← Frameworks / CBB TM / Control Mappings

Machine-readable: JSON API guide

Central Bank of Bahrain Technology Module

Mandatory technology governance and cybersecurity requirements for all CBB-licensed financial institutions in Bahrain. 16 sections covering board oversight, IT governance, information security, risk management, operations, access control, application and network security, data security, physical security, vulnerability management, SOC, incident response, BCM/DR, third-party management, and regulatory reporting.

Controls: 203
Total Mappings: 260
Publisher: Central Bank of Bahrain (CBB) Version: 2023
CBB TM → SP 800-53 SP 800-53 → CBB TM Coverage Analysis
AC (21) AT (4) AU (14) CA (3) CM (10) CP (13) IA (11) IR (9) MP (8) PE (19) PL (7) PM (15) PS (4) PT (2) RA (8) SA (13) SC (22) SI (10) SR (10)

AC Access Control

Control Name CBB TM References
AC-01 Policy and Procedures
TM-6
AC-02 Account Management
TM-6
AC-03 Access Enforcement
TM-6
AC-04 Information Flow Enforcement
TM-6TM-8
AC-05 Separation of Duties
TM-6
AC-06 Least Privilege
TM-6
AC-07 Unsuccessful Logon Attempts
TM-6
AC-08 System Use Notification
TM-6
AC-10 Concurrent Session Control
TM-6
AC-11 Device Lock
TM-6
AC-12 Session Termination
TM-6
AC-13 Supervision and Review — Access Control
TM-6
AC-14 Permitted Actions Without Identification or Authentication
TM-6
AC-15 Automated Marking
TM-9
AC-16 Security and Privacy Attributes
TM-6TM-9
AC-17 Remote Access
TM-6TM-8
AC-18 Wireless Access
TM-6TM-8
AC-19 Access Control for Mobile Devices
TM-6
AC-20 Use of External Systems
TM-6TM-15
AC-24 Access Control Decisions
TM-6
AC-25 Reference Monitor
TM-6

AT Awareness and Training

Control Name CBB TM References
AT-01 Policy and Procedures
TM-3
AT-02 Literacy Training and Awareness
TM-3
AT-03 Role-based Training
TM-3
AT-06 Training Feedback
TM-3

AU Audit and Accountability

Control Name CBB TM References
AU-01 Policy and Procedures
TM-16
AU-02 Event Logging
TM-12
AU-03 Content of Audit Records
TM-12
AU-04 Audit Log Storage Capacity
TM-5TM-12
AU-05 Response to Audit Logging Process Failures
TM-12
AU-06 Audit Record Review, Analysis, and Reporting
TM-12TM-13TM-16
AU-07 Audit Record Reduction and Report Generation
TM-12
AU-08 Time Stamps
TM-12
AU-09 Protection of Audit Information
TM-12
AU-10 Non-repudiation
TM-12
AU-11 Audit Record Retention
TM-12
AU-12 Audit Record Generation
TM-12
AU-14 Session Audit
TM-12
AU-16 Cross-organizational Audit Logging
TM-12

CA Security Assessment and Authorization

Control Name CBB TM References
CA-02 Control Assessments
TM-16
CA-05 Plan of Action and Milestones
TM-4TM-11TM-16
CA-07 Continuous Monitoring
TM-5TM-12TM-16

CM Configuration Management

Control Name CBB TM References
CM-01 Policy and Procedures
TM-5
CM-02 Baseline Configuration
TM-5
CM-03 Configuration Change Control
TM-5TM-11
CM-04 Impact Analyses
TM-5TM-7TM-11
CM-05 Access Restrictions for Change
TM-5
CM-06 Configuration Settings
TM-5
CM-09 Configuration Management Plan
TM-5
CM-12 Information Location
TM-9TM-15
CM-13 Data Action Mapping
TM-9TM-15
CM-14 Signed Components
TM-7

CP Contingency Planning

Control Name CBB TM References
CP-01 Policy and Procedures
TM-14
CP-02 Contingency Plan
TM-14
CP-03 Contingency Training
TM-14
CP-04 Contingency Plan Testing
TM-14
CP-05 Contingency Plan Update
TM-14
CP-06 Alternate Storage Site
TM-14
CP-07 Alternate Processing Site
TM-14
CP-08 Telecommunications Services
TM-14
CP-09 System Backup
TM-14
CP-10 System Recovery and Reconstitution
TM-14
CP-11 Alternate Communications Protocols
TM-14
CP-12 Safe Mode
TM-14
CP-13 Alternative Security Mechanisms
TM-14

