DESC Information Security Regulation (Dubai) explained: video brief

Basis and scope

Dubai's Information Security Regulation rests on Resolution No. 13 of 2012 and Dubai Law No. 11 of 2014, under which the Dubai Electronic Security Center maintains and continuously improves it to reflect current information security practices and control requirements. The published structure is brief; the domain texts are in the copy DESC issues on request. This short film shows how the regulation is organised and applied.

The ISR applies across each Dubai government entity, including its employees, consultants, contractors and visitors. In practice an entity keeps a scope statement, third-party clauses in its contracts and access and supervision rules for people who are not its own staff, so that suppliers working for government entities meet the same expectations.

Thirteen domains and DESC oversight

The regulation is set out in thirteen domains, each taking current practice into account, and applied through an applicability review that records which controls apply to the entity and why. Implementation is then checked domain by domain against the ISR copy the entity holds. Related DESC standards, for example for cloud service providers, IoT and industrial control systems, may apply alongside it, and DESC's cloud service provider security standard cites the ISR.

DESC monitors government entities' compliance. There is no certificate for the ISR as an organisation; DESC's certification programme for ISR officers certifies individuals, not organisations. Entities should keep the current ISR copy from DESC, name an owner for DESC correspondence and watch for updates, and legal interpretation stays with their advisers.

The ISR applies to all Dubai government entities, including their employees, consultants, contractors and visitors. A private supplier meets it through the entity it serves: as contract clauses, access conditions and security questionnaires and, for cloud, data centre or security operations services, as DESC's own standards for those services. The regulation is not a public download; DESC provides it on e-mail request through its Standards and Policies page, and suppliers can ask the entity they serve which requirements it flows down. ISO/IEC 27001 is the strongest starting point and commonly aligned in practice, but the ISR is a separate text with its own applicability review, and DESC, not a certification body, monitors compliance.