Oman's Ministry of Transport, Communications and Information Technology (MTCIT) maintains a public register of accredited Security Assessment Service Providers. For most regulated buyers in the Sultanate — government entities, banks, energy operators, and listed companies — that register is the first filter when scoping a security assessment, penetration test, or compliance engagement.
This article explains what the MTCIT accreditation actually covers, why it exists, how to verify a provider's status, and how the accreditation fits alongside the other credentials a credible Omani security provider should hold.
What MTCIT accreditation covers
MTCIT's Security Assessment Service Provider accreditation authorises a firm to perform security assessment work for entities operating under Oman's ICT regulatory framework. The accreditation is the Ministry's signal that a provider has been vetted against the criteria the Ministry expects for that category of work — corporate standing, technical capability, process discipline, and conflict-of-interest hygiene.
In practice, MTCIT accreditation is treated by Omani buyers as a baseline qualifier. A government tender for a vulnerability assessment, a banking compliance review, or a critical-infrastructure penetration test will normally require it. Without it, a bid is unlikely to clear the procurement filter.
How to verify a provider on the public register
MTCIT publishes the list of accredited providers at the following URL: https://mtcit.gov.om/approved-security-assessment-providers. Anyone — buyer, auditor, journalist, prospect — can look up a vendor by name and confirm their accreditation status directly with the Ministry, without taking the vendor's word for it.
When you verify, look up the legal entity name, not just the trading name. AHAT's accreditation appears on the register under our legal entity, ALHOLOL ALTHAKEYA INTERNATIONAL. A vendor that cannot give you a precise legal name to look up — or whose legal name does not appear on the register — has not actually been accredited.
What MTCIT accreditation does not cover
MTCIT accreditation is specifically a Security Assessment Service Provider accreditation. It signals that the Ministry has approved the firm to perform regulated security assessment work in Oman. It is not, on its own, a substitute for the other credentials buyers should also check.
A credible Omani security provider will typically also hold an information-security-management certification — ISO 27001 is the international standard — and, if they also deliver telecom or managed services, a Telecom Services Licence from Oman's Telecommunications Regulatory Authority (TRA). Each credential answers a different question. MTCIT addresses 'is this firm authorised to assess security?'. ISO 27001 addresses 'does this firm manage its own security competently?'. The TRA licence addresses 'is this firm authorised to operate telecom and managed services in Oman?'.
Why this matters beyond the procurement filter
Accreditation isn't only a compliance gate. A buyer working with an MTCIT-accredited provider has a regulator-backed reference point if anything goes wrong — disputes, scope creep, conflicts of interest, post-incident questions about who had access to what. That reference point matters enormously in security work, where the engagement itself involves giving a third party privileged visibility into the client's systems.
It also matters for the provider. The accreditation forces a discipline around how engagements are scoped, documented, and reported — the kind of discipline that, in our experience, is the difference between a security assessment that generates a clean report and one that drives real risk reduction.
Practical checklist before commissioning an assessment
- Confirm the provider's legal entity name appears on the MTCIT public register.
- Confirm the provider holds ISO 27001 certification, and ask which auditor and which year.
- If the engagement crosses into managed services, confirm the provider holds a TRA Telecom Services Licence and ask for the licence number.
- Ask the provider to walk through the scoping methodology and the standard report deliverables before signing a SOW.
- Ask for the engagement model: managed retainer or fixed-scope one-time project. The correct answer depends on your environment, not on the provider's preferred billing model.
If a 30-minute scoping conversation with AHAT would help you put a specific engagement on the right footing, the contact form at /contact-us is the fastest route. We respond within one business day.