IA Identification and Authentication

Control Name CBB TM References
IA-01 Policy and Procedures
TM-6
IA-02 Identification and Authentication (Organizational Users)
TM-6
IA-03 Device Identification and Authentication
TM-6
IA-04 Identifier Management
TM-6
IA-05 Authenticator Management
TM-6
IA-06 Authentication Feedback
TM-6
IA-07 Cryptographic Module Authentication
TM-6
IA-08 Identification and Authentication (Non-organizational Users)
TM-6
IA-10 Adaptive Authentication
TM-6
IA-11 Re-authentication
TM-6
IA-12 Identity Proofing
TM-6

IR Incident Response

Control Name CBB TM References
IR-01 Policy and Procedures
TM-13
IR-02 Incident Response Training
TM-13
IR-03 Incident Response Testing
TM-13
IR-04 Incident Handling
TM-5TM-12TM-13
IR-05 Incident Monitoring
TM-13
IR-06 Incident Reporting
TM-13TM-16
IR-07 Incident Response Assistance
TM-13
IR-08 Incident Response Plan
TM-13
IR-09 Information Spillage Response
TM-13

MP Media Protection

Control Name CBB TM References
MP-01 Policy and Procedures
TM-9
MP-02 Media Access
TM-9
MP-03 Media Marking
TM-9
MP-04 Media Storage
TM-9
MP-05 Media Transport
TM-9
MP-06 Media Sanitization
TM-9
MP-07 Media Use
TM-9
MP-08 Media Downgrading
TM-9

PE Physical and Environmental Protection

Control Name CBB TM References
PE-01 Policy and Procedures
TM-10
PE-02 Physical Access Authorizations
TM-10
PE-03 Physical Access Control
TM-10
PE-04 Access Control for Transmission
TM-10
PE-05 Access Control for Output Devices
TM-10
PE-06 Monitoring Physical Access
TM-10
PE-07 Visitor Control
TM-10
PE-08 Visitor Access Records
TM-10
PE-09 Power Equipment and Cabling
TM-10
PE-10 Emergency Shutoff
TM-10
PE-11 Emergency Power
TM-10
PE-12 Emergency Lighting
TM-10
PE-13 Fire Protection
TM-10
PE-14 Environmental Controls
TM-10
PE-15 Water Damage Protection
TM-10
PE-17 Alternate Work Site
TM-10
PE-18 Location of System Components
TM-10
PE-20 Asset Monitoring and Tracking
TM-10
PE-23 Facility Location
TM-10

PL Planning

Control Name CBB TM References
PL-01 Policy and Procedures
TM-2TM-3
PL-02 System Security and Privacy Plans
TM-2TM-3
PL-07 Concept of Operations
TM-2
PL-08 Security and Privacy Architectures
TM-2TM-3
PL-09 Central Management
TM-1TM-2TM-3TM-4
PL-10 Baseline Selection
TM-4
PL-11 Baseline Tailoring
TM-4

PM Program Management

Control Name CBB TM References
PM-01 Information Security Program Plan
TM-1TM-2TM-3
PM-02 Information Security Program Leadership Role
TM-1TM-3
PM-03 Information Security and Privacy Resources
TM-1
PM-04 Plan of Action and Milestones Process
TM-4TM-11
PM-06 Measures of Performance
TM-16
PM-07 Enterprise Architecture
TM-2
PM-08 Critical Infrastructure Plan
TM-2TM-14
PM-09 Risk Management Strategy
TM-1TM-2TM-3TM-4
PM-11 Mission and Business Process Definition
TM-2TM-14
PM-13 Security and Privacy Workforce
TM-3
PM-14 Testing, Training, and Monitoring
TM-3TM-16
PM-15 Security and Privacy Groups and Associations
TM-3
PM-16 Threat Awareness Program
TM-3TM-11TM-12TM-13
PM-28 Risk Framing
TM-2TM-3TM-4
PM-29 Risk Management Program Leadership Roles
TM-1

