Qatar's Cyber Security Manual for SMEs: what it asks of your website

Published 2026-11-02 · 5 min read · Samtaro Security & Legal

What the manual is

The Cyber Security Manual for SMEs (version 1.0, June 2024) was published jointly by Qatar Development Bank (QDB) and the National Cyber Security Agency (NCSA). It describes itself as a minimum requirement for SMEs to secure their businesses, written for owners and managers rather than IT specialists. It is free to read on QDB's website. This article is our own summary; read the manual itself for the exact wording.

The 15 requirements at a glance

The manual splits its requirements into process controls (section 5) and technical controls (section 6).

Section	Requirement
5.1	Know your information systems and assets
5.2	Classify your data (following NCSA's National Data Classification Policy)
5.3	Leadership ownership: name an information security owner and set a budget
5.4	Staff awareness, including onboarding and yearly training
5.5	Track changes to your systems
5.6	A written incident response plan
6.1	Basic perimeter defence: firewall, secured Wi-Fi, VPN with MFA for remote access
6.2	Physical security for servers and devices
6.3	Rules for portable and personal devices
6.4	Keep systems and applications updated, ideally automatically
6.5	Change default settings and passwords
6.6	Individual user accounts, least privilege, strong passwords and MFA
6.7	Encrypted, tested backups in a separate location
6.8	Secure your online presence: website and social media accounts
6.9	Use cloud services securely

The step most SMEs miss: two hours to report

Section 5.6 says a typical incident response plan should, at a minimum, report all critical incidents to NCSA within two hours of identifying them. The manual lists two channels: email ncsoc@ncsa.gov.qa and the NCSA hotline 16555, available 24/7. Put both in your plan now, not during an incident.

This is separate from the personal-data breach rules under the PDPPL, where NCSA's breach guideline works to a 72-hour window (see GCC breach notification). A website compromise that exposes customer data can trigger both.

Which parts show up on your public website

Most of the manual covers things only you can check internally: asset lists, training, backups and device rules. A few requirements leave visible traces on your public site and domain:

• 6.8 Secure your online presence: HTTPS, security headers and no exposed files such as .env or .git (website security checklist)
• 6.4 Updates: a CMS or server that advertises an old version number in its headers is a sign updates are lagging
• 6.5 Default settings: default pages and directory listings left switched on
• Phishing (section 4): the manual names phishing as a common attack; SPF, DKIM and DMARC on your domain make it harder for others to send email pretending to be you (email authentication guide)

What a website scan can and can't tell you

Our automated, passive scan looks only at those public signals. It can't see your firewall, backups, staff training or incident plan, and it doesn't check MFA on your accounts. It is not a security audit or penetration test, it is not legal advice, and it is not connected to QDB, NCSA or any NCSA attestation or certification programme.

Check the public side in under a minute with the free mini-scan.

This article is for general educational purposes and is not legal advice. Seek qualified counsel for your specific situation.