NESA vs ISO 27001: How the UAE IA Standard Differs

NESA and ISO 27001 are not rivals. The UAE Information Assurance (IA) Standard, still often called NESA, is a national control set from the UAE Cyber Security Council that ministries, federal authorities and critical information infrastructure entities have to comply with. ISO/IEC 27001 is an international standard for running an information security management system, and certification against it is a choice. The IA Standard draws on ISO/IEC 27001:2022, so much of the work counts towards both. The real differences are a fixed baseline of mandatory controls, a set order of work and reporting to a UAE regulator. If the IA Standard applies to you, see our NESA compliance services.

What is the UAE IA Standard (NESA), and who has to follow it?

The UAE IA Standard is the national information assurance standard published by the UAE Cyber Security Council (CSC). The Council describes it as a nationally recognised framework for the security and resilience of critical information infrastructure across the UAE. The current text is version 2.1, dated November 2025, and the Council publishes it on its website as an open document.

Section 1.2 of the standard says it applies to:

• Ministries and federal authorities.
• Non-government critical information infrastructure (CII) entities.
• Emirate government entities. Where an emirate has its own CIIP programme, the emirate lead carries out the applicability assessment, enforcement and monitoring. Where it does not, the standard applies to emirate government entities directly.

Other private companies are not named as mandatory implementers. Even so, the foreword says the standard has been adopted by government and non-government CII sectors and by numerous private sector entities. If you are not sure whether you count as CII, ask your sector regulator. The Council's Critical Information Infrastructure Protection (CIIP) Policy sets the governance for CII entities and the approach to identifying critical assets.

The NESA name is still in use. Microsoft Purview Compliance Manager, for example, lists its template as "UAE - NESA Information Assurance Standards".

TDRA also still publishes the earlier UAE IA Regulation, version 1.1, dated March 2020, which sorts 188 controls into four priority levels. The Council's standard does not say whether it replaces that regulation, so ask your sector regulator which version you will be assessed against. Our guide to NESA compliance explains version 1.1.

What is ISO 27001, and how does certification work?

ISO/IEC 27001 is the international standard that sets the requirements for an information security management system (ISMS). The current edition is ISO/IEC 27001:2022, the third edition, published in October 2022 and amended in 2024 with climate action changes. The 2013 edition has been withdrawn.

ISO describes it as guidance for companies of any size and from all sectors. You establish an ISMS, apply a risk management process adapted to your size and needs, and keep improving it.

Certification is optional. ISO says organisations implementing the standard can decide whether to go through a certification process. If you do, the certificate comes from a certification body. ISO notes that a certificate from an accredited body may add confidence, because an accreditation body has independently confirmed that certification body's competence.

Your cloud provider's certificate does not certify your organisation. Microsoft 365 holds an ISO/IEC 27001:2022 certificate, and Microsoft says you can use it in your own assessment. You are still responsible for engaging an assessor to evaluate the controls and processes in your own organisation. Our ISO 27001 certification page covers whether you need a certificate at all.

Where do the two frameworks overlap?

They overlap heavily, by design. The CSC states that the IA Standard aligns with ISO/IEC 27001, NIST SP 800-53 and the CIS Controls. The standard lists ISO/IEC 27001:2022, ISO/IEC 27002:2022 and ISO/IEC 27005:2022 among the references it was built on.

Annex D of the IA Standard maps its controls to ISO/IEC 27001 and 27002, to NIST SP 800-53 Revision 5 and to the DESC Information Security Regulation v3. Some examples from that table:

• Information security policy (M1.2.1) maps to ISO/IEC 27001 clause 5.2.
• Risk identification (M2.2.1) maps to clause 6.1.2, and the Statement of Applicability (M2.3.4) to clause 6.1.3.
• The awareness and training programme (M3.2.1) maps to clause 7.3.
• Internal audits (M6.2.2) and management review (M6.2.3) map to clauses 9.2 and 9.3.
• Access rights (T5.2.2) maps to ISO control 5.18, and the incident response plan (T8.2.1) to ISO control 5.24.

In practice, an existing ISO/IEC 27001 ISMS gives you the base for the IA Standard: the risk method, the policy set, internal audit and management review. You then add the IA sub-controls to it. Annex D also shows some IA controls with no ISO reference, for example T4.1.4 Security of Wireless Networks, so plan for gaps rather than assuming full coverage.

Where does the UAE IA Standard differ from ISO 27001?

The IA Standard is more prescriptive, and it answers to a regulator. These differences are written into the standard itself:

• A fixed baseline. 70 of the 134 controls are "Always Applicable". They must be implemented whatever your risk assessment says, and the standard states that omitting any of them is not acceptable and constitutes non-conformity. ISO, by comparison, describes its standard as applying a risk management process adapted to each organisation's size and needs.
• Mandatory sub-controls. The 134 controls break down into 449 sub-controls, which the standard calls mandatory implementation requirements. ISO/IEC 27001:2022 itself runs to 19 pages.
• Exclusions go to the regulator. You may exclude a risk-based control only with justification submitted to the CSC and evidence that accountable persons accepted the risk. Without an entity risk assessment, every control counts as applicable and mandatory.
• A set order of work. Each control carries a priority from P1 to P4. Critical entities must begin with the 39 P1 controls. They may promote or demote other controls based on their risk assessment, but not P1. The standard is clear that priority sets the order of work, not how critical a control is.
• Performance indicators. Control families and sub-families come with indicators to measure how well the controls work. You can use them or develop your own.
• Regulator oversight. Entities report progress to their sector regulator or lead entity, or to the CSC where none is defined. The CSC reviews compliance self-assessment reports and can perform or commission compliance audits and tests. ISO/IEC 27001 certification, by contrast, comes from a certification body you engage.

Do you need both, and which should come first?

That depends on whether you are in scope, who regulates you and what your customers ask for. A simple way to decide:

• You are a ministry, federal authority or CII entity. The IA Standard is not optional, so it comes first. Build the management system core (risk method, policies, internal audit, management review) so that it also meets the ISO/IEC 27001 clauses, using Annex D as the map.
• A customer or tender asks for an ISO/IEC 27001 certificate. You need certification from a certification body, because that is the document being asked for.
• Both apply. Run one management system, one risk register and one evidence set. Keep a control mapping that shows which IA control and which ISO clause each piece of evidence supports.
• Neither applies yet. The 70 Always Applicable controls make a practical baseline, and the Council notes that numerous private sector entities have adopted the standard. Certification can follow when a customer asks for it.

Avoid running two separate programmes. Two risk registers and two policy sets mean two sets of evidence to keep current.

What evidence does an assessor expect to see?

Expect to show that each control exists, operates and is reviewed. The IA Standard's Always Applicable list includes, among others:

• An information security policy and supporting policies (M1.2.1, M1.2.3).
• A risk treatment plan and a Statement of Applicability (M2.3.3, M2.3.4), plus recorded risk acceptance for any control you excluded.
• Internal audits, management review and corrective action (M6.2.2, M6.2.3, M6.3.1).
• Logging, monitoring of system use and management of technical vulnerabilities (T3.2.2, T3.2.3, T3.3.2).
• Privileged access rights and reviews of user access rights (T5.2.3, T5.2.4).
• An incident response plan, with incident response training and testing (T8.2.1, T8.2.3, T8.2.4).

For each one, keep the record that shows it working: the approved document, the review minutes, the log extract or the test report.

If you run on Microsoft 365 or Azure, two things help with both frameworks:

• Microsoft's Service Trust Portal provides independently audited compliance reports, so your auditors can compare Microsoft's cloud results with your own legal and regulatory requirements.
• Microsoft Purview Compliance Manager lists regulatory templates for ISO/IEC 27001:2022 and for the UAE NESA Information Assurance Standards. Both are premium templates, so check your licence, and check which version of the UAE standard a template reflects before you rely on it.

Logging and monitoring are controls you operate every day, not documents you write once. We run Microsoft Sentinel for client tenants and have a Dubai-based SOC. For the IA Standard itself, start with our NESA compliance services.