Qatar Central Bank Cloud Computing Regulation (2024) 22: Perform regular cloud security testing by service model, using third parties or CSP-provided reports where direct testing is not allowed

What does 22 require?

An entity regularly performs the tests relevant to its service model: architecture and infrastructure review and vulnerability assessment for IaaS; application and source code testing for IaaS and PaaS; and security configuration review, compliance review and penetration testing for IaaS, PaaS and SaaS. It may engage a reputable third party to conduct the tests in line with the Sector-Specific Security Regulation, and where the entity is barred from running a given assessment against the cloud environment, the CSP supplies a report of that assessment by a reputable third party.