Bahrain is one of the GCC's most mature cybersecurity jurisdictions, particularly for financial services. Which logging rules apply depends on your regulator, whether you process personal data and whether you are critical national infrastructure. Often, several apply at once.
The frameworks that apply
- Central Bank of Bahrain (CBB) Rulebook: the most prescriptive framework, covering banks, investment firms, insurers, exchange houses and payment providers.
- Personal Data Protection Law (PDPL): Law No. 30 of 2018, enforced by the Personal Data Protection Authority.
- National Cyber Security Center (NCSC): guidelines for government and critical infrastructure.
- Telecommunications Regulatory Authority (TRA): requirements for licensed telecom operators and ISPs.
CBB Rulebook: what it expects from your logs
- Audit trails that are tamper-evident and cover access, configuration changes, privilege escalation and failed logins.
- A 24/7 security operations centre, in-house or managed, with logs feeding real-time detection.
- A SIEM with meaningful coverage and rule quality, not just a deployed product.
- Incident reporting within defined timeframes, using logs to reconstruct timelines.
- Third-party and cloud logging that is contractually guaranteed and operationally verified.
- Threat intelligence enrichment so indicators can be matched against your logs.
PDPL logging obligations
- Records of who accessed personal data, when and why, which requires application-layer logging.
- Breach detection and impact scoping using logs.
- Support for data subject access, correction and deletion requests.
- Data minimisation inside logs: mask or tokenise personal identifiers in your security data pipeline.
NCSC and TRA
NCSC guidelines expect government and critical infrastructure entities to centralise logging, monitor continuously and integrate with national incident response. TRA requirements focus on network-layer logging and mandatory event reporting for telecom operators.
Log sources you'll need to cover
- Identity and access: Active Directory, IAM, VPN, MFA and privileged sessions.
- Network and perimeter: firewall, proxy, DNS and IDS/IPS.
- Financial platforms: core banking, payments and trading systems.
- Endpoint and server: OS events, EDR and Windows Security logs.
- Cloud: Azure, AWS and Google Cloud audit logs.
- Personal data access: application-layer access to PII datasets.
Common gaps in Bahraini organisations
- A SIEM is in place, but detection rules are minimal, untested or misconfigured.
- Application-layer logging is missing, creating CBB and PDPL gaps at once.
- Third-party log access isn't in the contract, a recurring examination finding.
- No tiered retention, so long-term archiving is expensive or incomplete.
- Threat intelligence isn't used to enrich logs.
Retention reference for Bahrain
| Log category | Typical minimum | Driven by |
|---|---|---|
| Security event logs (SIEM) | 12 months online plus 2–5 years archive | CBB Rulebook, NCSC |
| Privileged access and IAM logs | 12 months | CBB cybersecurity module |
| Financial transaction logs | 5–7 years | CBB Rulebook, AML law |
| Network and firewall logs | 6–12 months | CBB, TRA, NCSC |
| Personal data access logs | Duration of processing plus regulatory period | PDPL |
| Cloud and outsourced service logs | Aligned to the primary log category | CBB outsourcing rules |
Validate these periods against the current CBB Rulebook module for your licence category and the latest PDPA guidance.
Logs that work, not just logs that exist
Bahrain's frameworks are explicit: examiners check that logs are complete, protected and actually used for detection. Treat log architecture as an engineering discipline, with a pipeline, detection engineering and a tiered security data lake, and compliance follows.
Frequently asked questions
Does the CBB require a SIEM?
The CBB expects continuous, real-time monitoring by a SOC, and a SIEM is the standard way to deliver it. Examiners look at coverage and rule quality, not just whether a SIEM exists.
How long should Bahraini banks keep security logs?
A common baseline is 12 months online with two to five years in archive, and longer for financial transaction records. Confirm against the CBB module for your licence.