ADGM: The New Legally Binding Standard
On July 29, 2025, the ADGM Financial Services Regulatory Authority (FSRA) announced its Cyber Risk Management Framework would become legally binding effective January 31, 2026. This wasn't an update to existing guidelines—it was an elevation of requirements to enforceable status.
The framework mandates specific controls that go beyond traditional risk management:
24-Hour Incident Notification
ADGM-regulated firms must now report material cyber incidents to the FSRA within 24 hours of detection. This isn't a best practice—it's a legal requirement with enforcement mechanisms. Our incident response services help firms meet this mandate.
Asset Classification Requirements
Firms must maintain a comprehensive ICT asset inventory classified by criticality (Tier 1, 2, or 3). Auditors are requesting to see these inventories with evidence of quarterly reviews.
Third-Party Contractual Obligations
Your agreements with cloud providers, MSPs, and SaaS vendors must now include specific security clauses addressing incident notification, data protection, and audit rights.
DIFC: The DFSA Risk-Based Approach
While DIFC's approach through DFSA Rulebook GEN 5.5 maintains flexibility—allowing firms to adopt ISO 27001, NIST CSF, CIS Controls, or G7 Cybersecurity Principles—the expectations have sharpened in 2026.
The DFSA's 2025-2026 Business Plan emphasizes "meaningful outcomes" over checkbox compliance. Recent examinations focus on:
Board Accountability
Cyber risk must be on your board agenda with documented evidence of oversight. The DFSA expects to see governing body approval of your cyber risk framework—not just IT department sign-off.
Threat Intelligence Integration
The DFSA's Threat Intelligence Platform (TIP) is now a mandatory engagement point. Firms must demonstrate they receive, assess, and act upon DIFC-specific threat intelligence.
Data Protection Integration
Cyber risk management and data protection are now examined as integrated functions under DIFC Data Protection Law No. 5 of 2020. Separate programs without coordination are flagged as gaps.
The Six-Month Transition Ended January 31, 2026
If you were preparing for these requirements, preparation time is over. Recent enforcement actions from the Central Bank of the UAE (penalties reaching AED 19.5 million in late 2025) demonstrate that regulators are using their enforcement powers.
The question for February 2026 isn't whether you're familiar with these frameworks—it's whether you can demonstrate continuous compliance with legally binding requirements.