Organisations in the UAE often face several overlapping security frameworks. Understanding which apply — and how they map to each other — saves significant time and cost.
UAE Information Assurance (IA) Standard
Originally issued by NESA (now under the UAE Cyber Security Council), the IA Standard defines management and technical controls and is mandatory for government entities and critical-sector organisations. Controls are prioritised (P1–P4) so you can sequence implementation.
Dubai Electronic Security Center (DESC) ISR
The DESC Information Security Regulation applies to Dubai government entities and, increasingly, to their suppliers. DESC also publishes standards for cloud service providers and ICS security.
ISO/IEC 27001:2022
The internationally recognised standard for an Information Security Management System (ISMS). It is risk-based and certifiable, making it a strong foundation that maps well to both UAE IA and DESC ISR.
UAE Personal Data Protection Law (PDPL)
Federal Decree-Law No. 45 of 2021 governs processing of personal data, including security obligations and breach notification. Free zones such as DIFC and ADGM have their own data-protection regimes.
PCI DSS v4.0
Mandatory for any organisation storing, processing or transmitting payment card data. Version 4.0 requirements became fully effective in March 2025.
Avoid doing the work twice
Build one control framework — typically anchored on ISO 27001 — and map each control to the other frameworks you must meet. Collect evidence once, reuse it everywhere.
Our Security Gap Analysis & GRC service maps your controls across all applicable frameworks.