Compliance walkthrough
How to comply with the DESC Information Security Regulation (Dubai): video walkthrough
A walkthrough of building a programme to Dubai's Information Security Regulation, for government entities and the suppliers that serve them.
Key takeaways
- The ISR is maintained by DESC for Dubai government entities.
- It reaches employees, consultants, contractors, visitors and suppliers.
- Thirteen domains are applied through an applicability review.
- Obtain the current ISR text from DESC and watch for updates.
- There is no organisational ISR certificate; DESC monitors compliance.
The Dubai Government's information security rulebook
The Information Security Regulation, or ISR, is the information security rulebook of the Dubai Government, maintained by the Dubai Electronic Security Center (DESC). Its stated purpose is to give every Dubai government entity the standards to keep critical business processes running and to reduce information security risks and damage by preventing incidents or limiting them. It was formalised under Resolution No. 13 of 2012, and Dubai Law No. 11 of 2014, which established DESC, makes DESC responsible for maintaining and continuously improving it.
The ISR applies across Dubai government entities, including their employees, consultants, contractors and visitors, and through them the suppliers that serve them. There is no certificate for the ISR as such: DESC monitors government entities' compliance. This short film walks through how a compliance programme is built.
From applicability review to a running programme
First define what the programme must cover: the entity or the contracts in scope; the services, systems, sites and people; the current ISR copy issued by DESC, which DESC provides on request; other DESC standards that apply, such as those for IoT, industrial control systems or cloud service providers; and any client entity's security clauses. The regulation is set out in thirteen domains, applied through an applicability review that decides which controls apply.
A gap analysis then compares current controls with the applicable ISR domains, and the programme designs and implements what is missing, with an owner for DESC correspondence and a watch on updates to the regulation. Third-party clauses, access and supervision rules extend the controls to contractors and visitors. The programme has to run before it can be reviewed, and internal audit checks it first.
Sterling's expert and experienced consultants carry the applicability review and implementation with your team under Sterling OS™. DESC decides whether an entity meets the regulation, and an entity decides whether its suppliers do; legal interpretation stays with your advisers.
DESC ISR (Dubai) at a glance
- Purpose
- Continuity of critical business processes across Dubai government, with information security risks, incidents and their damage minimised
- Relevant to
- All Dubai government entities, including their employees, consultants, contractors and visitors, and through them the suppliers that serve them
- Edition
- Formalised under Resolution No. 13 of 2012 and maintained by DESC under Dubai Law No. 11 of 2014; DESC's CSP Security Standard cites ISR:2017 v.02. The text is issued by DESC on e-mail request
- Certification
- None for the ISR as such. DESC monitors government entities' compliance; its certification programme for ISR officers certifies individuals, not organisations
- Sterling's role
- Applicability review and implementation with your team, Effivity, training, internal audit and assessment readiness, then Sustain™
- Cost and timing
- Total investment for a DESC ISR compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 4 to 9 months
DESC ISR (Dubai): questions people ask
Is there a DESC ISR certification?
Not for an organisation. DESC's published certifications cover cloud service providers, data centres and security operations centres against separate standards, and its Cyber Force certification covers incident response and penetration testing providers. DESC's programme for ISR officers certifies individuals. Government entities' compliance with the ISR is monitored by DESC; an "ISR certificate" offered to your company by a consultant or a certification body is a badge, not a DESC decision.
Who does the ISR apply to?
All Dubai government entities, including, in DESC's words, but not limited to their employees, consultants, contractors and visitors. DESC's IoT Security Standard names government and semi-government entities, and ISR officers from semi-government entities take part in DESC's ISR community. If your organisation's status is unclear, confirm it with DESC or your legal advisers before scoping.
We are a private company supplying a Dubai government entity. Does the ISR apply to us?
Through the entity, for the people and services within its scope: the regulation expressly covers the entity's consultants and contractors. In practice it reaches you as contract clauses, access conditions and security questionnaires and, for cloud, data centre or SOC services, as DESC's own standards for those services. Scope the programme to the services, systems and people that touch the entity's information.
Does ISO/IEC 27001 certification make us ISR compliant?
Not by itself, though it is the strongest starting point. The two are commonly aligned in practice, and DESC's own CSP Security Standard combines ISR:2017 v.02 with ISO/IEC 27001:2013 and ISO/IEC 27002:2013. But the ISR is a separate text with its own applicability review and requirements, and DESC, not a certification body, monitors ISR compliance. Map the ISMS to the ISR and close what is specific to the regulation.
Which version of the ISR applies to us?
The one DESC currently issues. DESC provides the ISR on e-mail request, and its website entry shows no version number. The version DESC cites in its CSP Security Standard is ISR:2017 v.02. Confirm with DESC, or with the entity you serve, which copy applies, and plan for updates, since DESC maintains and improves the regulation.
Keep exploring
Related to this video
The complete guide
Everything on DESC ISR (Dubai)
Start with the DESC ISR (Dubai) page, or go straight to the guide you need.
On the DESC ISR (Dubai) page
- What are the main DESC ISR requirements?
- How do you become DESC ISR compliant?
- How much does DESC ISR compliance cost?
- How long does DESC ISR compliance take?
- Who needs DESC ISR compliance?
- How DESC ISR compliance protects government services and the trust behind them
- Frequently asked questions about DESC ISR
Often combined with DESC ISR (Dubai)
More videos: Information security, cyber and cloud
- How to implement IEC 62443Implementation walkthrough · 3 min 15 s
- IEC 62443 requirements explainedTwo-minute brief · 2 min
- How to implement ISO/IEC 27018Implementation walkthrough · 3 min 15 s
- ISO/IEC 27018 requirements explainedTwo-minute brief · 2 min
- How to comply with the NCA Essential Cybersecurity Controls (Saudi Arabia)Compliance walkthrough · 3 min 15 s
- NCA Essential Cybersecurity Controls (ECC) requirements explainedTwo-minute brief · 2 min
- How to comply with the NIS2 DirectiveCompliance walkthrough · 3 min 15 s
- NIS2 Directive requirements explainedTwo-minute brief · 2 min
- How to implement NIST CSF 2.0Implementation walkthrough · 3 min 15 s
Talk to a consultant
Plan your DESC ISR compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice