DFSA Cyber Risk Requirements: What DIFC Firms Must Have in Place
If your firm is regulated by the Dubai Financial Services Authority, cyber risk is no longer just good practice. Since the DFSA issued its Cyber Risk Management Rules in January 2024, it has been a rulebook obligation, set out in Section 5.5 of the General (GEN) Module.
The rules apply to every DFSA Authorised Firm, as well as Registered Auditors, Credit Rating Agencies and Authorised Market Institutions. How far you go depends on the nature, scale and complexity of your business, but no firm is too small to be in scope.
This guide sets out what the DFSA expects, where its 2024 thematic review found firms falling short, and a practical checklist for getting ready.
1. A Written Cyber Risk Management Framework
The core requirement is a framework that lets you identify and reduce cyber risks, and detect, respond to and recover from incidents.
The DFSA does not mandate a single standard. It names the NIST Cybersecurity Framework, ISO/IEC 27000, the CIS Critical Security Controls and the CSA Cloud Controls Matrix as common choices. Whichever you use, it should cover the eight principles the DFSA adapted from the G7’s Fundamental Elements of Cybersecurity for the Financial Sector:
- Cybersecurity strategy and framework
- Governance and accountability
- Risk and control assessment, including third parties
- Monitoring and testing
- Incident response and stakeholder notification
- Recovery
- Information sharing
- Continuous learning and review
2. Board and Senior Management Oversight
The DFSA expects your board and executive management to understand the firm’s cyber vulnerabilities and to provide the resources, controls and oversight to manage them.
Its 2024 thematic review found oversight was weakest where IT and cyber functions are outsourced. Outsourcing the work does not outsource the responsibility: your board still needs regular, understandable reporting on cyber risk.
3. Regular Testing, Not Just Automated Scans
The DFSA expects a comprehensive testing programme. Internet-facing systems should be tested at least annually, and whenever they are updated or newly deployed.
The review found many firms relied only on automated vulnerability scans. The DFSA wants testing to go further, including scenario-based testing and penetration tests, and it expects firms to prioritise and fix what testing finds.
4. Continuous Monitoring
About 20% of firms in the review lacked continuous detection and response for critical systems, most of them smaller firms. If nobody is watching your systems outside office hours, an attack that starts on Friday night may not be noticed until Monday.
5. An Incident Response Plan You Have Actually Tested
Over 80% of firms had an incident response plan, but the DFSA found many were generic, left out crisis communication and had no playbooks for common attacks such as ransomware or business email compromise. Around 35% of firms did not test their plans regularly.
Plans should be reviewed at least once a year and after any major incident.
6. Notifying the DFSA Within 72 Hours
This is the requirement firms most often get wrong. You must notify the DFSA as soon as reasonably practicable, and no later than 72 hours after you become aware of a material cyber incident, or have information that reasonably suggests one has occurred. Notification is made through the cyber incident form on the DFSA ePortal.
The DFSA’s review noted that some firms failed to notify, or notified late. The clock starts when you have reasonable grounds to suspect an incident, not when your investigation is finished.
7. Third-Party and Vendor Risk
Only 75% of firms in the review carried out cyber due diligence on providers before giving them access, and about two-thirds periodically reviewed their critical providers. Your IT provider, cloud services and software vendors all sit inside your risk perimeter.
8. Staff Training and Threat Intelligence
Staff should receive cyber awareness training at least annually. The DFSA also runs a free Cyber Threat Intelligence Platform for Authorised Firms, which you can register for through the ePortal. Around two-thirds of firms have joined.
A Practical Readiness Checklist
- A written cyber risk framework based on a recognised standard
- Regular cyber risk reporting to the board
- An inventory of your IT assets and data, with risk ratings
- Penetration testing of internet-facing systems at least annually
- Continuous monitoring of critical systems, including outside office hours
- An incident response plan with playbooks, reviewed and tested every year
- A clear process for notifying the DFSA within 72 hours
- Cyber due diligence on providers before they get access
- Annual staff training
- Registration on the DFSA Cyber Threat Intelligence Platform
How Mecaka Can Help
The DFSA’s own review shows where firms most often fall short: testing, continuous monitoring, and a notification process nobody has rehearsed.
Our vCISO service gives you a senior security lead to build the framework, report to your board and prepare you for DFSA review. Our Managed SOC provides the 24/7 monitoring and incident response the rules expect.
Book a free 30-minute call to see where your firm stands.
This article is general information, not legal advice. Always check the current DFSA Rulebook for the requirements that apply to your firm. Sources: DFSA Cyber Risk Supervision; DFSA Thematic Review 2024: Cyber Risk.