ADGM Cyber Risk Management Framework 2026: Essential Compliance Guide for Financial Institutions

Introduction: A New Era of Digital Resilience in Abu Dhabi

The Financial Services Regulatory Authority (FSRA) of the Abu Dhabi Global Market (ADGM) has introduced a comprehensive Cyber Risk Management Framework that will fundamentally reshape how financial institutions approach cybersecurity. Announced on July 29, 2025, this landmark regulation becomes mandatory on January 31, 2026, giving firms a critical six-month implementation window.

 

This regulatory evolution addresses a pressing concern: varying levels of cyber resilience across ADGM’s financial sector have created systemic vulnerabilities, particularly given the industry’s interconnected nature and heavy reliance on outsourced technology services. According to the FSRA’s consultation paper, the framework aims to establish consistent, enforceable standards while aligning with the UAE’s broader national cybersecurity strategy ahead of its 2026 Financial Action Task Force (FATF) Mutual Evaluation.

 

At NR Doshi & Partners, we recognize that this framework represents more than a compliance checkbox—it’s an opportunity to build operational resilience and protect stakeholder trust in an increasingly digital financial ecosystem.

Who Must Comply? Understanding the Scope

Covered Entities

The framework applies comprehensively to:

 

• Authorised Persons: All firms licensed to conduct regulated financial activities within ADGM, including banks, insurance companies, investment firms, asset managers, payment service providers, FinTech companies, and virtual asset service providers
• Recognised Bodies: Investment exchanges and clearing houses operating within ADGM

Proportionality Principles

While requirements apply universally, the FSRA has embedded proportionality throughout the framework. Firms must implement systems and controls appropriate to the nature, scale, and complexity of their activities. Consequently, a boutique investment advisory firm faces different practical implementation requirements than a major international bank, though both must demonstrate comprehensive cyber risk management capabilities.

The Seven Core Pillars of Compliance

1. Written Cyber Risk Management Framework

Every firm must establish and maintain a documented cyber risk management framework capable of identifying, assessing, and managing cyber risks effectively. This framework must address both the probability and potential impact of cyber incidents, implementing prevention measures that reduce likelihood and mitigation strategies that minimize consequences.

 

The framework cannot exist as a theoretical exercise—it must be operational, integrated with overall risk management, and demonstrably effective in protecting the organization’s information and communication technology (ICT) assets.

2. Risk Identification and Assessment

Firms must maintain a current, comprehensive inventory of their ICT assets and conduct regular risk assessments—at minimum annually. This requirement extends beyond simple asset cataloging to include:

 

• Asset classification by criticality to business operations
• Vulnerability assessment identifying weaknesses in systems and infrastructure
• Threat intelligence integration understanding relevant attack vectors and emerging risks
• Risk quantification assessing both likelihood and impact
• Dependency mapping understanding interconnections and third-party dependencies

 

The assessment process must be dynamic, incorporating lessons learned from testing exercises, actual incidents, and intelligence sharing with industry peers and regulators.

3. Prevention Measures and Technical Controls

Prevention forms the first line of defense. While the regulations adopt a principles-based approach rather than prescriptive technical requirements, effective prevention programs typically include:

 

Access Controls: Multi-factor authentication, role-based access aligned with least-privilege principles, regular access reviews, and privileged access management with session monitoring.

 

Network Security: Segmentation of critical systems, regularly updated firewall rules, intrusion detection and prevention systems, and secure configuration of network devices.

 

Data Protection: Encryption of sensitive data in transit and at rest, data loss prevention technologies, secure disposal procedures, and classification schemes for different data sensitivity levels.

 

Endpoint Security: Next-generation antivirus solutions, endpoint detection and response capabilities, timely patch management, and mobile device management for remote work.

 

Security Awareness: Regular cybersecurity training for all staff, specialized training for IT personnel and senior management, phishing simulation exercises, and clear acceptable use policies.

4. Third-Party Cyber Risk Management

One of the framework’s most significant expansions addresses third-party cyber risks—risks arising from ICT services provided by external providers or their subcontractors. This reflects the reality that most cyber incidents stem from supply chain vulnerabilities.

