DESC ISR · Dubai Government Information Security Regulation · United Arab Emirates

DESC ISR compliance consulting for Dubai government information that stays protected, with the evidence to show it.

Meet the Information Security Regulation that the Dubai Electronic Security Center applies to every Dubai government entity in the United Arab Emirates, and to the consultants, contractors and visitors who work with them: the applicability review documented, the controls of the thirteen domains operating, and evidence ready whenever DESC, or the entity you supply, asks for it. Sterling's expert and experienced consultants build the programme with your teams, prepare the evidence and stay with you once it runs, from Dubai and in 60+ countries. We ensure a successful DESC ISR compliance programme for our clients.

Book a free discovery call Start the free readiness check

Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
A team of expert and experienced cybersecurity governance consultants, advising on management systems across sectors and countries since 2003
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling builds the controls, the governance and the evidence; compliance is monitored by DESC and, for suppliers, assessed by the government entity you serve

DESC ISR at a glance

Purpose: Continuity of critical business processes across Dubai government, with information security risks, incidents and their damage minimised
Relevant to: All Dubai government entities, including their employees, consultants, contractors and visitors, and through them the suppliers that serve them
Edition: Formalised under Resolution No. 13 of 2012 and maintained by DESC under Dubai Law No. 11 of 2014; DESC's CSP Security Standard cites ISR:2017 v.02. The text is issued by DESC on e-mail request
Certification: None for the ISR as such. DESC monitors government entities' compliance; its certification programme for ISR officers certifies individuals, not organisations
Sterling's role: Applicability review and implementation with your team, Effivity, training, internal audit and assessment readiness, then Sustain™
Cost and timing: Total investment for a DESC ISR compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 4 to 9 months

8,100+ client engagements in 60+ countries.

DESC ISR client experience

What it is

What is DESC ISR and what is it used for?

The Information Security Regulation (ISR) is the information security rulebook of the Dubai Government, in the Emirate of Dubai, United Arab Emirates, maintained by the Dubai Electronic Security Center (DESC). Its stated purpose is to give every Dubai government entity the standards to keep critical business processes running and to reduce information security risks and damage by preventing incidents or limiting them. It was formalised under Resolution No. 13 of 2012, drawing on leading information security regulations, frameworks, policies and practices; Dubai Law No. 11 of 2014, which established DESC, makes DESC responsible for maintaining and continuously improving it.

The regulation is set out in thirteen domains, each taking into account one or more of three classes of information security: governance, operation and assurance. Entities must conduct an applicability review and commit the resources a "right-fit" implementation needs, so the ISR asks for judgement, not a checklist copied in full. There is no ISR certificate for an organisation: DESC's legal functions include monitoring government entities' compliance with the information security requirements it issues, following up their implementation and verifying the security of their information systems.

Current text. DESC issues the ISR on e-mail request rather than as a public download, and its website entry carries no version number or date. The version DESC cites in its own Cloud Service Provider (CSP) Security Standard is ISR:2017 v.02, the second version, of 2017. Because DESC maintains and updates the regulation, the programme starts by confirming that your copy is the one DESC currently issues. DESC ISR explained: the domains, the three classes and the applicability review

Who it is for

Who needs DESC ISR compliance?

The ISR applies to all Dubai government entities and, in DESC's words, includes but is not limited to their employees, consultants, contractors and visitors. Semi-government entities are part of the ISR community too: the ISR officers DESC gathered in January 2026 came from government and semi-government entities alike. Organisations come to Sterling from four starting points:

You are a Dubai government or semi-government entity. DESC monitors your compliance and follows up implementation. Everything starts from a documented applicability review against the ISR copy DESC has issued to you, with the gap, owner and budget behind each decision.
You supply, consult or contract to a Dubai government entity. The regulation reaches your people through the entity's scope, so expect ISR clauses, access conditions and security questionnaires in the contract. A programme sized to the services and systems you touch answers them once, instead of tender by tender.
You provide cloud, data centre, SOC, incident response or penetration testing services. Accredited certification bodies certify cloud providers to DESC's CSP Security Standard, DESC lists data centre and SOC standards among its certifications, and its Cyber Force certification covers incident response and penetration testing for government entities in Dubai. These sit beside the ISR, not in place of it.
You hold ISO/IEC 27001 and assume it covers the ISR. The two are commonly aligned in practice, and a certified ISMS is a strong base, but the ISR is DESC's own text: the applicability review, the regulation's specific requirements and DESC's monitoring sit outside what an ISO/IEC 27001 certificate attests.

Business benefits

How DESC ISR compliance protects government services and the trust behind them

The ISR is written around continuity: services residents and businesses rely on should keep running when something goes wrong. We start from the incidents that would hurt your entity most, a compromised account, an over-privileged contractor, a critical system down, and give each control an owner and a record.

Critical services that keep runningContinuity of critical business processes is the regulation's stated purpose: recovery planned, tested and measured, not assumed.
Decisions you can defendAn applicability review that records why each requirement applies, how it is met and who decided, so a right-fit implementation is visible, not asserted.
Contractors held to the entity's rulesConsultants, contractors and visitors covered by clauses, onboarding and access conditions, because the ISR's scope already includes them.
Ready for DESC, whenever it looksEvidence organised by domain and class, so monitoring, follow-up and real-time assessment find records that already exist.
One control set for several demandsThe ISR, ISO/IEC 27001, DESC's CSP Security Standard and client questionnaires answered from one evidence base, with the differences mapped.
People who know their partAwareness for every employee and contractor in scope, practitioner training for control owners, and an ISR officer with the records to answer for the programme.

Measure a few things that show the controls work: applicability decisions reviewed on schedule, contractor accounts removed the day a contract ends, access reviews completed, restore tests passed, audit findings closed on time. Page counts prove nothing.

Requirements

What are the main DESC ISR requirements?

The published structure is brief, thirteen domains applied through an applicability review, and the domain texts are in the copy DESC issues on request. The table therefore maps the regulation's structure and DESC's oversight to practice; your implementation is checked against the ISR copy you hold, domain by domain, and legal interpretation stays with your advisers.

Element	What it requires of you	What it looks like in practice
Basis Resolution No. 13 of 2012 and Dubai Law No. 11 of 2014	Work to the regulation DESC maintains and continuously improves to reflect current information security practices and control requirements	The current ISR copy obtained from DESC, an owner for DESC correspondence and a watch on updates
Scope Entities, people and third parties	Apply the ISR across the entity, including its employees, consultants, contractors and visitors	A scope statement, third-party clauses, and access and supervision rules for contractors and visitors
Applicability review Right-fit implementation	Review which requirements apply and commit the resources a right-fit implementation needs	A recorded decision per requirement, with its justification, owner, budget and target date
Thirteen domains The control requirements	Implement the requirements of each domain as your applicability review decides	A domain-by-domain implementation record, linked to the policies, procedures and technical evidence behind it
Governance Class of information security	Where a domain concerns governance: direction, accountability and decisions on information security risk	Approved policies, defined security roles, a risk register and management decisions minuted
Operation Class of information security	Where a domain concerns operation: the controls that protect information in daily work	The records controls produce as work happens, such as access reviews, change approvals, backup checks and incident logs
Assurance Class of information security	Where a domain concerns assurance: checking that controls are in place, effective and complied with	Internal audits, technical tests, compliance reviews and findings closed with evidence
DESC oversight Monitoring and follow-up	DESC monitors government entities' compliance with the information security requirements it issues, follows up implementation and verifies the security of their information systems	An evidence set ready for DESC's requests and for the ASAAS 2.0 real-time assessments DESC announced in January 2026

The DESC instruments that sit beside the ISR

DESC instrument	Who it concerns	What it means for an ISR programme
CSP Security Standard	Cloud service providers and organisations using cloud services	Built on ISO/IEC 27001:2013, ISO/IEC 27002:2013, ISO/IEC 27017:2015, ISR:2017 v.02 and the CSA Cloud Controls Matrix 3.0.1; certified by accredited certification bodies under the scheme used for ISO/IEC 27001, with yearly surveillance and recertification every three years
DC and SOC Security Standards	Data centres, security operations centres (in-house or outsourced) and organisations using them	Listed by DESC among its certifications; relevant to where systems are hosted and how monitoring is provided
Cyber Force certification	Individuals and companies offering incident response or penetration testing to government entities in Dubai	Certified providers are listed on DESC's Certified Providers page; check there before engaging one
IoT Security Standard	All Dubai government and semi-government entities	Connected devices under the same risk, asset and supplier controls
ICS Standard	Entities operating critical infrastructure or industrial control systems	Operational technology treated beside the ISR programme, not outside it
EBMD and Connected Vehicle standards	Electronic biomedical devices (developed with the Dubai Health Authority); entities planning to use autonomous vehicles	Identified at scoping, before the applicability review
Web Security Policies	Websites, web applications, mobile applications and APIs	Applied to each website, app and API in scope

What does useful DESC ISR evidence look like?

The ISR copy DESC issued and the applicability review built on it; policies approved by leadership; a risk register with treatment decisions; for each applicable domain, the procedure and the records it produces, such as access reviews, change approvals, restore tests and the incident log; contractor and visitor terms; training records; penetration test findings and their remediation; the internal audit and management review. We draw them from your real systems into Effivity from the first workshop, so reviewers see controls at work, not a folder assembled for them.

DESC ISR requirements explained, domain by domain

Compliance process

How do you become DESC ISR compliant?

A programme has to run before it can be reviewed. We design and build the controls with your team; DESC decides whether an entity meets the regulation, the entity decides whether its suppliers do, and no consultant's opinion stands in for either.

01
Define what the programme must cover.The entity or the contracts in scope; services, systems, sites and people; the ISR copy DESC has issued; other DESC standards that apply, such as IoT, ICS or CSP; and any client entity's security clauses.
02
Gap analysis: review the current position against the ISR and your applicability review.The gap analysis tests policies, controls and records against the requirements of each applicable domain, keeps what works, records applicability decisions with their justification and sets actions, owners and dates.
03
Implement, and keep the evidence as you go.Governance decisions and roles, policies and procedures, operational controls, contractor and visitor terms, awareness training and incident handling, each producing its record from the first day.
04
Audit, review and address the findings.An internal audit across the applicable domains, technical testing where the regulation and your risks call for it, and a management review; we raise findings before anyone external does and close them with evidence.
05
Complete the regulator or client review.Answer DESC's monitoring, follow-up and assessment requests, or a client entity's supplier checks, from an evidence package that already exists; add ISO/IEC 27001 or CSP Security Standard certification where an audited certificate helps.
06
Keep the programme running.Applicability decisions revisited when systems or services change, DESC's updates to the regulation absorbed, contractors reassessed, training repeated and the internal audit on a set cycle.

Judge a proposal by what remains when the consultant leaves: who runs the applicability review against which ISR copy, how controls are tested on your own systems, and where the evidence for DESC will live. No certificate exists for an organisation, so controls are what DESC and client entities examine. How to choose a credible DESC ISR provider · The certification buyer's checklist

Cost

How much does DESC ISR compliance cost?

An ISR programme is priced by what it covers and where it starts. A supplier with an ISO/IEC 27001 certificate and a handful of systems touching one entity is a different project from a government entity building its applicability review across hundreds of systems, several sites and many contractors. What never changes is the proposal format: each component shown, one all-inclusive proposal.

Cost component	What affects it
Consulting and implementation	Entities, services, systems and sites in scope, current maturity, deliverables and how much of the work your team carries (Design™ or Drive™)
Testing and independent certification	Penetration testing, incident response retainers and any ISO/IEC 27001 or CSP Security Standard certification you choose, each shown separately
Internal resources and remediation	Time from IT, security, procurement and legal, and missing technology such as multi-factor authentication, logging, backup or encryption
Software and learning	Included in a Sterling engagement: Effivity for the programme and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal
Continued support	Applicability reviews, internal audits, contractor reassessments, refresher learning and ISR updates under Sustain™

What moves the price

Whether you are the government entity or a supplier to one, and how many entities you serve
Systems, sites, headcount and contractors inside the scope
Whether an ISO/IEC 27001 ISMS or an earlier ISR programme exists
Cloud, data centre, SOC, IoT or industrial systems that bring other DESC standards in
A DESC request, a contract start or a renewal date to meet

What a Sterling proposal always shows

Deliverables, responsibilities, assumptions and exclusions, in writing
Testing, certification and legal costs listed apart from our fee, so the whole programme can be compared
Effivity, training and Academy access itemised at no additional cost
Payment milestones tied to deliverables, not to the calendar
One all-inclusive proposal. No surprises, ever

Timeline

How long does DESC ISR compliance take?

Allow four to nine months before the programme is operating with evidence behind it: nearer four for a supplier with a working ISO/IEC 27001 ISMS and a narrow scope, nearer nine for an entity whose applicability review has never been documented, or where access control, logging, recovery or contractor management must be rebuilt first. If DESC or a client entity has set a date, the scope, the applicability review and the governance decisions go first, each a milestone in Effivity.

Phase	What determines the pace
Scope and gap analysis	Obtaining the current ISR copy, access to system owners and records, and agreeing the scope
Build and implementation	Applicability decisions and their budget, technical changes, contractor terms and training
Evidence and review	Controls operating long enough to produce records, then internal audit, technical testing and management review
Regulator or customer review	DESC's monitoring and assessment timetable, or a client entity's supplier review and contract dates

Share the DESC request, the contract clause or the go-live date on the first call, and you will hear what is achievable by then and which decisions cannot wait beyond the first fortnight. ISR compliance promised within a week, before anyone has seen your systems or your ISR copy, is a sales line, not a plan.

Challenges

Common DESC ISR implementation challenges

ISR programmes tend to stall in the same five places, and none of them is a dead end.

Nobody is sure which ISR copy is current.

Request the regulation from DESC, record the copy and its date in the document register, and give one person responsibility for DESC correspondence and updates, so the programme is never built against a superseded text.

The applicability review exists only in someone's head.

Go through the requirements one by one with the control owners, record the decision, the reason and the resources committed, and have leadership approve the result. A right-fit implementation is far easier to defend when the reasoning is written down.

ISO/IEC 27001 is in place, and the ISR is assumed to be the same thing.

Map the ISMS to the ISR, keep everything that already satisfies it and close the requirements specific to the regulation. One risk method, one set of controls and one evidence base serve both, with the differences recorded rather than duplicated.

Contractors and visitors sit outside the entity's controls.

A register of consultants, contractors and service providers ranked by the access they hold, ISR terms written into contracts as they are signed or renewed, onboarding and offboarding tied to access rights, and DESC's certified provider lists checked where they apply.

Evidence is scattered, and assessment is moving online.

With DESC announcing ASAAS 2.0 for real-time assessment and automated gap analysis, evidence kept in e-mail threads and shared drives becomes a liability. Effivity holds each requirement's decision, owner, records and audit result in one place.

Your engagement

What your DESC ISR engagement includes

The agreed scope brings together everything a working ISR programme and a prepared workforce require, from a single Sterling team and for a single all-inclusive proposal.

Scope, applicability review and implementation plan
The entity or contracts in scope, the current ISR copy confirmed, each requirement's applicability decided, and actions, owners and dates agreed before work starts.
Policies, procedures and controls
Governance, operational and assurance controls in proportion to your risks, contractor and visitor terms and the incident procedure, on Sterling's template sets adapted to your systems.
Effivity ISO & GRC software
Your ISR programme runs in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit and management review
Run by us or with your auditors, as agreed; every finding closed with evidence ahead of DESC's or a client entity's review.
Assessment readiness and support
Preparation for DESC's monitoring, follow-up and assessment requests and for client entities' supplier checks, and support through ISO/IEC 27001 or CSP Security Standard certification if you pursue it.

Compliance with the ISR is monitored by DESC. Sterling's part is consulting, not legal advice.

How we deliver

How Sterling supports your DESC ISR implementation

Sterling OS™, our delivery operating system, structures every ISR engagement in five phases with deliverables, decision owners and evidence fixed for each. Your team's capacity sets how much work Sterling takes on; method, software and accountability do not change.

01
Design™Guided implementation: the ISR officer, IT and control owners do the work, with Sterling providing the structure, templates, workshops and coaching.
02
Drive™Fully managed consulting: the applicability review, drafting, contractor terms and evidence are carried by Sterling consultants, with your teams deciding.
03
Sustain™Year-round upkeep once the programme is live: applicability reviews, internal audits, contractor reassessments and refresher training.
04
Automate™The programme in Effivity: requirements, applicability decisions, risks, controls, contractors, incidents, audits and management review in one workspace.
05
Revise™Updates DESC makes to the ISR or its other standards, and changes in your services, systems or contracts.

Before work begins, your engagement team, a fixed weekly session, the deliverables and the decisions reserved for leadership are agreed and tracked, so a control that slips is visible early, not in front of DESC.

How Sterling OS™ works

Often combined with

Standards organisations pair with DESC ISR (Dubai)

Effivity · DESC ISR compliance software, included in every engagement

How Effivity helps you fulfil, automate and simplify the requirements of the DESC Information Security Regulation.

Effivity, the Sterling group's ISO and GRC automation platform, used in 50+ countries, comes with every Sterling ISR engagement. Your consultant sets up the workspace for the agreed scope: ISR requirements with their applicability decisions, policies, risks, controls and owners, contractors, incidents, training, audits and management review in one place, so DESC or a client entity sees a programme in daily use. For Sterling consulting clients the subscription is included with the engagement, at no additional cost.

Included in every engagement See Effivity

Scope

Entities, systems and third parties in scope

The entity's services, systems and sites and the consultants, contractors and visitors the ISR reaches, in one register reviewed whenever they change.

Applicability review

Applicability decisions and the right-fit plan

Each ISR requirement with its applicability decision, justification, owner, budget and due date; changed decisions are approved and dated, so the review never goes stale.

Governance

Policies, roles and risk decisions

Policies with approvals and versions, security roles including the ISR officer, and a risk register whose treatments are tracked to closure and brought to management review.

Operation

Controls in daily work

Access reviews, asset records, change approvals, backups and incidents recorded as the work happens, each linked to the domain and requirement it evidences.

Assurance

Internal audit, testing and compliance checks

Audit programmes by domain, penetration test and vulnerability findings, compliance reviews and corrective actions closed with the evidence that the fix worked.

Consultants, contractors and visitors

Suppliers and third-party access

Contractors and service providers with clauses, assessments, access rights and review dates, and any DESC certification that applies to their cloud, data centre or SOC services.

DESC oversight

Evidence ready for DESC

DESC requests, responses and deadlines tracked, with evidence per domain drawn from the system, so a follow-up or assessment is answered from records that already exist.

Across the programme

Training, incidents and management review

Awareness training linked to Sterling Academy, incident and lessons-learned records, KPIs and a management review with its decisions and actions; with forms and reports configured to your way of working, no coding needed.

What this means at the audit

Whether the question comes from DESC, from a real-time assessment or from a government entity checking its suppliers, it is usually the same: show how this requirement is met. In Effivity the answer is one screen, with the applicability decision, the owner, the policy, the latest records and the audit result, each dated. Sustain™ then runs in the same workspace, so the next request finds a programme that never stopped.

Effivity for DESC ISR: the guide Effivity ISMS on effivity.com

In your engagement

Subscription included with the engagement, at no additional cost
Configured by your Sterling consultant within the agreed scope
Existing registers, policies and records imported, not retyped
Admin and user training for your team
Further modules, such as BCMS, QMS and PIMS, as other standards join the programme

DESC ISR client experience

Client letters on file, available on request.

Client feedback wall: letters on file

Signed client letters for DESC ISR are available on request. The client feedback wall lists every letter by standard.

Programmes with DESC ISR in scope

How the ISR fits beside ISO/IEC 27001 and cloud controls.

All case studies

01
Technology suppliers to Dubai government: ISO/IEC 27001, the ISR and cloud security as one programme
How a programme of this kind runs: an ISO/IEC 27001 ISMS provides the risk method and most of the controls; the ISR layer adds the applicability review, the requirements the client entity flows down, contractor and visitor terms and evidence organised by domain; where cloud services are provided, CSP Security Standard certification by an accredited body runs on the same evidence and audit calendar.
Integrated management systems

Sterling Academy · DESC ISR e-learning

ISR awareness for everyone the regulation reaches, not only the security team.

The ISR's scope takes in employees, consultants, contractors and visitors, so awareness cannot stop at the IT department. Sterling Academy's e-learning serves both the whole workforce and the people running the programme, with video lessons, practice checkpoints, a final exam and, per learner, a numbered Certificate of Completion that can be verified online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.

DESC ISR awareness for every employee, and for contractors' staff where your entity requires it
Practitioner courses for the ISR officer, the security team and control owners
Internal auditor training for the people who will audit the programme, as applicable to your standard, as part of the engagement
Learner progress by department and a training report for DESC or client-entity reviews
New hires and new contractors trained as they arrive, so the evidence stays current
A Sterling consultant reachable when a learner needs one

Keep exploring

Explore more about DESC ISR (Dubai)

Watch a video on how to comply with Dubai's DESC ISR here.
Watch a video on Dubai DESC ISR requirements here.

DESC ISR resources

Services for DESC ISR (Dubai)

Why Sterling

Want successful DESC ISR compliance? Come to Sterling.

Sterling's regional headquarters for the UAE is in Dubai, so ISR programmes are led from the city whose government the regulation protects, by consultants who can be on site. Suppliers serving Dubai from India, the Philippines, Europe or the United States keep one engagement team and one control set for the ISR and every other framework their clients raise.

From Dubai, across 60+ countries since 2003

Information security and governance programmes for technology and managed service providers, BPOs, healthcare, logistics and engineering firms, with a single engagement team answerable across all your locations.

All-inclusive proposal

One proposal covers consulting, Effivity, training and Academy access; testing, certification and legal costs are shown on their own lines. No surprises, ever.

Controls your people can run

Right-fit controls, procedures that match how access, changes, contractors and incidents are really handled, and software that holds the evidence, so compliance becomes routine rather than a scramble before each review.

Expert and experienced consultants

Consultants who have advised on management systems across sectors and countries since 2003 and get the ISR programme right first time, so DESC's review finds controls already working.

Sterling vs the rest: the full comparison Explore DESC ISR client experience

The Sterling Promise

What our DESC ISR compliance success guarantee means

100%on-time completion · success · 8,100+ client engagements

We stay with you until the agreed ISR programme outcome is achieved: the applicability review documented and approved, the applicable controls operating, contractors under terms, people trained and the evidence in place, so your team can answer DESC, a client entity or an incident on its own. Plain explanations, the included software and training for your workforce keep that capability in place after we leave.

The engagement defines the entity or contracts, scope, outcome and responsibilities. Your organisation supplies accurate information and the ISR copy it holds, gives access to the systems and contractors in scope and operates the agreed controls. Compliance is monitored by DESC and, for suppliers, assessed by the entities they serve; questions of legal interpretation belong with your own advisers. We commit to the agreed programme support, which is not legal advice and cannot guarantee that no incident will ever happen.

After the programme is in place

What happens after DESC ISR compliance?

ISR compliance is a state you keep, not a date you pass. DESC maintains and continuously improves the regulation, so updates have to be absorbed; applicability decisions need revisiting when systems, services or contractors change; incidents carry lessons; and DESC's monitoring and follow-up continue whether or not anything has gone wrong.

Sterling OS™ Sustain™ keeps that cycle turning with you: an annual refresh of the applicability review, internal audits across the applicable domains, contractor reassessments, refresher training and a watch on DESC's regulations and announcements, so the programme is current whenever it is tested.

FAQs

Frequently asked questions about DESC ISR

Is there a DESC ISR certification?

Not for an organisation. DESC's published certifications cover cloud service providers, data centres and security operations centres against separate standards, and its Cyber Force certification covers incident response and penetration testing providers. DESC's programme for ISR officers certifies individuals. Government entities' compliance with the ISR is monitored by DESC; an "ISR certificate" offered to your company by a consultant or a certification body is a badge, not a DESC decision.

Who does the ISR apply to?

All Dubai government entities, including, in DESC's words, but not limited to their employees, consultants, contractors and visitors. DESC's IoT Security Standard names government and semi-government entities, and ISR officers from semi-government entities take part in DESC's ISR community. If your organisation's status is unclear, confirm it with DESC or your legal advisers before scoping.

We are a private company supplying a Dubai government entity. Does the ISR apply to us?

Through the entity, for the people and services within its scope: the regulation expressly covers the entity's consultants and contractors. In practice it reaches you as contract clauses, access conditions and security questionnaires and, for cloud, data centre or SOC services, as DESC's own standards for those services. Scope the programme to the services, systems and people that touch the entity's information.

Does ISO/IEC 27001 certification make us ISR compliant?

Not by itself, though it is the strongest starting point. The two are commonly aligned in practice, and DESC's own CSP Security Standard combines ISR:2017 v.02 with ISO/IEC 27001:2013 and ISO/IEC 27002:2013. But the ISR is a separate text with its own applicability review and requirements, and DESC, not a certification body, monitors ISR compliance. Map the ISMS to the ISR and close what is specific to the regulation.

Which version of the ISR applies to us?

The one DESC currently issues. DESC provides the ISR on e-mail request, and its website entry shows no version number. The version DESC cites in its CSP Security Standard is ISR:2017 v.02. Confirm with DESC, or with the entity you serve, which copy applies, and plan for updates, since DESC maintains and improves the regulation.

How do we obtain a copy of the ISR?

Through the e-mail request link on DESC's Standards & Policies page; the regulation is not published as a public download. Suppliers can also ask the entity they serve which requirements it flows down.

What is an ISR officer, and does Sterling's training make someone one?

ISR officers work within Dubai government and semi-government entities. In January 2026 DESC gathered them at its Multaqa ISR Officers forum, briefed them on its certification programme for ISR officers and recognised the first and second batches of Certified ISR Officers. That certification is DESC's. Sterling Academy courses and internal auditor training build competence and evidence it, but they are training certificates, not DESC's certification.

What is ASAAS 2.0?

DESC describes ASAAS 2.0 as its next-generation AI-powered auditing engine. At its January 2026 forum DESC demonstrated it and said it would soon be made available to government entities, supporting real-time assessments, automated gap analysis and AI-driven recommendations through an interactive dashboard. Evidence structured by requirement, owned and kept current is what any such assessment rewards.

We provide cloud services in Dubai. What applies to us?

DESC's CSP Security Standard, which covers cloud service providers and organisations using cloud services. Accredited certification bodies certify it under the scheme applied for ISO/IEC 27001, with yearly surveillance and recertification every three years, and existing certifications are acknowledged without further audits for them. Certified providers are listed on DESC's Certified Providers page; data centre and SOC services have their own DESC standards.

What do you need to prepare a DESC ISR proposal?

Whether you are an entity or a supplier; the services, systems, sites and headcount in scope; any ISR copy or client requirements you hold; what exists today; and any DESC or contract date. With that we can scope the work and fix the fee; no applicability review is needed beforehand.

Before the first call

Prepare a useful DESC ISR readiness brief

Nothing needs to be assessed before the first call; a short account of who you are in relation to Dubai government, and who is asking, is enough. Seven questions:

Are you a Dubai government or semi-government entity, or a supplier, consultant or contractor to one? Which entities?
Which services, systems, sites and people should the programme cover?
Do you hold the current ISR copy from DESC, and has an applicability review ever been documented?
Who is asking: DESC, your ISR officer, a client entity's contract or questionnaire, a tender?
What exists today: ISO/IEC 27001, CSP Security Standard certification, SOC 2, penetration test reports, an incident procedure?
Which cloud, data centre, SOC, IoT or industrial control systems are involved, and who provides them?
Is there a DESC request, an assessment date, a contract start or a renewal to plan around?

Your answers let us size the work and quote an all-inclusive proposal we can keep. They are a starting point for a conversation, not a scored assessment and not legal advice on your obligations.

Don’t be fooled by certification scams

If it takes ten days, it is not DESC ISR compliance.

DESC issues no ISR certificate for an organisation, which has not stopped the market from selling one: "ISR certified" badges, "DESC-approved" seals on a consultant's letterhead, ten-day compliance packages and policy sets with another entity's name still inside. They cost less than a programme until DESC follows up, a client entity asks for the applicability review, or an incident shows which controls existed only on paper.

How to choose a credible DESC ISR provider

Ask what any "ISR certificate" actually is. DESC's certifications apply to service providers, such as cloud, data centre, SOC, incident response and penetration testing, under their own standards; an entity's ISR compliance is monitored by DESC, not certified by a consultant.
Check provider claims at the source. Certified cloud service providers and Cyber Force-certified incident response and penetration testing providers are listed on DESC's Certified Providers page; a logo in a proposal proves nothing.
Ask how the applicability review will be done, against the ISR copy DESC has issued, with your own system owners and records, not scored from a generic questionnaire.
Find out who does what, which testing, certification or legal costs sit outside the fee, and who helps when DESC follows up or an incident puts the programme under strain.
Separate training from certification. A course certificate from a training provider is not DESC's certification of an ISR officer, and neither of them proves that an entity complies.
Walk away from "ISR compliant in ten days", "DESC-approved" seals and template packs sold as compliance. The regulation requires right-fit controls that operate and evidence that they do; paperwork delivers neither.

All ten warning signs of shortcut compliance

What a credible DESC ISR compliance programme always involves

The current ISR copy obtained from DESC and kept under document control
A documented applicability review, approved by leadership, with resources committed
Controls implemented for each applicable domain, in proportion to your risks
Consultants, contractors and visitors brought under the same rules
Awareness training for everyone in scope, with records
Internal audit and management review completed ahead of any external review
An evidence set ready to share on the day DESC or a client entity requests it

Sterling's position. Sterling does not certify organisations, does not assess ISR compliance on DESC's behalf and does not issue compliance opinions. We build the controls, the governance and the evidence with you; DESC monitors compliance, and the entity you serve judges its suppliers. We never sell seals, and if an offer in front of you is one, we will say so. When a certificate would help, we name it and state what it covers: ISO/IEC 27001 from an accredited body as supporting evidence for the ISR, never a substitute for it, and CSP Security Standard certification where you provide cloud services.

Offered an "ISR certificate" or a "DESC-approved" seal? Send it to us for a no-charge opinion on what it proves and what it leaves unproven.

Keep exploring

More on DESC ISR (Dubai) and related standards

More in Information security, cyber & cloud

Talk to a consultant

Plan your DESC ISR compliance with confidence.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

hello@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Build a DESC ISR compliance programme for the first timeUnderstand cost, scope and timingMeet ISR requirements as a supplier to a Dubai government entityMap our ISO/IEC 27001 ISMS to the ISR

Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice