NESA compliance services in the UAE, for IA Regulation v1.1 and IA Standard v2.1.
The UAE Information Assurance (IA) Regulation, published by TRA (now TDRA) and still widely called NESA after the authority that set out the earlier UAE IA Standards, is mandatory for UAE government entities and for organisations designated as critical, and recommended for every other UAE organisation. Compliance is a posture, not a paperwork exercise. In November 2025 the UAE Cyber Security Council published version 2.1 of the UAE IA Standard, and we deliver readiness audits, control implementation and ongoing operations against whichever version your regulator names.
- v1.1 + v2.1IA versions covered
- 134Controls in v2.1
- P1-P4Control priorities
- 15Control families
Nine IA-Standards capability areas, operationalised.
Information Security Policy and Governance
Documented security policy, security council with named accountabilities, exception register, annual review cycle, board-level reporting. The paper layer that makes everything else defensible.
Asset Management
Inventory of information assets, ownership, classification, acceptable-use rules, return of assets on contract end. Maintained as a tracked register, not a stale spreadsheet.
Human Resources Security
Pre-employment screening, onboarding security training, role-based access, contractor controls, disciplinary process for security violations, secure offboarding.
Physical and Environmental Security
Server-room access control, environmental monitoring (temperature, smoke, leak), CCTV in sensitive areas, visitor management, secure-zone designation.
Access Control
Microsoft Entra ID with MFA, role-based access design, joiners-movers-leavers process, privileged access management with just-in-time elevation, access-review cycles.
Cryptography
Encryption-at-rest across endpoints, servers, databases, backups. TLS 1.2+ in transit. Key management discipline with HSM or Azure Key Vault, key rotation schedules.
Operations Security and Monitoring
Microsoft Sentinel as SIEM, 24/7 monitoring with regulator-grade alert rules, log retention to IA-mandated periods, monthly threat-hunt cycle.
Incident Management
Written incident-response playbook, severity matrix, escalation chain, regulator notification template, quarterly tabletop exercise, lessons-learned cycle.
Compliance and Audit
Quarterly evidence pack covering all 15 IA control families, internal audit cycle, supplier audit register, regulator-readiness drills. The auditor gets a folder, not a fire drill.
Four reasons IT and security leads consolidate IA work with GR.
Standards-literate, not standards-only
We hold the IA Standards mapping internally and apply the controls operationally. The output is not a 200-page compliance binder; it is a running operation that produces audit evidence on demand.
Microsoft-stack as the implementation surface
Most IA controls have a Microsoft-stack implementation path: Entra for access, Defender for endpoint and threat protection, Sentinel for monitoring, Purview for classification and retention, Intune for device compliance. We use this stack as the operational substrate.
Audit-evidence pack as standard deliverable
Quarterly evidence pack delivered without you asking: control-by-control status, exception register, audit trails, training completion. Designed to be handed to your supervisor with minimal preparation.
Training as part of the engagement
IA Standards require role-based security awareness training. We deliver it: leadership briefing, IT-team technical training, all-staff awareness session, recorded for new joiners.
Six categories of UAE entities where IA Standards apply.
Energy and utilities
Power generation, distribution, water utilities, gas. Often CII-designated, which makes the IA controls mandatory rather than voluntary.
Banking and financial services
Central Bank-licensed, DFSA, ADGM-regulated. Often subject to IA Standards alongside their primary regulator framework.
Healthcare critical infrastructure
Major hospitals, DHA-licensed and government healthcare facilities. Patient-safety-critical systems in scope.
Transport and logistics
Aviation, ports, mass-transit operators. Operational technology security particularly relevant.
Government and government-adjacent
Federal and Emirate-level government entities, semi-government corporations, government-contracting suppliers.
Voluntary adopters
Private-sector firms adopting IA Standards as a best-practice cybersecurity baseline ahead of supplier requirements or future regulatory expectation.
How IA Standards relate to ISO 27001 and UAE PDPL.
| Feature | IA Standards | ISO 27001 | UAE PDPL |
|---|---|---|---|
Issuing body | TDRA (IA Regulation v1.1); UAE Cyber Security Council (IA Standard v2.1) | ISO/IEC | UAE Data Office |
Scope | Critical-info-infra UAE | Generic information security | Personal data protection |
Geographic application | UAE-only | Global | UAE |
Certifiable | Compliance attestation | Yes (certifiable) | Compliance only |
Control count | 188 (v1.1); 134 (v2.1) | ~93 (2022) | ~30 articles |
Primary focus | CII protection | Information assets | Personal data |
Overlap with each other | Strong with both | Strong with IA | Article 6 with IA |
From baseline audit to ongoing operations in 8-14 weeks.
- 1
Baseline audit
2-3 weeks
Workshop-led discovery: current controls, existing documentation, control-by-control assessment against IA Standards. Output: written maturity assessment per control family and prioritised remediation roadmap.
- 2
Foundation build
4-8 weeks
Security policy refresh, identity baseline, Sentinel SOC operational, Purview classification, incident-response playbook written, asset register populated, exception register established.
- 3
Operational embedding
2-3 weeks
Quarterly evidence-pack cadence agreed, training rolled out, change management aligned, exception-handling workflow operating, supplier-audit register populated.
- 4
Quarterly compliance cycle
Ongoing
Quarterly control review, evidence-pack assembly, threat-hunt report, training refresh, exception-register review. Annual full re-audit against IA Standards evolution.
“We are a critical-infrastructure-adjacent operator and IA Standards compliance was a 2026 board-level commitment. GR ran the baseline audit in three weeks, built the foundation in seven, and we passed our supplier-led IA review at maturity tier 3 on first attempt. The quarterly evidence pack is now part of our normal operating rhythm.”
What buyers ask before engaging.
Adjacent capabilities that pair with NESA/IA work.
Cybersecurity Audit and Compliance
Broader security posture review including IA-Standards technical-controls assessment.
Microsoft Sentinel
Cloud SIEM used as the monitoring substrate for IA-Standards-compliant operations.
UAE PDPL Compliance
Federal-level personal data law that applies alongside IA Standards for many entities.
Book a NESA/IA readiness audit and we will deliver a written maturity report.
Tell us about confirmed assessment criteria, entity scope, system inventory and existing evidence. We will confirm the requirements and proposed scope with you.
Related Services
Explore more solutions that work great with this service
CBUAE IT Requirements
Which Rulebook articles actually bind your licence
ISO 27001 Certification UAE
The 2022 edition, and whether you should certify at all
ADHICS V2 Compliance
The Abu Dhabi healthcare standard, read from the source
IT Audit Services Dubai
Assessment, technical test or certification, scoped properly
DESC ISR Compliance
Dubai Information Security Regulation, scoping to evidence
Cybersecurity Audit
Security assessment and compliance audit
Microsoft Sentinel
Cloud-native SIEM and threat intelligence
Microsoft Defender
Advanced endpoint and email threat protection