Due Diligence Requirements:

Before engaging ICT service providers, firms must conduct thorough due diligence examining security certifications (ISO 27001, SOC 2), previous security incidents, financial stability, business continuity capabilities, and regulatory compliance track records.

Contractual Provisions:

Responding to industry feedback, the FSRA has refined requirements from blanket compliance obligations to specific contractual provisions addressing:

 

• Security standards and compliance with relevant industry frameworks
• Incident notification requirements enabling firms to meet their 24-hour FSRA notification obligations
• Incident cooperation obligations for providers to assist in remediation efforts
• Audit rights allowing assessment of provider control environments
• Subcontracting controls ensuring appropriate oversight of subcontractor arrangements
• Data handling requirements for data return or secure destruction at contract termination

Continuous Monitoring:

ICT service oversight extends beyond contract signing. Firms must implement ongoing supervision through regular review of provider security reports, periodic security assessments, performance monitoring against service level agreements, and annual reviews of contractual arrangements.

5. Monitoring and Testing

Continuous monitoring and regular testing form cornerstones of effective cyber risk management. The FSRA mandates that firms implement:

 

Ongoing Monitoring: Real-time or near-real-time visibility into security events, network traffic patterns, user behavior analytics, and compliance with security policies.

 

Testing Methodologies: Vulnerability assessments (at least annually for internet-facing systems), penetration testing by qualified professionals, scenario-based exercises simulating specific threats, and advanced red team exercises where appropriate.

 

Remediation Processes: Documented tracking of identified vulnerabilities through remediation with risk-based prioritization, assigned ownership and timelines, verification testing, and escalation procedures for high-risk findings.

6. Response and Recovery Capabilities

Despite best prevention efforts, cyber incidents will occur. Firms must establish, maintain, and regularly test robust cyber incident response plans ensuring timely recovery and regulatory compliance.

Essential Plan Components:

• Governance and roles defining incident response team structure and decision-making authority
• Detection and analysis procedures for identifying and assessing potential security incidents
• Containment strategies to limit incident spread and prevent further damage
• Eradication and recovery steps to eliminate root causes and restore normal operations
• Post-incident activities conducting lessons-learned reviews and updating controls
• Communication protocols for internal notifications, external stakeholder communications, and regulatory reporting

 

The incident response plan must integrate with business continuity and disaster recovery plans, ensuring coordinated crisis management. Regular testing through tabletop exercises, simulations, or full-scale drills maintains team readiness.

7. Governance and Incident Notification

Board and Senior Management Responsibilities:

The framework assigns ultimate responsibility for cyber risk management to governing bodies and senior management. Boards must approve the framework, ensure adequate resources, receive regular risk reports, and participate in cybersecurity training to understand business implications.

Critical 24-Hour Notification Requirement:

Firms must notify the FSRA immediately—and no later than 24 hours—after becoming aware that a material cyber incident has occurred. This requirement applies regardless of weekends or public holidays, necessitating robust on-call arrangements.

Materiality Assessment Factors:

Determining materiality requires considering financial impact, operational disruption, reputational damage, regulatory reporting obligations, systemic implications, and data sensitivity. The FSRA has committed to updating cyber incident notification templates before year-end 2025 to facilitate the reporting process.

The notification process involves an initial report (Template A) within 24 hours providing preliminary information, followed by progressive reports (Template B) as investigations advance and additional details become available.

Comparing ADGM with Global Standards

Alignment with EU’s Digital Operational Resilience Act (DORA)

ADGM’s framework shares significant common ground with the European Union’s Digital Operational Resilience Act, which entered into force on January 17, 2025. Both prioritize comprehensive ICT risk management, stringent incident reporting, extensive third-party risk management, regular testing, and board-level accountability.

Key Differences:

ADGM’s framework applies to all ICT services, including one-off arrangements, whereas DORA primarily focuses on ongoing relationships. DORA provides more prescriptive contractual requirements and establishes direct oversight of critical ICT third-party providers, while ADGM adopts a more principles-based approach focusing on regulated firms’ management of these relationships.

For firms operating in both jurisdictions, substantial overlap allows integrated compliance approaches, though DORA’s more prescriptive requirements in certain areas may necessitate contractual provisions exceeding ADGM’s minimum standards.

