CBK CORF Compliance

CBK CORF compliance means meeting the Cyber and Operational Resilience Framework issued by the Central Bank of Kuwait for the banks and financial institutions it supervises. The CORF replaces CBK's 2020 Cybersecurity Framework and combines cyber resilience, operational resilience, and third-party risk management requirements under one maturity-based model.

The CORF applies to all Regulated Entities under CBK supervision. CBK places each entity in a tier by risk profile: Tier 1 covers high-impact entities such as D-SIBs and Financial Market Infrastructures, Tier 2 covers mid-sized entities, and Tier 3 covers smaller ones. The Cyber Resilience Baselines also extend to employees, third-party vendors, and vendor staff serving the entity.

The CORF sets out 876 controls in three Baselines: 519 in the Cyber Resilience Baselines, 146 in the Operational Resilience Baselines, and 211 in the Third-Party Risk Management Baselines. Testing-related controls require penetration testing, red teaming, and resilience testing on a set schedule and again after significant changes in the environment or threat landscape.

Each requirement is rated Compliant, Non-Compliant, or Not Applicable based on documented, verifiable evidence, with no partial credit. Each sub-domain also receives a maturity level from 1 (Initial) to 5 (Innovative). A level counts only when the level below it is fully achieved.

CBK assesses Tier 1 entities every year, Tier 2 entities every eighteen months, and Tier 3 entities every two years. Any entity can also face spot checks and ad-hoc reviews at any time, so evidence must stay current between scheduled assessments.

For Cybersecurity Testing and Threat Management, Level 4 (Advanced) expects Breach and Attack Simulation tools to validate defensive controls continuously and exposures to be prioritized by asset criticality, adversary TTPs, and business impact. Level 5 (Innovative) expects a CTEM program that aligns testing, detection, and risk mitigation.

Security validation tests defenses the way an attacker would: it checks whether controls block or detect real attack techniques, maps the attack paths that lead to critical assets, and proves which exposures are actually exploitable. It turns periodic, document-based compliance into tested evidence, with time-stamped results, treatment decisions, and verified re-tests that CBK assessors, independent auditors, and the Board can review.

Picus combines Breach and Attack Simulation, Autonomous Penetration Testing, and Exposure Validation to test controls, map attack paths, and prove exploitability, including on systems too critical to test live. Each exposure ends in a Patch, Mitigate, Monitor, or Accept with Evidence decision with a verified re-test, and Numi AI orchestrates Picus Swarm agents to start new tests when the environment or threat landscape changes.