Oman issues mandatory “IT Risk Management Policy”

4 min 12 sec April 20, 2026 (Edited)

Written by

David Yates

Partner, Head of Digital & Data

d.yates@tamimi.com View LinkedIn Profile

Oman’s Ministry of Transport, Communications and Information Technology has issued a mandatory IT Risk Management Policy applicable to all government agencies, aimed at strengthening cyber resilience and protecting public digital assets. Here are the key takeaways:

(1) The policy has been developed in alignment with the Ministry’s strategic direction to strengthen digital assets and enhance the efficiency of digital services across Oman. Recognizing the increasing reliance on information technology across units of the State’s administrative apparatus, the Ministry identified a need for a unified framework governing the management of IT risks. The policy aims to clearly define roles and responsibilities, ensure the preparedness of government units and their contractors to manage potential technological risks, support the enhancement of digital security, and contribute to the effective and reliable advancement of digital transformation initiatives.

(2) The policy sets out four core objectives:

• Protecting government digital assets from current and emerging technological threats.
• Assessing and managing IT risks effectively to ensure business continuity and the stable delivery of digital services at the highest levels of security.
• Enhancing strategic decision-making by government units based on risk assessment and analysis.
• Ensuring alignment with the national emergency management framework in the Sultanate, as well as with relevant policies, regulations, and legislation.

(3) The stated purpose of the policy is to define the core responsibilities of government units and their contractors in managing IT risks. This includes the identification, assessment, treatment, and monitoring of risks in a systematic manner, to ensure effective risk management, protect digital assets, and maintain continuity of services.

(4) The policy applies to two categories of entities:

• State Administrative Units — all units within the State’s administrative apparatus.
• Third Parties — external IT service providers and contractors engaged by government units.

(5) The policy imposes nine key obligations on government administrative units:

• Integration of risk management into IT strategy — Risk management must be embedded as an integral part of each unit’s IT strategy.
• Development of an internal IT risk management policy — Each unit must develop and approve a comprehensive internal policy for managing risks of IT systems and projects, in compliance with national laws and regulations, including the Personal Data Protection Law and other relevant cybersecurity legislation.
• Designation of a risk management team — A team responsible for managing IT risks must be designated within the unit’s organizational structure.
• Asset identification and classification — IT assets must be identified and classified according to their sensitivity and importance to ensure their protection and effective management.
• Periodic risk assessments — Units must conduct periodic assessments of IT risks and maintain a documented register including their sources, impacts, and mitigation measures.
• Risk treatment plans — Units must develop and implement risk treatment plans, including incident response plans and business continuity plans, in accordance with approved risk priorities.
• Procedures for critical systems — Specific procedures must be established and implemented to manage risks associated with critical and sensitive systems, enhancing protection and minimizing the likelihood of disruption to vital services.
• Monitoring and continuous improvement — The effectiveness of the risk management policy must be periodically monitored and improved based on assessment results, incidents, and technological or organizational changes.
• Escalation mechanism — A clear mechanism must be established for escalating high-priority risks to senior management or relevant authorities, ensuring timely decisions based on an accurate assessment of potential impact.

(6) Importantly for the private sector, government units are also required to incorporate IT risk management controls into contracts and agreements with external service providers and contractors throughout the entire project lifecycle — from engagement to delivery or service termination. The specific obligations imposed on external parties include the following:

• Legal compliance — Full compliance with all relevant national laws, including the Personal Data Protection Law issued under Royal Decree No. (6/2022), and all legislation governing the IT and cybersecurity sector.
• Adherence to the unit’s IT risk management policy when signing contracts.
• Pre-implementation risk assessment — A comprehensive risk assessment must be conducted for any system or service to be provided before implementation, including for critical and sensitive systems within the unit.
• Sharing of risk assessment results — Results must be shared with the unit and approval obtained before the actual operation of the service or system.
• Application of technical controls — Appropriate technical controls must be applied to address identified risks, such as encryption, access control, backup, and network segregation, and these controls must be updated based on risk assessment results or unit requirements.
• Periodic reporting — The external provider must supply the unit with periodic reports including the overall security status, any detected technical or security incidents, and any cases of non-compliance with the policy or contractual terms.
• Incident notification — The unit must be immediately and formally notified of any security or technical incident that could impact government systems or data.
• Audit cooperation — Full cooperation with the government unit in any audit related to IT risk management is required, including granting unit representatives access to relevant documents, records, and technical systems upon request for verification or assessment purposes.

This policy establishes a comprehensive, standardized approach for IT risk management across all Omani government entities, mandating proactive risk identification, assessment, and treatment while extending accountability to third-party contractors and service providers.