ISO/IEC 27001 by region
ISO 27001 certification in the UAE and GCC: EIAC accreditation, Dubai practice and the regional security frameworks
Clause by clause: ISO/IEC 27001:2022 requirements: every clause explained →
What is different about ISO/IEC 27001 in the UAE and GCC: how EIAC and GAC accredit certification bodies, free-zone and entity scope, and how the certificate relates to the UAE IA Standard, Dubai ISR, ADHICS, NCA ECC, SAMA CSF and the UAE PDPL.
Key points
- In the UAE, certification bodies for ISO/IEC 27001 are accredited by EIAC, a Government of Dubai entity; registration with EIAC is mandatory for certification bodies based in Dubai. GAC accredits management system certification bodies across the GCC.
- Most UAE and Saudi information security rules, including the UAE IA Standard, Dubai's ISR, ADHICS, NCA ECC and SAMA CSF, are assessed by a regulator rather than certified. An ISO/IEC 27001 certificate is strong supporting evidence for them, not a substitute.
- Two local schemes use the certification route directly: DESC's CSP Security Standard is certified under the ISO/IEC 27001 accreditation scheme, and EIAC lists ADHICS among its certification-body schemes.
- Free-zone entities may fall outside the federal data protection law, so the legal and contractual register in clause 4 has to name the right law for each legal entity in scope.
Why organisations in the UAE and GCC pursue ISO/IEC 27001
For a Dubai software house, a fintech in Abu Dhabi or a BPO serving Riyadh, the request usually arrives in a security questionnaire or a tender pack: a bank, a government entity or a multinational wants proof that the supplier's security is managed. ISO/IEC 27001 is the certificate those buyers recognise across borders.
What makes the Gulf different is the second layer. Government entities, hospitals, banks and critical national infrastructure each answer to a regional information security regulation, and they pass its expectations down to suppliers. A certified ISMS gives one risk method, one Statement of Applicability and one evidence base that the regulatory frameworks can draw on. What the standard itself requires is covered in the requirements guide.
Accreditation in the UAE and GCC: EIAC, GAC and checking a certificate
The Emirates International Accreditation Centre (EIAC) is a government entity working under the Executive Council of the Government of Dubai. It accredits certification bodies to ISO/IEC 17021-1, and its management system schemes include ISO/IEC 27001. EIAC states that registration is mandatory for certification bodies based in Dubai under local regulations, and voluntary elsewhere in the UAE. Its Conformity Assessment Bodies Directory shows who holds which scope.
GAC, the Gulf Cooperation Council's accreditation body, accredits bodies that audit and certify management systems, and publishes a directory filterable by body type and country. In Saudi Arabia, SAAC, the national accreditation body, publishes its own directory of accredited bodies.
International recognition now runs through the Global ACI arrangement, which replaced the IAF MLA and ILAC MRA on 1 January 2026. EIAC describes itself as an IAF MLA and ILAC MRA signatory, and the Global ACI site published no list of recognised bodies when we checked, so confirm the current status of the accreditation body behind your certificate before you rely on it. The certificate verification guide covers the full check.
Local practice that changes an ISMS project
Legal entities and free zones. Groups often trade through a mainland company, a free-zone company and a Saudi branch. Scope statements, the interested-party register and supplier contracts need to follow those entities. The UAE federal data protection law excludes free-zone companies that have their own data protection legislation, and the DIFC has its own Data Protection Law, so the applicable privacy law differs by entity.
Arabic as the binding text. The NCA states that the Arabic version of the ECC governs its interpretation, and the UAE data protection law's English text is a translation of the Arabic original. Legal register entries should cite the binding version.
Cloud and hosting. Cloud providers serving Dubai Government, and organisations using their services, meet DESC's CSP Security Standard, which is certified by accredited bodies under the scheme used for ISO/IEC 27001. Planning both audits together avoids evidencing the same controls twice.
The local layer: how ISO/IEC 27001 relates to each framework
| Local item | What it means for your ISMS | Where to verify it |
|---|---|---|
| UAE Information Assurance Standard (UAE IA hub) | TDRA's national baseline for protecting information assets; compliance is assessed by the designating authority, and ISO/IEC 27001 supplies the governance and risk method it builds on | The UAE government portal and TDRA |
| Dubai ISR (DESC ISR hub) | Applies to Dubai Government entities and their contractors; DESC publishes no ISO/IEC 27001 mapping, so the two are aligned in practice and the certificate supports supplier checks | DESC's regulations page |
| ADHICS (ADHICS hub) | The Department of Health's standard for Abu Dhabi healthcare; ISO/IEC 27001 supports it but does not replace it, and EIAC-accredited bodies can certify ADHICS itself | EIAC's certification-body schemes and Malaffi's policy page |
| NCA ECC (NCA ECC hub) | Saudi minimum cybersecurity controls for national entities, assessed by the NCA; an operating ISMS shortens the programme but no certificate satisfies the ECC | The National Cybersecurity Authority's controls list |
| SAMA CSF (SAMA CSF hub) | The Saudi Central Bank's framework for regulated financial institutions, rated by maturity; ISO/IEC 27001 evidence supports parts of it, never the whole | The Saudi Central Bank's rulebook |
| UAE PDPL (UAE PDPL hub) | Federal Decree-Law No. 45 of 2021 requires security measures matched to risk; linking personal-data risks to ISO/IEC 27001 controls is one practical way to evidence them | The UAE legislation portal |
| EIAC and GAC accreditation | Choose a certification body whose accreditation covers ISO/IEC 27001 and your sector | EIAC's directory and GAC's accredited bodies list |
How Sterling works in the UAE and GCC
Sterling supports UAE and GCC clients from its Dubai office. Sterling does not certify: an accredited certification body you select audits and decides.
How Sterling supports UAE and GCC organisations
One ISMS that answers your certification body and your regulator
We start with a gap analysis against ISO/IEC 27001 and the regional frameworks that apply to you, build one risk method and Statement of Applicability, run the evidence in Effivity, carry out the vulnerability assessment, train your internal auditors and stay with you through Stage 1 and Stage 2. We ensure successful certification for our clients.
Book a free discovery callISO/IEC 27001 in the UAE and GCC: questions buyers ask
Does ISO 27001 certification make us compliant with the UAE IA Standard?
No. It gives you the governance, risk method and many of the controls, but compliance with the UAE IA Standard is assessed by the authority that designated your entity. Treat the certificate as supporting evidence and close the gaps it does not cover.
Must our ISO 27001 certification body be accredited by EIAC?
For a certification body based in Dubai, EIAC states that registration is mandatory. Outside Dubai it is voluntary, and certificates from other internationally recognised accreditation bodies are widely used, so check what your client or regulator specifies.
Is ISO 27001 enough for Saudi NCA ECC or SAMA requirements?
No. Both are assessed by the regulator, the NCA and the Saudi Central Bank respectively. An operating ISMS supplies much of the evidence, and the remaining regulatory controls are added to the same system.
How do we check an ISO 27001 certificate issued in Dubai?
Search the issuing body's register and EIAC's directory, then confirm that its accreditation covers ISO/IEC 27001 and that the certificate cites the 2022 edition. A certificate still citing the 2013 edition has lapsed.
ISO/IEC 27001 by region
Every guide in the ISO/IEC 27001 series is written for one question and links back to the hub for the whole picture.
- ISO/IEC 27001 certification in Australia
- ISO/IEC 27001 certification in India
- ISO/IEC 27001 certification in the Netherlands and Europe
- ISO/IEC 27001 certification in Singapore and South East Asia
- ISO/IEC 27001 surveillance and recertification
- ISO/IEC 27001 for telecommunications and data centres
- ISO/IEC 27001 certification in the Philippines
- ISO/IEC 27001 certification in the UAE and GCC
- ISO/IEC 27001 certification in the United Kingdom
- ISO/IEC 27001 timeline
- ISO/IEC 27001 training
Keep exploring
Explore more about ISO/IEC 27001
Watch a video on how to implement ISO 27001 here.
Watch a video on ISO 27001 requirements here.
ISO/IEC 27001 resources
Services for ISO/IEC 27001
Talk to a consultant
Plan your ISO/IEC 27001 certification in the UAE and GCC with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice