Suspect a breach? Report it immediately — response within 1 hour.Report an incident
EBH Security
Contact us

Cybersecurity services — Kuwait

Direct engagement, with no local accreditation restriction, under CITRA's guidance.

Last updated — August 22, 2026

The local regulatory framework

Kuwait's cybersecurity framework is carried by the Communication and Information Technology Regulatory Authority (CITRA), which issues and updates a national cybersecurity framework applicable to telecommunications operators and, more broadly, to entities handling sensitive information systems. This framework is driven by directives and guidelines issued by CITRA rather than by a single, stable piece of legislation.

Concrete obligations

Compliance with cybersecurity directives issued by CITRA for telecommunications operators and digital service providers

Implementation of security controls proportionate to the criticality of information systems, in line with national guidelines

Active monitoring of regulatory developments, as Kuwait's framework continues to evolve

Adapted services

Security audit

Managed SOC & MDR

Compliance & GRC

Priority sectors

TelecommunicationsFinance

Delivery modalities

Engagement model

Direct engagement

Languages

Arabic, English, French

Local FAQ

What is the reference cybersecurity authority in Kuwait?

The Communication and Information Technology Regulatory Authority (CITRA), which issues the national cybersecurity directives.

Is there a single, stable cybersecurity law in Kuwait?

Kuwait's framework relies mainly on directives and guidelines issued by CITRA rather than a single fixed piece of legislation — ongoing regulatory monitoring is required.

Can EBH Security operate directly in Kuwait?

Yes, no local accreditation constraint restricts direct engagement in this market.

What sectors are priorities in Kuwait?

Telecommunications, given CITRA's direct authority over that sector, along with finance.

How does EBH Security ensure compliance with CITRA's directives?

Through continuous regulatory monitoring and an initial scoping phase that aligns the engagement with the guidelines in force at the time.

Get in touch