ADGM / FSRA Cybersecurity Requirements: A Practical Guide
ADGM’s Cyber Risk Management Rules have applied since 31 January 2026. This guide covers the security requirements for FSRA-regulated firms and a practical way to prepare the supporting evidence. The separate DeFi consultation does not replace these rules.
Which ADGM Requirements Apply?
The FSRA’s July 2025 announcement introduced the framework for Authorised Persons and Recognised Bodies, with compliance required from 31 January 2026. GEN 3.5 contains the core requirements for Authorised Persons; Recognised Bodies should check how the Market Infrastructure Rulebook applies them.
The FSRA’s IT risk page also explains that IT practices are considered during supervision and Financial Services Permission applications. A commercial registration in ADGM alone does not establish which financial-services rules apply to a business. Start with your permission, activities and operating entities.
GEN rules, IT risk management guidance and virtual asset activity requirements should be recorded separately in your assessment. Label the source, its status and the entity it applies to. A policy based on guidance may help implement a rule, but the assessment still needs to identify the rule itself.
Our articles on DeFi protocol due diligence and DeFi monitoring address the separate draft DeFi guidance. Keep that proposed guidance separate from the cyber rules already in force.
The GEN 3.5 Security Requirements
The adopted cyber amendments require a written, governing-body-approved framework proportionate to the firm’s risks, with defined responsibilities and at least annual review. The following table pairs the main duties with evidence we recommend collecting.
| Rule / duty | Practical evidence to prepare |
|---|---|
| 3.5.1 and 3.5.3: framework, governance and risk tolerance | Approval record, named owners, escalation authority and management reports showing decisions on unresolved risks. |
| 3.5.2: third-party cyber risk, due diligence and oversight | Provider register, security reviews, contracts, incident contacts and records of follow-up on exceptions. |
| 3.5.4: current ICT inventory and at least annual risk assessment | Asset export linked to business functions, custody dependencies and the risk register. |
| 3.5.5–3.5.6: malware protection and network security | Endpoint coverage, network diagrams, firewall rules, detection settings and sampled security alerts. |
| 3.5.7–3.5.8: access management; MFA or equivalent for internet-accessible and privileged access | Role exports, authentication settings, access reviews and a test of a departed operator’s revoked access. |
| 3.5.9–3.5.13: changes, updates, encryption, physical security and training | Release approvals, patch records, backup recovery results and exercises for staff with privileged access. |
| 3.5.14: ongoing monitoring, regular resilience testing and remediation; internet-facing systems tested at least annually | Dated scope, test reports, finding owners, fix verification and management review. |
| 3.5.15–3.5.17: incident detection, response and recovery; response procedures tested regularly and the plan reviewed at least annually | Alert records, response plans, recovery procedures and exercise results showing who made each decision. |
Use the FSRA’s current rulebook links when finalising scope. The table is a starting point for an assessment, not a complete control catalogue.
Include the Systems That Can Move Assets
For a virtual asset firm, we recommend tracing a withdrawal from the client request through approval, transaction construction and signing. This often identifies dependencies missing from the initial cloud inventory.
- Signing: HSMs, MPC shares, approval devices, signing policies and the people who can change them.
- Administration: identity providers, privileged cloud roles, support consoles and emergency accounts.
- Software delivery: repositories, build jobs, secrets, deployment permissions and wallet vendor updates.
- Onchain authority: upgrade, pause, mint and asset-transfer roles, where your business uses them.
- Recovery: backup locations, recovery participants, replacement devices and provider dependencies.
Record who owns each component and which service fails if it is unavailable or compromised. Our private key management guide explains the differences between custody designs and their recovery assumptions.
Build a Test Plan Around Your Risks
GEN 3.5.14 sets a testing programme rather than one universal test format. Its guidance gives examples of methods. Choose tests against your architecture and record why they cover the risks identified.
For a custody operation, our recommended scope includes the withdrawal application, administrative APIs, signing boundaries and the infrastructure hosting them. A report on the public website leaves much of that operation untested.
Combine penetration testing with configuration review, access tests and recovery exercises where appropriate. If contracts hold funds or enforce an important control, include a smart contract audit in the technical plan. That is a scoping recommendation; this general cyber rule is not a blanket requirement for every firm to buy a contract audit.
For every finding, retain the affected asset, business impact, owner, due date and retest result. Record any remaining exposure and who accepted it. A closed ticket should point to the evidence that the fix worked.
Prepare for Immediate Incident Notification
The FSRA’s incident reporting instructions say Authorised Persons must notify relevant operational incidents immediately under GEN 8.10.6. GEN 3.5.18 requires notification of material cyber incidents immediately, and no later than 24 hours after awareness or information reasonably suggesting one occurred. The instructions specify an initial Template A and progressive updates using Template B.
Do not build a playbook that waits for a completed investigation before anyone can escalate. We recommend rehearsing three cases: a compromised signer, a custody provider outage and unauthorised access to a withdrawal console.
For each exercise, identify the person who evaluates materiality, the person authorised to notify, their deputies, the available evidence and the next update time. Test whether the team can preserve logs and stop dangerous transactions while the notification is prepared. Our exchange incident response guide provides an operational starting point.
Check What Your Providers Actually Cover
GEN 3.5.2 keeps responsibility with the firm using the ICT provider. Its requirements include suitable contractual arrangements, incident cooperation, continuing security verification and supervision.
We recommend testing the practical limits of each provider’s assurance. A cloud certificate may describe the provider’s controls while leaving your identity configuration and signing policy entirely with your team. Record those boundaries before accepting the certificate as evidence.
Ask how quickly you can obtain incident information, whether subcontractors handle critical data or keys, and how you recover service if the provider becomes unavailable. Connect each answer to a contract term or an exercised procedure. See our third-party risk management playbook for a fuller checklist.
A Practical Assessment Pack
Keep one index that connects each applicable requirement to a control, its owner, a test and the resulting evidence. We suggest these fields:
- Requirement: source, rule reference, applicable entity and activity.
- Control: the implemented procedure or configuration and the system it protects.
- Test: method, scope, date and any limitations.
- Evidence: report, export, log sample or exercise record, with a version and owner.
- Outcome: finding, remediation, retest and any outstanding risk decision.
Guardian’s ADGM / FSRA assessment can review the control framework, test the relevant systems and organise the technical findings for management and supervisory review. Agree the scope against your actual permission and architecture before testing begins.
Primary Sources
- FSRA: IT Risk Management and incident reporting instructions.
- FSRA: Cyber Risk Management Framework announcement, 29 July 2025.
- FSRA: adopted General Rulebook cyber amendments.
Sources checked 7 November 2026. Rule summaries and recommended technical evidence are distinguished above; the assessment scope depends on the firm’s permission and activities.
Plan your compliance assessment
Review the requirements, test your controls and verify the fixes with Guardian.