A digital-banking channel
Trace a transaction through customer access, APIs, applications, third parties and logging. Validate how operations recognize and handle an event.
All frameworks & requirements
Central Bank of Jordan
CBJ Cybersecurity Framework Readiness
Strengthen financial-sector cyber resilience through CBJ readiness, service-based risk, technical controls, incident coordination and evidence.
Published financial-sector framework; verify current supervisory instructionsSources reviewed: 4 November 2026
Understand the requirement. Connect it to operations.
The Central Bank of Jordan publishes a Cybersecurity Framework for the Financial Sector with a risk-based approach to resilience. The official document covers governance/management, technical/operational controls, crisis/contingency planning, collaboration and assessment. Jo-FinCERT supports sector coordination.
The useful assessment unit is a financial service and its dependencies. Customer channels, identity systems, payment integrations, suppliers, data and recovery arrangements must work as one controlled service. An institution should explain both its safeguards and how it knows they are effective.
Confirm applicability before choosing controls.
Confirm the institution's license, supervised activities and current CBJ instructions before determining the boundary. Consider the published framework and associated directions in context; do not assume identical requirements for every bank, payment provider, fintech or supplier.
Map national cybersecurity, personal-data protection, outsourcing, continuity and contractual obligations to the same control inventory. Maintain distinct references and approval responsibilities. Cross-border institutions need a separate Saudi mapping where applicable rather than treating CBJ and SAMA as interchangeable.
Turn requirements into implementation and evidence.
| Focus area | Implementation examples | Evidence to maintain |
|---|---|---|
| Governance and cyber risk | Connect services, risk decisions and management oversight. | Approved roles, risk assessments and governance records. |
| Technical and service protection | Review identity, applications, transactions, infrastructure and data. | Access reviews, architecture evidence and validation findings. |
| Supplier dependencies | Assess outsourced services, remote access and cloud responsibilities. | Supplier reviews, contract controls and access evidence. |
| Crisis and recovery readiness | Exercise escalation, containment and restoration with business owners. | Response records, recovery tests and action plans. |
| Collaboration and assessment | Define appropriate coordination and repeatable evidence-based reviews. | Coordination procedures, assessment rationale and improvement tracking. |
What this looks like in practice.
A major supplier outage
Exercise institutional decisions and recovery dependencies, not only the supplier's service-level commitment. Document limitations and accountable remediation.
From readiness assessment to working controls.
Agree the scope, responsible owners and acceptance criteria before work begins. The approach is tailored to your systems, suppliers, operating constraints and existing evidence.
Assess and prioritize
Review applicability, current controls and evidence. Identify gaps and dependencies, distinguish design from operating effectiveness, and prioritize actions with accountable owners.
Design the improvements
Translate approved requirements into architecture, policies, processes and technical changes. Reuse effective controls while keeping national and sector mappings distinct.
Implement and validate
Configure agreed safeguards, document procedures and validate representative workflows within authorized access and change windows. Record exceptions and residual risks.
Handover and sustain
Organize evidence, transfer operating knowledge and define a review cadence. Track corrective actions as systems, services, suppliers and requirements change.
Agree concrete deliverables.
- A scope and applicability record with assumptions and responsibilities.
- A gap/risk register and prioritized remediation roadmap.
- Control mapping, architecture recommendations and operating procedures.
- An evidence register, agreed validation results and handover material.
Deliverables, depth, access and timing depend on the statement of work. This is readiness and implementation support; it does not include a promise of regulator acceptance or formal certification.
Common questions.
Does the framework apply identically to all financial businesses?
Confirm the license, supervisory perimeter and current directions. Determine applicability for the institution and its activities rather than a generic sector label.
Is CBJ cybersecurity equivalent to SAMA CSF?
No. These are distinct regimes. Shared controls can support both, but mappings and evidence expectations remain separate.
What is Jo-FinCERT's role here?
Official CBJ material describes financial-sector collaboration and coordination. Define appropriate participation and escalation arrangements using current requirements.
Can an audit checklist replace operational testing?
No. Complement evidence review with proportionate validation of controls, incident handoffs and recovery. Testing needs authorized scope and an agreed method.
Can IRIS guarantee regulator acceptance?
No. Readiness support identifies gaps and improves implementation and evidence. Supervisory conclusions and formal approvals remain with the competent authority.
Start with the official sources.
Read the linked authority publications for the binding scope, wording and applicable updates. The implementation examples on this page are practical recommendations, not a reproduction of every regulatory requirement.
General readiness and technology information, not a legal opinion, regulator endorsement or guarantee of compliance. Confirm applicability, current versions and sector directions with the competent authority and qualified advisers.
Related frameworks and requirements
Define the right scope for your organization.
Bring your services, systems, supplier dependencies and existing findings. We will help turn them into a practical assessment and implementation scope.
Discuss your readiness