PS Personnel Security

Control Name CBB TM References
PS-04 Personnel Termination
TM-6
PS-05 Personnel Transfer
TM-6
PS-07 External Personnel Security
TM-15
PS-09 Position Descriptions
TM-1

PT Personally Identifiable Information Processing and Transparency

Control Name CBB TM References
PT-02 Authority to Process Personally Identifiable Information
TM-9
PT-03 Personally Identifiable Information Processing Purposes
TM-9

RA Risk Assessment

Control Name CBB TM References
RA-01 Policy and Procedures
TM-2TM-4
RA-02 Security Categorization
TM-4TM-9
RA-03 Risk Assessment
TM-4TM-15
RA-04 Risk Assessment Update
TM-4
RA-05 Vulnerability Monitoring and Scanning
TM-4TM-11
RA-07 Risk Response
TM-4TM-11
RA-09 Criticality Analysis
TM-4TM-14TM-15
RA-10 Threat Hunting
TM-11TM-12

SA System and Services Acquisition

Control Name CBB TM References
SA-02 Allocation of Resources
TM-5
SA-03 System Development Life Cycle
TM-7
SA-04 Acquisition Process
TM-7TM-15
SA-08 Security and Privacy Engineering Principles
TM-7
SA-09 External System Services
TM-15
SA-10 Developer Configuration Management
TM-7
SA-11 Developer Testing and Evaluation
TM-7
SA-15 Development Process, Standards, and Tools
TM-7
SA-16 Developer-provided Training
TM-7
SA-17 Developer Security and Privacy Architecture and Design
TM-7
SA-20 Customized Development of Critical Components
TM-7
SA-21 Developer Screening
TM-7TM-15
SA-22 Unsupported System Components
TM-15

SC System and Communications Protection

Control Name CBB TM References
SC-01 Policy and Procedures
TM-8
SC-02 Separation of System and User Functionality
TM-8
SC-03 Security Function Isolation
TM-8
SC-05 Denial-of-service Protection
TM-8
SC-06 Resource Availability
TM-5
SC-07 Boundary Protection
TM-8
SC-08 Transmission Confidentiality and Integrity
TM-8TM-9
SC-10 Network Disconnect
TM-8
SC-12 Cryptographic Key Establishment and Management
TM-9
SC-13 Cryptographic Protection
TM-9
SC-20 Secure Name/Address Resolution Service (Authoritative Source)
TM-8
SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
TM-8
SC-22 Architecture and Provisioning for Name/Address Resolution Service
TM-8
SC-23 Session Authenticity
TM-8
SC-24 Fail in Known State
TM-14
SC-26 Decoys
TM-12
SC-28 Protection of Information at Rest
TM-9
SC-32 System Partitioning
TM-8
SC-39 Process Isolation
TM-8
SC-40 Wireless Link Protection
TM-8
SC-41 Port and I/O Device Access
TM-8
SC-44 Detonation Chambers
TM-8TM-12

SI System and Information Integrity

Control Name CBB TM References
SI-02 Flaw Remediation
TM-5TM-11
SI-03 Malicious Code Protection
TM-8
SI-04 System Monitoring
TM-8TM-12TM-13
SI-05 Security Alerts, Advisories, and Directives
TM-11TM-13
SI-10 Information Input Validation
TM-7
SI-11 Error Handling
TM-7
SI-12 Information Management and Retention
TM-9
SI-13 Predictable Failure Prevention
TM-5
SI-17 Fail-safe Procedures
TM-14
SI-19 De-identification
TM-9

SR Supply Chain Risk Management

Control Name CBB TM References
SR-01 Policy and Procedures
TM-15
SR-02 Supply Chain Risk Management Plan
TM-15
SR-03 Supply Chain Controls and Processes
TM-15
SR-04 Provenance
TM-15
SR-05 Acquisition Strategies, Tools, and Methods
TM-15
SR-06 Supplier Assessments and Reviews
TM-15
SR-07 Supply Chain Operations Security
TM-15
SR-08 Notification Agreements
TM-15
SR-10 Inspection of Systems or Components
TM-15
SR-11 Component Authenticity
TM-15