How to comply with the UAE IA Standard: video walkthrough

The national baseline for information assurance

The UAE Information Assurance Standard is the United Arab Emirates' baseline for protecting information and the systems that handle it. On the official portal, u.ae, it appears as the UAE Information Assurance Regulation, developed by the Telecommunications and Digital Government Regulatory Authority, TDRA, to lift the minimum level of protection for information assets and supporting systems across the country. It works through management and technical information security controls, with which an entity establishes, implements, maintains and continuously improves information assurance.

Designation gives it force: TDRA designates critical entities under the UAE Critical Information Infrastructure Protection Policy to implement it. Other organisations work to the controls because a designated customer requires it. No certificate replaces compliance; the authority that designated the entity assesses it. This short film walks through how a programme is built.

From boundary to review

Define what the programme must cover: the designation or the customer requirement, the entities, services, systems, sites and information in scope, the authority involved, the version of the IA requirements that applies, and any emirate or sector framework that runs alongside. The version is confirmed in writing with the designating authority before planning starts.

A gap analysis then tests each management and technical control against the organisation's policies, systems, records and suppliers; what works is kept, and every gap gets an action, an owner and a date. Implementation follows: policies approved by leadership, responsibilities assigned, technical controls configured across access, operations, networks, suppliers, incidents and recovery, paper records brought under control, supplier clauses updated and people trained, each step leaving its own record. An internal audit and a management review test the programme and close the findings with evidence. The organisation then responds to whatever review, reporting or information request its designating authority sets, and to customers' supplier assessments, from an evidence file that already exists.

An ISO/IEC 27001 information security management system often carries much of the evidence, and an ISO/IEC 27001 certificate is useful supporting evidence, but it does not by itself make an entity compliant. Sterling's expert and experienced consultants design and implement the controls with your people under Sterling OS™; whether they meet the requirements is for the designating authority to decide.