Regional Comparisons

Singapore’s approach under the Cybersecurity Act targets critical infrastructure operators with sector-specific requirements, mandatory security audits, and incident reporting obligations. The UK’s evolving regime through the Cyber Security and Resilience Bill expands scope to managed service providers while maintaining proportionate, risk-based regulation similar to ADGM’s philosophy.

Implementation Challenges and Solutions

Resource Constraints

Smaller firms may struggle with advanced technical capabilities like continuous security monitoring, sophisticated penetration testing, and privileged access management. Solutions include leveraging managed security service providers, participating in industry information-sharing arrangements, prioritizing controls based on risk assessments, and seeking FSRA guidance on proportionate implementation.

Third-Party Contract Renegotiation

Many firms will need to renegotiate existing technology contracts to incorporate required cybersecurity provisions. Challenges include limited negotiating leverage with major providers, timeline pressures within the six-month window, and potential cost increases.

Practical approaches:

• Prioritize renegotiations based on service criticality and risk exposure
• Seek standard addenda that providers might accept across multiple clients
• Consider supplemental agreements where direct amendments prove impossible
• Document good-faith efforts for regulatory discussions

Balancing Security and Operations

Implementing robust controls sometimes creates operational friction. Success requires engaging business stakeholders early, designing user-friendly security technologies, communicating business value clearly, and establishing escalation procedures for conflicting needs.

Best Practices for Successful Implementation

Recommended Timeline (6-Month Window)

Months 1-2: Conduct comprehensive gap analysis, assemble cross-functional teams, secure executive sponsorship and resources, develop implementation roadmap, initiate board education programs.

 

Months 3-4: Develop framework documentation, begin third-party contract reviews, implement priority technical controls, establish incident response capabilities, conduct ICT asset inventory and risk assessments.

 

Months 5-6: Complete framework documentation and obtain board approval, finalize third-party arrangements, conduct response plan testing, implement monitoring capabilities, develop notification procedures, conduct final compliance verification.

Key Success Factors

Cross-Functional Collaboration: Build teams spanning IT, cybersecurity, risk management, legal, compliance, business units, finance, and procurement to ensure comprehensive implementation.

 

Executive Engagement: Provide leadership education, establish regular reporting cadences, identify key decision points, and secure explicit resource commitments.

 

External Expertise: Strategically leverage consulting services for gap assessments, managed security services for 24/7 capabilities, specialized training providers, and legal counsel for contract negotiations.

 

Comprehensive Documentation: Maintain written frameworks, policies and procedures, asset inventories, risk assessments, due diligence reports, testing records, incident response plans, and board reporting packages.

The Road Ahead: Anticipating Regulatory Evolution

While current requirements establish binding standards, firms should anticipate ongoing developments:

 

Post-Implementation Reviews: The FSRA may conduct thematic or risk-based reviews assessing adoption effectiveness and identifying refinement areas.

 

Potential Annual Reporting: Depending on implementation findings, the FSRA may introduce annual Cyber Risk Management Returns requiring firms to report on cybersecurity posture, incidents experienced, and control effectiveness, aligning with international practices.

 

Guidance Updates: Expect additional FSRA guidance clarifying expectations and providing practical implementation examples as common questions emerge.

 

Evolving Threats: Regulatory expectations will likely evolve in response to emerging threat patterns, including increasing sophistication in ransomware, supply chain compromises, and AI-enhanced social engineering.

Conclusion: Embracing Cyber Resilience as Strategic Advantage

The ADGM Cyber Risk Management Framework represents far more than a compliance obligation—it offers financial institutions an opportunity to strengthen operational resilience, protect customer trust, and differentiate themselves in competitive markets.

 

At NR Doshi & Partners, we advise clients to approach implementation strategically, viewing cybersecurity as a business enabler rather than merely a cost center. Firms that build robust frameworks, foster security cultures, and demonstrate genuine commitment to protecting stakeholders will emerge as leaders in the next era of financial services.

 

The six-month implementation window demands focused action, but with strategic planning, appropriate resource allocation, and executive commitment, firms can successfully navigate this transition while building lasting cybersecurity capabilities that serve them well beyond regulatory compliance.