Press Release
Mamluk releases the Compliance and Assurance Convoy for Bahriya Tersane, beginning with NCA ECC
DUBAI, UNITED ARAB EMIRATES — 6 November 2026 — Mamluk today released the Compliance and Assurance Convoy for Bahriya Tersane. The convoy maps a regulator’s technical controls onto an organisation’s Kubernetes cluster, enforces the controls the cluster can enforce, checks the ones it can only observe, and writes dated evidence for each regime every day. The first regime, the Saudi National Cybersecurity Authority’s Essential Cybersecurity Controls, ECC-2:2024, is available today, and regimes for Qatar, the Saudi Central Bank and the United Arab Emirates are expected in the first quarter of 2027.
The convoy is released as experimental, and is installed on the organisation’s own premises. The evidence it produces stays in the organisation’s cluster unless the organisation chooses to send it to its own email server or storage.
Evidence that does not go out of date
A regulated organisation must show its assessor how each control is met, and a Kubernetes platform changes many times a day. Evidence gathered by hand before an assessment describes the cluster as it was on one day. The convoy instead has the cluster produce its own evidence each day, against the regime’s own control numbers.
Each run’s report lists every requirement of the regime with exactly one result, names the checks behind each technical result, and opens with a list of what to fix first, by namespace and by severity. The same report is written as PDF and as OSCAL assessment results, which governance, risk and compliance tools can import.
How it covers NCA ECC
The convoy holds all 176 requirements of ECC-2:2024. Seven are enforced by an admission policy, fourteen are checked in the cluster, thirteen are provided by the platform and reported, and 142 are organisational, which the report lists for the organisation to evidence. Admission policies start by warning and refuse nothing until the organisation chooses, and the controls the Kubernetes API server can decide by itself hold whether or not a policy engine is installed.
Every check is mapped once to the controls of NIST SP 800-53, and each regime is mapped to the same controls. A further regime is therefore added as data, and an organisation that answers to two regulators is reported against both from one cluster’s evidence.
The regimes that follow
Each regime is licensed separately. NCA ECC is available today; each regime that follows is expected to become available, built and tested by Mamluk, in the quarter below.
| Regime | Availability |
|---|---|
| Saudi Arabia: NCA Essential Cybersecurity Controls, ECC-2:2024 | Available today |
| Qatar: Qatar Central Bank, technology risks for banks | Q1 2027 |
| Saudi Arabia: SAMA Cyber Security Framework | Q1 2027 |
| United Arab Emirates: UAE Information Assurance Standard, with the Central Bank of the UAE’s requirements for banks | Q1 2027 |
| Saudi Arabia: SAMA Cyber Resilience Fundamental Requirements; Bahrain: Central Bank of Bahrain Rulebook | Q3 2027 |
| Qatar: National Information Assurance Standard; Kuwait: Central Bank of Kuwait framework | Q4 2027 |
The UAE Information Assurance Standard maps its own controls to NIST, and the convoy takes that mapping as published. For the other regimes the mapping is Mamluk’s; neither QCB nor SAMA publishes a crosswalk to NIST.
The convoy records technical evidence. The mapping is Mamluk’s, and the convoy does not certify compliance: the organisational requirements remain the organisation’s to evidence, and compliance is determined by its assessor.
“An assessor asks what the cluster does, not what a document says it does,” said Meezaan-ud-Din, Founder of Mamluk. “The convoy lets the cluster answer for itself, every day, in the regulator’s own numbering, and keeps the answer inside the organisation.”
Availability and price
The Compliance and Assurance Convoy requires the Bahriya Tersane core licence and Kubernetes 1.36 or later. It runs on the Bahriya Kubernetes Engine 2.2.0 or later, or on any conformant Kubernetes distribution at that version. The requirements the platform provides are evidenced from the facts BKE declares from version 2.3.0; on earlier BKE versions and on other distributions, they are reported for the organisation to evidence. It is licensed at USD 24,000 per regulatory regime, per organisation, per year, with no base fee. Each regime has its own page at tersane.bahriya.cloud, and organisations can enquire through mamluk.net.
About Mamluk
Mamluk LLC-FZ is an engineering firm in the Meydan Free Zone, Dubai, specialising in enterprise architecture, Kubernetes and cloud infrastructure. It develops the Bahriya Kubernetes Engine, the only enterprise Kubernetes distribution developed and supported from within the GCC, Bahriya Tersane and Kipchak, and operates the public cloud bahriya.cloud.
For media enquiries, contact uae@mamluk.net.