VAPT requirement for UAE banks/insurers and Listed Companies

Understanding cybersecurity testing obligations, independent assessments and practical reporting expectations in the UAE.

VAPT requirements for UAE banks, insurers and listed companies depend on regulatory status, licensed activities and applicable cybersecurity obligations. There isn’t one annual testing rule that applies identically to all three categories.

For institutions covered by the Central Bank of the UAE’s operational risk framework, independent penetration testing is expressly required for Critical Functions. For listed companies, applicability needs closer examination: listing status alone shouldn’t be treated as proof of a universal annual VAPT obligation.

The starting point is regulatory mapping. Then comes meaningful testing.

What Is VAPT?

Vulnerability Assessment and Penetration Testing (VAPT) combines two related activities. A vulnerability assessment identifies security weaknesses, such as outdated software, exposed services and configuration gaps. Penetration testing evaluates whether weaknesses can be exploited within an authorised scope.

A scan may identify a potential problem. A penetration test investigates its practical significance.

For financial institutions and listed businesses, this distinction matters. Management needs to understand whether a weakness could expose customer information, interrupt operations or compromise critical systems.

VAPT Requirements for UAE Banks

The CBUAE Operational Risk Management Regulation, Circular C 1/2026, is shown in the official Rulebook as effective from 14 September 2026. Its scope covers Licensed Financial Institutions that are juridical persons.

Article 7.13 requires periodic operational risk stress testing that challenges the control environment. Article 7.14 specifically requires independent third-party penetration testing, at least for Critical Functions, with results presented to the Board.

Article 8 separately addresses ICT and cybersecurity management, including vulnerability testing, regular control evaluation and oversight of systems provided by third parties.

So, VAPT for UAE banks should connect technical findings with operational exposure. Testing an isolated website while overlooking systems supporting critical banking services can leave significant gaps.

VAPT Requirements for UAE Insurers

The CBUAE framework also includes insurance and reinsurance companies within its definition of Licensed Financial Institutions. Insurers should therefore assess the operational risk testing requirements against their own activities and critical dependencies.

Practical scope may include policy administration, claims platforms, customer portals, payment interfaces and connections with intermediaries or service providers.

Electronic insurance requirements add relevant security obligations. Article 10 requires secure handling of sensitive user information, protection of website systems and security audits following recognised management and operational practices. These obligations shouldn’t be presented as an identical annual penetration testing requirement for every insurer.

Here’s what deserves attention: an outsourced platform can still create substantial exposure for the insurer. Establish who tests it, what the assessment covers and how findings reach management.

Is VAPT Mandatory for DFM/ADX Listed Companies?

For companies listed on Dubai Financial Market or Abu Dhabi Securities Exchange, distinguish corporate governance duties from sector-specific cybersecurity requirements.

The Joint Stock Companies Governance Guide addresses internal controls, risk management and oversight of technology risks. These provisions support cybersecurity governance, but shouldn’t automatically be translated into a fixed annual VAPT mandate for every listed issuer.

A listed bank or insurer must assess its sector obligations alongside applicable listing and governance requirements. Other issuers should check their industry regulator, relevant cybersecurity directions and contractual commitments.

This distinction prevents a common mistake: applying requirements for a licensed financial service provider to an ordinary listed company simply because both operate in the UAE.

How Often Should VAPT Be Conducted?

Frequency must follow the applicable rule, supervisory direction and risk assessment.

The CBUAE provisions discussed above refer to periodic testing; they don’t establish one universal annual timetable for all systems across the organisations covered in this article.

As a practical planning approach, companies can establish a scheduled testing cycle and additional assessments following significant changes. Examples include major application releases, infrastructure migrations, new external interfaces or incidents revealing control weaknesses.

Document the rationale. An unchanged calendar isn’t a substitute for considering changed risks.

What Should a UAE VAPT Engagement Include?

A useful engagement should cover five stages:

1. Define scope: Identify applications, infrastructure, interfaces and dependencies relevant to the assessment.

2. Authorise testing: Agree permitted activities, testing windows, escalation contacts and safeguards.

3. Assess weaknesses: Combine appropriate scanning with manual validation and controlled testing.

4. Report business impact: Explain affected assets, evidence, severity and realistic consequences.

5. Remediate and retest: Assign owners, track corrective actions and verify whether weaknesses remain.

Don’t stop at the severity score. An apparently moderate finding may become significant when combined with excessive access or exposure to sensitive information.

What Evidence Should Management Retain?

Maintain the approved scope, authorisation, testing methodology, technical report, management summary and remediation tracker. Record exclusions clearly.

For findings awaiting correction, document interim controls, accountable owners and escalation decisions. Retesting should establish whether corrective action worked.

These records make the assessment reviewable. They also help management explain what was tested—and where assurance remains limited.

How ASC Global UAE Can Help

ASC Global UAE can support organisations in assessing VAPT requirements and structuring an appropriate cybersecurity assurance programme.

Support can include:

• Mapping regulatory obligations to the organisation’s status and activities.

• Defining scope around critical systems and business dependencies.

• Coordinating appropriately qualified independent testing specialists.

• Reviewing findings and developing practical remediation plans.

• Preparing management summaries and tracking retesting evidence.

Discuss your requirements with ASC Global UAE to establish suitable coverage, responsibilities and reporting expectations.

Frequently Asked Questions

Does a vulnerability scan replace penetration testing?

No. Scanning identifies potential weaknesses; penetration testing assesses exploitability within the agreed scope.

Is annual VAPT compulsory for every UAE listed company?

Don’t assume so. Check the issuer’s sector, applicable directions and specific obligations before setting frequency.

Does outsourcing remove responsibility?

No. Management should establish appropriate testing coverage, access to findings and accountability for corrective action.

Is VAPT the same as internal audit or ICFR?

No. VAPT evaluates technical security weaknesses. Internal audit and internal control over financial reporting have different objectives, although findings may inform their assessments.