Compliance FrameworksMiddle East & Africa
Kuwait Cybersecurity Law
Kuwait National Cyber Security Strategy and DCC guidelines - critical infrastructure protection.
Kuwait National Cyber Security Strategy and DCC guidelines - critical infrastructure protection.
| Short name | KW Cyber |
| Region | Middle East & Africa |
| Country or scope | Kuwait |
| Sector | Government |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers KW Cyber
- Scan requirements: 5, all decided by a scan.
- Controls: the scan requirements below, plus 9 controls from Safeguard's control catalog for KW Cyber.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 23: 1 written for KW Cyber and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
KW-CYBER-ASSET Critical Asset Identification | Operators of critical national infrastructure must identify and classify the information assets and systems they rely on, which for software means a documented component inventory (Kuwait NCSS critical infrastructure protection pillar) | Scan |
KW-CYBER-RISK Cyber Risk Assessment Capability | National cybersecurity guidance requires risk assessments over critical systems, which is only possible when components are unambiguously identifiable for matching against known threats (Kuwait NCSS / CITRA risk management guidance) | Scan |
KW-CYBER-INT System Integrity Protection | Baseline controls call for protecting the integrity of systems supporting critical services against tampering, evidenced by cryptographic hashes on deployed software artifacts (CITRA cybersecurity framework technical controls) | Scan |
KW-CYBER-VENDOR Third-Party and Vendor Oversight | CITRA guidance requires managing risks introduced by service providers and technology vendors, which extends to recording who supplies each software component (CITRA third-party/outsourcing security guidance) | Scan |
KW-CYBER-IR Incident Response Readiness | Entities must be able to report and respond to cyber incidents in coordination with national authorities, requiring version-level knowledge of deployed software to scope impact quickly (Kuwait NCSS incident response and coordination pillar) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
KW-GOV-1 | Cybersecurity Governance Structure |
KW-GOV-2 | Cybersecurity Policy Framework |
KW-RISK-1 | National Cyber Risk Assessment |
KW-ASSET-1 | Asset Inventory & Classification |
KW-IAM-1 | Access Control & Privileged Access Management |
KW-INC-1 | Incident Detection & Response |
KW-INC-2 | Cyber Incident Reporting to DCC |
KW-BCP-1 | Business Continuity & Disaster Recovery |
KW-BCP-2 | Backup & Recovery Controls |
Policy templates
Written for KW Cyber:
- Kuwait Cybersecurity Programme Policy
And 22 from the standard set, adapted to KW Cyber.