Press Release
The Compliance and Assurance Convoy adds the Qatar Central Bank's Technology Risks circular
DUBAI, UNITED ARAB EMIRATES — 7 November 2026 — Mamluk today made the Qatar Central Bank’s Technology Risks circular, issued in January 2018, available in the Compliance and Assurance Convoy for Bahriya Tersane. It is the convoy’s second regime, after the Saudi National Cybersecurity Authority’s Essential Cybersecurity Controls, and the first for banks in Qatar.
The convoy is installed in the bank’s own Kubernetes cluster. It maps a regulator’s technical controls onto the bank’s Kubernetes cluster, enforces the controls the cluster can enforce, checks the ones it can only observe, and writes dated evidence for each regime every day. The evidence stays in the bank’s cluster unless the bank chooses to send it to its own email server or storage.
How it covers the circular
The regime holds every numbered statement of the circular, 516 in all, under QCB’s own numbers. Six are enforced by an admission policy, 27 are checked in the cluster, and 28 are provided by the platform and reported. The remaining 455 are organisational, such as governance, personnel, procurement and business continuity, and the report lists them for the bank to evidence.
Where the cluster evidences only part of a statement, the report says which part. For example, the statement on defence-in-depth network design is evidenced for network segmentation only, from the cluster’s host firewall and its network policies; the other measures it names are the bank’s to evidence. For the statement on encrypting sensitive data sent to external parties, the evidence concerns TLS on traffic into the cluster and to its control plane, and the encryption of the data the bank’s applications send remains the bank’s. The same note appears in the HTML and PDF report and in the OSCAL assessment results.
QCB does not map its statements to NIST SP 800-53. The circular states that it includes requirements from Qatar’s National Information Assurance Policy, the NIST Cybersecurity Framework and ISO/IEC 27001, but it maps none of its statements to them. The mapping is therefore Mamluk’s, and the report names the checks behind each technical result.
The convoy records technical evidence and does not certify compliance. The organisational statements remain the bank’s to evidence, and compliance is determined by the bank and its assessor.
One installation, one regime at a time
A bank that answers to more than one regulator selects each regime in the same installation, and the cluster is scanned once for all of them. Each regime is licensed separately, and is added to a running installation by adding it to the licence and to the chart’s values; the steps are in Activating a regime.
The regimes that follow
| Regime | Availability |
|---|---|
| Saudi Arabia: NCA Essential Cybersecurity Controls | Available |
| Qatar: Qatar Central Bank, Technology Risks | Available today |
| Saudi Arabia: SAMA Cyber Security Framework | Q1 2027 |
| United Arab Emirates: UAE Information Assurance Standard, with the Central Bank of the UAE’s requirements for banks | Q1 2027 |
| Saudi Arabia: SAMA Cyber Resilience Fundamental Requirements; Bahrain: Central Bank of Bahrain Rulebook | Q3 2027 |
| Qatar: National Information Assurance Standard; Kuwait: Central Bank of Kuwait framework | Q4 2027 |
Availability and price
The QCB regime is available today. Like every regime of the convoy, it is licensed at USD 24,000 per organisation, per year, with the Bahriya Tersane core licence and no base fee. The regime has its own page at tersane.bahriya.cloud, and banks can enquire through mamluk.net.
About Mamluk
Mamluk LLC-FZ is an engineering firm in the Meydan Free Zone, Dubai, specialising in enterprise architecture, Kubernetes and cloud infrastructure. It develops the Bahriya Kubernetes Engine, the only enterprise Kubernetes distribution developed and supported from within the GCC, Bahriya Tersane and Kipchak, and operates the public cloud bahriya.cloud.
For media enquiries, contact uae@mamluk.net.