Published 6 November 2026 · 6 min read · Tuscan Digital
Cybersecurity compliance in the UAE can feel like alphabet soup. IA, ISR, PDPL, ISO 27001, NIST. The good news is that the same core controls sit underneath all of them. Get those right and most audits become a question of evidence, not panic.
Which rules apply to you
| Framework | Who it applies to | Issued by |
|---|---|---|
| UAE Information Assurance Regulation | Entities across the UAE, with critical entities designated under the national critical information infrastructure policy | TDRA |
| Information Security Regulation (ISR) | Dubai Government entities | Dubai Electronic Security Center (DESC) |
| Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) | Organisations that process personal data in the UAE, outside free zones with their own data laws | UAE federal law |
| DIFC Data Protection Law No. 5 of 2020 and ADGM Data Protection Regulations 2021 | Companies in those free zones | DIFC and ADGM |
| Sector rules | Banks, insurers, healthcare providers and other regulated sectors | Their own regulators |
| ISO/IEC 27001:2022 | Voluntary, but often required by clients and tenders | ISO and IEC |
| NIST Cybersecurity Framework 2.0 | Voluntary reference model used worldwide | NIST |
Not sure where you sit? Start with your customers. A government client, a bank or a hospital will usually tell you which framework they expect.
The 12-point checklist auditors start with
- Know what you own. Keep an up-to-date list of systems, devices, cloud services and data, each with a named owner.
- Classify your data. Label what is public, internal, confidential and personal, and record where it lives, including cloud regions.
- Assess your risks. Run a risk assessment, keep a risk register and review it at least once a year.
- Control access. Turn on multi-factor authentication, give people only the access they need and remove it the day they leave.
- Patch on a schedule. Apply security updates regularly and fix critical issues fast.
- Back up and test restores. Encrypt backups, keep one copy offline and prove you can restore it.
- Log and monitor. Collect logs in one place and make sure someone reviews alerts, around the clock for critical systems.
- Test yourself. Run vulnerability assessments and penetration tests at least once a year and after major changes, then re-test the fixes.
- Plan for incidents. Write an incident response plan, name the team and rehearse it.
- Check your suppliers. Put security terms in contracts and review the access vendors hold.
- Train your people. Run regular awareness training and phishing simulations.
- Keep the evidence. Store policies, logs, test reports and training records where an auditor can find them.
Where personal data fits in
If you hold data about customers or staff, data protection law sits right next to your security controls. Under the UAE PDPL, people can ask to see, correct or delete their data, and sending it outside the UAE is allowed only under set conditions. In practice, that means knowing which systems hold personal data, who can reach it and which countries it travels to.
A sensible order of work
- Map which frameworks apply and where your gaps are.
- Fix the quick wins first: multi-factor authentication, patching and backups.
- Run a penetration test and fix what it finds.
- Put monitoring in place so problems surface early.
- Close the paperwork: policies, registers and evidence.
Need a second pair of eyes? Our cybersecurity team runs VAPT, 24/7 monitoring and compliance programmes aligned to UAE IA, ISO 27001 and NIST, and your first prioritised risk summary arrives by the end of your first week with us. For the wider plan, see IT consulting.