hello@sterling-grc.com +1 201 263 4443 New York ISO & GRC consulting in 60+ countries
Contact Sterling Academy login
SterlingInternational Consulting Talk to a consultantTalk to us
← All videos

Two-minute brief

UAE IA Standard requirements explained: video brief

A two-minute brief on the elements of the UAE Information Assurance requirements and what they look like in practice.

  • Two-minute brief
  • 2 min

Key takeaways

  • Designation under the UAE CIIP Policy gives the requirements force.
  • Coverage follows information wherever it is used, processed, stored or transmitted.
  • Management and technical controls each need their own evidence.
  • Assurance is maintained and continuously improved.
  • A gap register tracks every applicable control against the baseline.

Designation and coverage

At its core the UAE Information Assurance Regulation requires designated entities to put management and technical information security controls in place and to keep them working. This short film maps the elements set out in official UAE sources; an implementation is checked against the full text of the version that applies, control by control.

Designation comes first: entities that TDRA designates as critical under the UAE Critical Information Infrastructure Protection Policy implement the regulation, so the designation, the services and systems it concerns, a named programme owner and the authority's contact route belong on file. The requirements apply to information wherever it is used, processed, stored or transmitted, and to the systems and processes used for those purposes, which in practice means a system inventory and data-flow map for the designated services, including hosted, outsourced and cloud services. Information on paper counts as much as information in systems, whether the entity owns it, leases it or simply has it in its possession, custody or control, so archives, printed records and removable media appear in the asset inventory with owners and handling rules.

Controls, continuity and the baseline

Management controls establish information assurance across the entity: approved policies, assigned responsibilities, a risk method, awareness for staff and a compliance plan with dates. Technical controls protect the information and systems in scope, each configured with its own evidence. Assurance is then maintained and continuously improved, not implemented once and left, through internal audits, measures, corrective actions and a management review that takes decisions. The baseline asks for protection at least at the minimum level the regulation sets, tracked in a gap register against every applicable control, with treatment dates and residual risks accepted by the right person.

Organisations outside the UAE can be drawn in when they hold or process information for a designated entity and a contract requires it. National cyber strategy, policy and standards sit with the UAE Cybersecurity Council, and the designating authority, not a certificate, decides compliance.

UAE IA Standard at a glance

Purpose
A higher minimum level of protection for information assets and their supporting systems across the UAE, through management and technical information security controls
Relevant to
Entities designated as critical under the UAE CIIP Policy, which must implement it, and organisations that hold or process information for them where a contract requires it
Edition
The UAE Information Assurance Regulation developed by TDRA; national cyber strategy, policy and standards sit with the UAE Cybersecurity Council. Confirm the version your designation applies
Certification
No certificate replaces compliance: the authority that designated your entity assesses it. ISO/IEC 27001 certification is supporting evidence
Sterling's role
Scoping, gap analysis and implementation with your team, Effivity, training, internal audit and regulator-review readiness, then Sustain™
Cost and timing
Total investment for a UAE IA compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 6 to 12 months

UAE IA Standard: the complete guide →

UAE IA Standard: questions people ask

Is there a UAE IA Standard certificate?

The IA requirements are controls for entities to implement, and compliance is assessed by the authority that designated your entity, not by a consultant or a software vendor. Sterling prepares you and does not assess compliance for any authority. Where an audited certificate helps, ISO/IEC 27001 certification from an accredited certification body is genuine supporting evidence; it should be described as exactly that, never as IA compliance.

Does ISO/IEC 27001 certification make us UAE IA compliant?

Not by itself, though it is the strongest starting point. The two are commonly aligned in practice: both run a cycle of establishing, implementing, maintaining and improving, and much Annex A evidence carries over. Typical gaps are a certificate scope narrower than the designated services, IA controls with no counterpart in the Statement of Applicability, paper records outside the inventory and evidence not kept for each control. In the UAE, the Emirates International Accreditation Centre (EIAC) accredits certification bodies for ISO/IEC 27001.

Who has to comply with the UAE IA Standard?

Entities that TDRA designates as critical under the UAE CIIP Policy must implement the IA Regulation. Its stated purpose reaches further, a higher minimum level of protection across all entities in the UAE, and a designated customer can extend the controls to its suppliers by contract. For a definitive answer on your own position, rely on your designation and your authority, not on a questionnaire.

Which version of the UAE IA requirements applies to us?

The version your designating authority applies to your entity. Ask for it in writing, together with any compliance date and reporting arrangements, before the gap analysis starts. When a new version is issued, Sterling's Revise™ service compares the two and plans the move.

What does the UAE Cybersecurity Council do?

The UAE Cabinet agreed to establish the Council in November 2020 to develop a comprehensive national cybersecurity strategy and a safe, strong cyber infrastructure for the country. Chaired by the Head of Cyber Security for the UAE Government, it contributes to a legal and regulatory framework covering cybercrime and the security of existing and emerging technologies, and to a National Cyber Incident Response Plan; national cyber strategy, policy and standards are among its responsibilities.

More UAE IA Standard questions and answers →

Keep exploring

Related to this video

Read next

Services

Next steps

The complete guide

Everything on UAE IA Standard

Start with the UAE IA Standard page, or go straight to the guide you need.

On the UAE IA Standard page

Often combined with UAE IA Standard

More videos: Information security, cyber and cloud

All videos

Talk to a consultant

Plan your UAE IA Standard compliance with confidence.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

hello@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Your goal
Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice