Business Continuity Mandates in the GCC and Pakistan: SAMA, NCA ECC, CBUAE, SBP and PISF

Saudi Arabia — SAMA CSF

SAMA’s Cyber Security Framework for financial institutions includes continuity and resilience expectations alongside cybersecurity domains. Use the SAMA compliance hub and your authorised circulars for programme detail.

Saudi Arabia — NCA ECC

NCA Essential Cybersecurity Controls address continuity-related cybersecurity capabilities for in-scope entities. Start from the NCA ECC hub; map ECC continuity themes to your BCMS without inventing ECC control tallies here.

UAE — CBUAE

Central Bank of the UAE expectations for licensed financial institutions typically include business continuity and operational resilience. Confirm applicable CBUAE standards and notices for your licence; align ISO 22301 artefacts as supporting evidence.

Pakistan — SBP

State Bank of Pakistan guidance for banks and regulated entities commonly addresses continuity and disaster recovery. Treat ISO 22301 as a structured BCMS backbone while meeting SBP-specific reporting and testing expectations.

Pakistan — PISF

PISF continuity and DR expectations are covered in CyberSilo’s PISF BCP / DR requirements guide. Use ISO 22301 clauses to organise evidence that also supports national framework alignment.

How ISO 22301 Helps Regionally

• Shared language for BIA, plans, exercises, and management review
• Customer and group assurance across multi-country groups
• Reusable artefacts mapped into SAMA / ECC / PISF / CBUAE workstreams via CSA

How CyberSilo Helps

• BCMS programme artefacts — BIA, plans, exercise records — organised in Compliance Standards Automation
• ThreatHawk SIEM / SOAR for detection, response evidence, and ICT continuity telemetry during disruption
• Advisory scoping for certification readiness — contact CyberSilo

Frequently Asked Questions

Does ISO 22301 replace SAMA or NCA obligations?

No. It supports continuity management maturity. Local frameworks and circulars remain authoritative.

We only operate in Pakistan — still useful?

Yes for structure and international customers; still map explicitly to SBP / PISF expectations.

Where is CBUAE detail on this site?

Confirm current CBUAE publications for your licence. This page is a high-level pointer, not a control catalogue.

Related ISO 22301 Resources

BCM services · SAMA · NCA ECC · PISF BCP · Hub