Built for estates the regulator looks at.
We focus where networks are large, converged and consequential, and where an auditor will ask for the evidence behind every control you claim to run.
Sectors we focus on
Financial services
Retail and wholesale banks, insurers and payment institutions licensed by the Central Bank of Bahrain.
- Security operations centre and SIEM build
- Privileged access, logging and evidence retention
- Recurring penetration testing and vulnerability management
- Outsourcing and cloud control design
- Control mapping onto the NIST Cybersecurity Framework
Industry and energy
Aluminium, refining, upstream and utilities operators running converged IT and OT estates.
- Plant and site network modernisation
- IT and OT segmentation with agentless access control
- OT vulnerability and exposure management
- Controls for operational technology and IoT
- Source of truth for distributed assets
Government and telecom
Ministries and authorities, operators, carriers and managed service providers.
- Campus and multi-site network design
- Network source of truth at carrier scale
- Model-driven service orchestration
- DDI consolidation and DDoS mitigation
- Governance tooling and audit evidence
Designed for Bahrain's regulatory reality.
A Bahraini buyer, and a licensee of the Central Bank of Bahrain especially, is not only asking whether a control works. They are asking who can attest to it, how fast an incident has to be reported, and where the data is allowed to go. We scope for those questions from the first workshop.
NCSC Baseline Controls
The National Cyber Security Centre baseline covers seven domains and fifty-two controls. It binds entities inside Bahrain's critical national infrastructure and is voluntary for everyone else, and the published document still carries a draft marking. We scope architecture against it and keep traceability from control to deployed capability, while being clear with you about what is settled and what is not.
CNI sector controls
The NCSC also publishes sector control sets for gas, electricity and oil, financial services, ICT, healthcare, government, critical industry and transportation. We design to the set that actually applies to you rather than to a generic baseline.
CBB Rulebook
The Central Bank of Bahrain requires covered licensees to run a cybersecurity framework built on the NIST Cybersecurity Framework, to operate a security operations centre with SIEM, to penetration test at least twice a year, and to file a first report on a qualifying incident within one hour. We build to those obligations, including the outsourcing and cloud control requirements that sit alongside them.
PDPL
Law No. 30 of 2018 and its 2022 implementing resolutions permit personal data to be transferred to whitelisted countries and require an authorisation for anywhere else, set a seventy-two hour breach notification deadline, and require prior approval for biometric, genetic, surveillance and cross-dataset processing. That shapes data classification and platform placement, so we design for it up front.
Framework names are the property of their respective authorities. This is a statement of how we scope and design, not a claim of certification or endorsement.
How we reduce procurement risk.
Cloud placement decided, not defaulted
Bahrain's Cloud First policy asks for recognised assurance rather than blanket residency restrictions, and there has been a hyperscale cloud region in country since 2019. We put the placement decision on the table with the evidence, instead of defaulting either way.
Cross-border data handled up front
Whether a platform sends data outside Bahrain, and whether the destination is whitelisted under the PDPL, is settled during solution design rather than discovered during contract review.
Vendor origin disclosed up front
Country of origin and ownership are declared during solution design, so nothing about the supply chain is a surprise at approval.
Open by default
Open standards and open-source cores wherever they serve the customer, so an exit is always possible and no single vendor holds the estate.
Ready to make your network prove itself?
Tell us where you are on the journey, from a source of truth to full AIOps, or from a first security baseline to an audit you can pass, and we will tell you exactly how we would help you get there.