Manama Sets a Common Baseline: GCC Adopts Joint Cyber Frameworks as Attack Volumes Hold at Wartime Levels

Week of 31 August 2026 | Compiled by Team Paringa

GCC cybersecurity for the people accountable for it. This week the region moved from coordination talk to adopted frameworks and scheduled drills, while the threat picture stayed at levels that were exceptional eighteen months ago.

What Happened This Week

🔴 GCC Ministerial Committee adopts joint cybersecurity frameworks in Manama

The fifth meeting of the GCC Ministerial Committee for Cybersecurity convened in Manama on 27 August 2026, bringing together the heads of national cybersecurity authorities from member states and the GCC General Secretariat. Qatar was represented by a delegation led by Eng. Abdulrahman bin Ali Al Farahid Al Malki, President of the National Cyber Security Agency.

The headline outcome was formal adoption of joint GCC cybersecurity frameworks. These are standardised regulatory mechanisms intended to harmonise defence protocols across member states, accelerate cross-border intelligence sharing and establish a common operational baseline. That is a meaningful shift from six national regimes that broadly rhymed to a set of agreed common controls.

Delegates also authorised execution of the 6th and 7th Gulf Cyber Drills. These are scheduled stress tests of rapid-response capability and inter-agency coordination against multi-vector attacks on critical national infrastructure. The committee reviewed progress against the executive implementation plan of the GCC Cybersecurity Strategy, which runs 2024 to 2028, and discussed extraordinary operational measures member states have put in place around sovereign networks, power grids and communications.

The framing from officials was that an interconnected Gulf digital economy cannot be defended by isolated national models. That is correct, and it has a direct operational consequence for anyone running security across multiple GCC markets: the compliance surface is about to converge, and the audit evidence you need in Riyadh, Abu Dhabi and Doha will start to look more alike than it does today.

Sources: The Peninsula Qatar, Asharq Al-Awsat

Harmonisation is good news for multi-country operators and bad news for anyone whose regional security posture is six separate answers held together by spreadsheets. Two practical moves this quarter: map your existing controls to the NCA ECC and UAE Cybersecurity Council baselines side by side and find where they already diverge, and get your incident response runbook tested against a multi-country scenario before a Gulf Cyber Drill does it for you. Organisations that can evidence a single consistent control set across GCC entities will spend materially less on audit than those maintaining parallel regimes.

🟡 UAE Cybersecurity Council blocks coordinated attacks on aviation, energy and education

On 10 August 2026 the UAE Cybersecurity Council announced that national systems had detected and contained a series of organised cyberattacks targeting aviation, energy and education. The campaign used multiple vectors, including attempts to breach systems and digital infrastructure, targeting of accounts and operational data, and phishing campaigns aimed at using users as the entry point into target environments.

The Council said the attacks were detected and contained before attackers achieved their objectives, with no disruption to critical systems or essential services. This was the third publicly disclosed critical-infrastructure campaign against the UAE in 2026. Dr Mohammed Al Kuwaiti, Chairman of the UAE Cybersecurity Council, has put daily attack attempts against the UAE at 600,000 to 800,000, against a pre-conflict baseline of 90,000 to 200,000.

The detail worth noting is the vector mix. This was not purely technical exploitation. Phishing and account compromise sat alongside infrastructure intrusion, which means identity was a primary attack surface, not a secondary one. Aviation and energy both carry OT exposure where an identity compromise on the IT side becomes an operational problem quickly.

Sources: Gulf News, Sharjah24, Emirates 24|7

A four-to-eight-fold increase in attempt volume changes SOC economics before it changes SOC technique. Most Gulf security operations were staffed and tooled for the old baseline, and the gap is being absorbed by analyst overtime and alert suppression, neither of which is a control. If your SOC has quietly raised thresholds to keep queue depth manageable in the last twelve months, that decision needs to be on the risk register with a named owner. The identity angle also matters: phishing-resistant authentication removes the entry vector these campaigns keep using, and it is cheaper than the detection capacity you would otherwise need to buy.

🟡 Iran-linked actors expand OT targeting as US sanctions land

In August 2026 US agencies including CISA, the FBI, the NSA, the Department of Energy and the EPA warned that Iran-affiliated actors are expanding attacks on industrial control devices used in water, energy and municipal infrastructure. A 19 August advisory detailed targeting of Siemens S7 programmable logic controllers, with the target set also extending to Schneider Electric equipment. CISA advisory AA26-097A covers Iranian-affiliated exploitation of PLCs across US critical infrastructure.

Separately, the US Treasury sanctioned five Iranian nationals over cyberattacks and theft targeting critical infrastructure, government offices and digital assets, as part of a wider sanctions package. Iranian threat activity has been attributed to campaigns against more than 30 water and wastewater utilities across at least 12 US states since strikes on Iran began in February 2026.

The Gulf read-across is direct. The tooling, tradecraft and target selection being used against US utilities apply without modification to GCC water, power and desalination infrastructure, and the Gulf sits far closer to the conflict. Any operator running Siemens S7 or Schneider PLCs should treat these advisories as regionally relevant rather than as US news.

Sources: The Hacker News, Cybersecurity Dive, CISA advisory AA26-097A

Pull the PLC inventory this week. Most GCC operators cannot name every internet-reachable controller they own, and that is the finding these advisories keep producing. Three checks, in order: which S7 and Schneider devices are reachable from outside the OT boundary, which still run default or shared credentials, and whether your SOC has any visibility into OT protocol traffic at all. The third is where most organisations discover they have IT monitoring and OT hope.

What GCC CISOs and Heads of Security Are Dealing With

Two forces are pulling in the same direction. Threat volume has settled at a wartime baseline rather than spiking and receding, and regulation is consolidating faster than internal capability. The Saudi NCA now runs unannounced regulatory inspections and requires independent security audits for Class A organisations, with the NCINCC-1:2025 controls setting a tiered minimum baseline for private sector entities. The GCC-level frameworks adopted in Manama add a regional layer on top. Meanwhile the UAE Cybersecurity Council is publicly disclosing campaigns rather than absorbing them quietly, which raises board-level visibility and board-level expectation at the same time.

The market response is visible in the numbers. The Middle East and Africa cybersecurity market is estimated at USD 3.67 billion in 2026, up from USD 3.27 billion in 2025, with forecasts to USD 6.54 billion by 2031 at 12.23 percent CAGR. Analysts expect bundled MSSP offerings and sovereign-cloud SOCs to take share from pure-play consulting, driven by demand for continuous monitoring with localised data handling. That last point is the commercially important one: Gulf buyers increasingly will not accept a SOC that processes their telemetry outside the region, and that requirement is reshaping who can credibly bid.

Three Things Worth Watching Next Week

1. Dates and scope for the 6th Gulf Cyber Drill — Once published, it tells you which sectors and scenarios GCC authorities consider highest risk, which is a free prioritisation input for your own tabletop schedule.

2. Publication detail on the adopted joint GCC frameworks — Whether these are binding controls or reference architecture determines how much work lands on multi-country operators in the next two quarters.

3. Further UAE Cybersecurity Council disclosures — Three publicly disclosed campaigns in 2026 so far. A fourth, particularly one touching financial services or healthcare, would signal an escalation in both targeting and disclosure policy.

Questions? hello@paringa.ai

Paringa is an Infrastructure & AI Security, Cost and Governance Specialist. We work with GCC organisations on identity, detection and OT visibility, and on proving control coverage to regulators without running six parallel compliance regimes. | 31 August 2026 | © Paringa Ltd