Cyber Basics for Qatari SMEs: Using the QDB–NCSA Manual and New Log Management Guidelines

A small business does not need a security team to be a target. It needs an email inbox, a shared password and an unpatched laptop. In Verizon's 2025 Data Breach Investigations Report snapshot for small and medium businesses, ransomware featured in 88% of SMB breaches, compared with 39% for large organisations. (Verizon counts firms with fewer than 1,000 employees as SMBs, so most Qatari SMEs are smaller still.) Qatari SME owners already have two free, locally relevant tools for reducing that risk: the Cyber Security Manual for SMEs published by Qatar Development Bank (QDB) with the National Cyber Security Agency (NCSA), and NCSA's Log Management Guidelines, announced in February 2026. Here is how to turn both into a practical plan.

What the QDB–NCSA manual is

QDB launched the manual with NCSA in August 2024 to raise awareness and give owners practical guidelines. It is written for SME business owners rather than IT specialists, and states that its requirements apply to all SMEs and their information assets. It describes itself as a set of minimum requirements and distinguishes "shall" (a requirement) from "should" (a recommendation). The manual names the most common threats as phishing, denial-of-service attacks, malware and ransomware, and advises against paying ransoms.

Its controls fall into two groups. Below is a condensed checklist based on them.

Process controls: the management basics

• Know what you have. Keep an inventory of devices, software, accounts and data.
• Classify your data. Identify which information is sensitive, in line with Qatar's National Data Classification Policy.
• Name an owner. Make one person responsible for information security and set aside a cyber budget, even a modest one.
• Train people. Run awareness training for new staff and refresh it every year. Most attacks start with a person clicking something.
• Control changes. Plan and record changes to systems instead of making ad-hoc fixes.
• Plan for incidents. Write a simple incident response plan covering who to call, what to isolate and how to restore, and carry out a root-cause review after recovery.

Technical controls: the practical defences

• Secure the perimeter. Use a firewall, protect Wi-Fi with strong passwords and encryption, and require a VPN with multi-factor authentication (MFA) for remote access.
• Patch promptly. Turn on automatic updates where possible and use licensed software only.
• Change the defaults. Replace default passwords and settings on every new device and service.
• Limit access. Give each person a unique account with only the access they need, keep admin accounts separate, and enforce MFA.
• Back up and test. Make regular, encrypted, off-site backups and check that you can actually restore them.
• Protect your public face. Secure your website and social media accounts with strong passwords, MFA and limited staff access.
• Use the cloud carefully. Assess the risks before moving data, and consider government-endorsed providers.
• Cover phones and laptops. Set rules for portable and personal devices used for work, and secure your premises physically.

One point every owner should note: the manual asks SMEs to report critical incidents to NCSA within two hours of identifying them, by email to ncsoc@ncsa.gov.qa or through the NCSA hotline, 16555, which runs 24 hours a day.

The missing piece: logs

The manual does not cover logging, and NCSA's newer guidance fills that gap. On 9 February 2026 NCSA announced national Log Management Guidelines. As The Peninsula reported, they respond to "the inadequate activation, collection, and management of system logs", and NCSA described poor log management as one of the key challenges in investigating incidents. The guidelines give direction on which critical events must be logged and monitored across systems, networks and applications, with the aim of earlier detection, faster response and better recovery. NCSA encourages organisations to build log monitoring into their risk management and incident response.

For a small business, this does not have to mean expensive tools. As general guidance, a sensible starting point is:

• Switch on the audit and sign-in logs that your email, cloud and accounting platforms already provide. Many are off or kept for only a short time by default.
• Prioritise logs for log-ins (especially failed attempts and admin access), changes to user accounts, and access to sensitive data.
• Make sure device clocks are synchronised so events can be pieced together.
• Decide who reviews alerts and how often, and link this to your incident response plan.

The full guidelines are published in NCSA's document library. Ask your IT provider to map your systems against them.

Data protection and buyer expectations

Security is also a legal and commercial issue. Qatar's personal data privacy law, Law No. 13 of 2016, requires organisations that control personal data to protect it and process it lawfully. NCSA guidance on individuals' rights under the law, explained by The Peninsula in April 2026, sets out obligations such as responding to erasure requests within 30 days. Larger customers increasingly ask suppliers about security in their onboarding questionnaires. An SME that can show an asset list, MFA, tested backups, logging and an incident plan will have a stronger answer.

For a recognised international benchmark, the UK's Cyber Essentials scheme builds on five controls: firewalls, secure configuration, security update management, user access control and malware protection. These map closely to the technical controls in the QDB–NCSA manual.

How this supports NDS3 and Qatar National Vision 2030

Qatar's National Cyber Security Strategy 2024–2030, launched by NCSA in September 2024, includes pillars on cyber resilience across the Qatar ecosystem and on a thriving, innovative and data-driven economy. The Third National Development Strategy relies on SMEs adopting cloud tools, e-commerce and digital payments. Every small firm that gets the basics right reduces its own risk and strengthens the supply chains that larger companies and government entities depend on.

What to do next: a 30-day plan

• Week 1: download the QDB–NCSA manual, name a security owner and build your asset inventory.
• Week 2: turn on MFA for email, banking, cloud and social media accounts, and remove shared or unused accounts.
• Week 3: set up automatic updates and encrypted off-site backups, then test a restore.
• Week 4: enable key logs, write a one-page incident response plan with NCSA's reporting contacts, and book staff awareness training.

Sources

• Cyber Security Manual for SMEs (news release) – Qatar Development Bank – qdb.qa
• Cyber Security Manual (for Small and Medium Enterprises) – Qatar Development Bank and National Cyber Security Agency – qdb.qa (PDF)
• Qatar issues national Log Management Guidelines to reinforce cybersecurity – The Peninsula – thepeninsulaqatar.com
• NCSA issues log management guidelines to strengthen national cyber resilience – Qatar Tribune – qatar-tribune.com
• Explainer: NCSA issues guidelines on individuals' rights under personal data privacy protection law – The Peninsula – thepeninsulaqatar.com
• National Cyber Security Strategy 2024-2030 launched – The Peninsula – thepeninsulaqatar.com
• 2025 Data Breach Investigations Report: SMB Snapshot – Verizon Business – verizon.com (PDF)
• Cyber Essentials overview – UK National Cyber Security Centre – ncsc.gov.uk

Photo: Towfiqu barbhuiya / Unsplash