, FSA
INSTRUMENTS IN THIS PACK: 6 national and sector, plus 13 international standards
CONTRACTING: Registered Omani entity, with the firm's longest delivery record in any market.

Regulatory register

What applies, to whom, and what the platform does about it. Indicative and maintained as the instruments change — applicability is confirmed per client during scoping.

Oman — national and sector regulation
Authority or instrument	What it is	Who it applies to	What the platform does
Ministry of Transport, Communications and Information Technology	National cyber security framework and information security standards	Government entities and designated organisations	Control mapping, maturity position and evidence maintained continuously
Oman National CERT	Incident reporting and national coordination requirements	Organisations within national scope	Notification workflow with the reporting clock built into the incident record
Central Bank of Oman	Cyber security, technology risk and business continuity requirements	Licensed banks and financial institutions	Control mapping, third-party registers, continuity evidence and incident reporting
Royal Decree 6 of 2022	Personal Data Protection Law and its executive regulations	Controllers and processors in the Sultanate	Processing records, permit and consent handling, rights workflow, transfer assessment, breach notification
Financial Services Authority	Capital markets and insurance technology and governance requirements	Licensed market and insurance participants	Sector obligations tracked in the same regulatory register
Cyber Defence Centre	National cyber defence coordination and sector directives	CNI and government-linked operators	Directives tracked as regulatory change with impact routed to control owners

International standards operating alongside the national regimes
Standard	Scope	How it is used
ISO/IEC 27001:2022 and 27002	Information security management system and control set	Certification readiness, live Statement of Applicability, continuous gap position
ISO/IEC 27701	Privacy information management	Extends the ISMS control set with privacy-specific controls and DPO workflow
ISO/IEC 27017 and 27018	Cloud security and cloud personal data	Applied where the estate is cloud-hosted or cloud-delivered
ISO 22301	Business continuity management	BIA, recovery objectives, plan currency and exercise evidence
ISO/IEC 42001:2023	AI management system	AI inventory, impact assessment and model governance
NIST CSF 2.0	Cybersecurity framework	Used as the neutral spine when several national regimes apply at once
NIST SP 800-53 Rev. 5	Control catalogue	Depth mapping where a client's control set is US-derived
CIS Controls v8	Prioritised technical control set	Common baseline for technology teams
COBIT 2019	Technology governance	Used in the Govern pillar for IT and digital governance structures
SOC 2	Service organisation controls	Trust services criteria for clients who serve enterprise customers
PCI DSS 4.0	Payment card security	Applied where card data is in scope
IEC 62443	Industrial automation and control systems	Applied to OT estates alongside the national OT controls
Open FAIR	Risk quantification taxonomy	The quantification method used throughout the Anticipate pillar

Hosting and contracting

Settle residency before tenant design. It is the item most often left until too late.

Data residency

Data classification under the national framework should drive hosting. Regional hosting is generally acceptable for private-sector workloads; government and CNI positions are confirmed case by case.

Contracting entity

Registered Omani entity, with the firm's longest delivery record in any market. Omani clients contract locally.

How Falconry360 is hosted and secured

THE OMAN PICTURE

Our longest delivery record in any market, and the one where the regulatory picture moved fastest.

Oman has gone from a light regulatory footprint to a national cyber framework, an active central bank regime and a data protection law with executive regulations — inside four years. Organisations that built their control environment before that shift are the ones we are usually asked to help.

What is different here

A compact market with real supervision. The Central Bank of Oman's expectations of licensed institutions are detailed and examined. The Financial Services Authority applies its own requirements to market and insurance participants.
The PDPL is now operational, not theoretical. Royal Decree 6 of 2022 and its executive regulations created obligations — permits, consent handling, transfer conditions, breach notification — that many organisations documented but never operationalised.
National coordination is active. Incident reporting obligations into the national CERT and sector directives from the Cyber Defence Centre are real reporting lines with real clocks.
Energy and utilities carry an OT perimeter. Distributed physical estates, vendor remote access and IT-OT convergence make the risk picture different from a purely corporate one.
Teams are small. A Omani security function is frequently three or four people carrying the same obligations as a team of thirty elsewhere. Automation and managed operation are not a luxury here; they are how the obligations get met at all.

What a first engagement usually looks like

Indicative. Scope, estate size and the number of regimes in play move the dates.

Weeks 1–3 · The real obligation set
National framework, central bank or FSA requirements, PDPL obligations and sector directives, resolved into one list with owners — rather than four programmes run by the same four people.
Weeks 4–8 · Control library and evidence
One control set covering the national framework and the sector regime, with evidence collected from source systems so the small team is not the bottleneck.
Weeks 9–14 · Privacy operations
PDPL obligations turned into working routines — processing records, permit and consent handling, transfer assessment and a breach workflow with the notification clock built in.
Ongoing · Operated, not just implemented
Where the team is small, we run the routine under managed services and the team keeps the decisions. This is the most common shape of engagement in the Sultanate.

Falconry holds a registered Omani entity, with the firm's longest delivery record in any market — across banking, energy and government-linked organisations.

Oman

Regulatory register

Hosting and contracting

Data residency

Contracting entity

Our longest delivery record in any market, and the one where the regulatory picture moved fastest.

What is different here

What a first engagement usually looks like

Map your obligations in Oman