UAE Information Assurance Standard, formerly known as NESA
UAE Information Assurance Standard: who it applies to and how the controls work
How the standard moved from NESA to the TDRA and the UAE Cyber Security Council, who has to implement it, how the management and technical control families are organised, and what the priority levels mean.
In short
The UAE Information Assurance Standard is the country's national set of information security controls. It began under the National Electronic Security Authority (NESA), was issued by the TRA as the UAE Information Assurance Regulation v1.1 in 2020, and is now published by the UAE Cyber Security Council. Government entities and organisations designated as critical are obliged to implement it, and others are encouraged to. Controls are split into management and technical families and ranked by priority, so critical entities know which to implement first.
NESA, TDRA or the Cyber Security Council: which name is current?
Many people still call it the NESA standard. The National Electronic Security Authority published the original National Information Assurance Framework and the IA Standards. The Telecommunications Regulatory Authority, now the Telecommunications and Digital Government Regulatory Authority (TDRA), then published the UAE Information Assurance Regulation, Version 1.1, in March 2020.
The UAE Cyber Security Council now publishes the UAE Information Assurance Standard. The Council has published a newer edition than v1.1. Before you plan a programme, check the current text on the Council's website and confirm which edition your regulator or contracting authority expects you to follow.
- NESA
- The National Electronic Security Authority, which published the original UAE IA Standards. The name is still widely used for the standard.
- TDRA
- The Telecommunications and Digital Government Regulatory Authority (formerly the TRA), which issued the Information Assurance Regulation v1.1 in March 2020.
- UAE Cyber Security Council
- The federal body that now publishes the UAE Information Assurance Standard and runs the national compliance platform for government entities.
Who has to implement the standard?
Under the 2020 regulation, all UAE government entities and other entities identified as critical are obliged to implement it. Critical entities are designated under the UAE's critical information infrastructure protection policy. All other UAE organisations are encouraged to adopt it voluntarily.
The Cyber Security Council's own guidance describes its frameworks as applying to critical sectors without necessarily being mandated for everyone. In practice, the question for a private company is usually contractual: a government customer or a critical-sector client asks you to demonstrate alignment.
- Government entities. Federal and local government bodies are obliged to implement the standard.
- Designated critical entities. Organisations identified as critical infrastructure are obliged to implement it, starting with the highest-priority controls.
- Suppliers to both. Often asked to show alignment through contract terms or security questionnaires.
- Everyone else. Encouraged to adopt it voluntarily as a national baseline.
Management and technical control families
Version 1.1 splits its controls into two groups. Management families cover how information security is governed and planned. Technical families cover how systems and information are protected in operation.
| Group | Families | What they cover |
|---|---|---|
| Management | M1 to M6 | Strategy and planning, risk management, awareness and training, human resources security, compliance, and performance evaluation and improvement |
| Technical | T1 to T9 | Asset management, physical and environmental security, operations management, communications, access control, systems acquisition and development, incident management, information systems continuity, and third-party security |
Read the family titles against the edition you are implementing. The newer edition from the Cyber Security Council keeps the split between controls that always apply and controls that depend on risk assessment, and adds sub-controls.
Priority levels and "Always Applicable" controls
You do not have to implement every control at once. The standard ranks controls by priority so organisations can sequence the work, and it separates controls that are mandatory in every case from those whose applicability depends on the organisation's risk assessment.
| Marker | Meaning |
|---|---|
| Always Applicable | Mandatory regardless of what the risk assessment concludes |
| Risk-based | Applies when the risk assessment shows the related threat is relevant |
| P1 | Highest priority. Critical entities start here. |
| P2 to P4 | Implemented after P1, in descending order of priority |
How it sits alongside other UAE requirements
The Information Assurance Standard is not the only UAE regime an organisation may face. Financial institutions licensed by the Central Bank of the UAE have their own regulations, and free zones such as ADGM have their own data protection rules. Personal data processed onshore falls under the UAE's federal data protection law.
These regimes overlap. Access control, incident management and third-party security appear in all of them. If you map each control to every requirement it satisfies, you do not have to assess the same control several times.
Building a UAE IA programme
Start by confirming which edition applies to you and whether you are obliged or adopting voluntarily. The risk assessment comes next, because it decides which risk-based controls are in scope.
-
01
Confirm edition and obligation
Check the current standard on the Cyber Security Council's website and confirm whether you are a government entity, a designated critical entity, or adopting voluntarily.
Your CISO and legal team
-
02
Run the risk assessment
Assess threats to your information and systems. The result decides which risk-based controls apply.
Your risk team, in Certifyi
-
03
Map existing controls
Link the ISO 27001 or other controls you already run to the IA controls they satisfy, starting with P1 and the always-applicable set.
Your compliance team, in Certifyi
-
04
Implement by priority
Close gaps in priority order, assign owners and collect the evidence that each control operates.
Control owners
-
05
Review and improve
Measure performance and review the programme, as the management families require.
Your security function and management
Who does what
The standard is published by the UAE Cyber Security Council, and obligations are confirmed by your sector or contracting authority. The organisation owns the controls, and Certifyi keeps the record.
| Task | Your team | Certifyi | Authority or assessor |
|---|---|---|---|
| Risk assessment | Assess threats and decide which risk-based controls apply | Holds the risk register and the applicability reasoning | Reviews whether the scope is justified |
| Control implementation | Implement controls in priority order | Tracks owners, status and linked evidence per control | Tests controls against the standard |
| Third-party security | Assess suppliers handling your information | Records vendor intake and risk assessments | Examines supplier arrangements |
| Performance evaluation | Measure and review the programme | Records management reviews and produces reports | Reviews evidence of improvement |
How Certifyi helps
Work through the priority controls on one control set
Certifyi does not certify you against the standard or report to any UAE authority. It holds the priority controls, your mapping, the evidence and the risk decisions behind your scope.
-
UAE IA priority controls in the catalogue
An assessment set of 91 P1 and P2 priority controls drawn from families M1 to M6 and T1 to T9. It is a priority-control set, not the full standard.
-
One control set across frameworks
Map a control once to the UAE IA Standard and ISO 27001, and reuse the mapping across frameworks. See the unified frameworks module.
-
Risk decisions next to the controls
The risk register holds the assessment that decides which risk-based controls apply, with heatmaps to show where the risk sits.
-
Third-party security
Run supplier intake and risk assessments in the vendor risk module. Suppliers answer through their own portal rather than by email.
-
Assessor access and reports
Give an assessor scoped, read-only access to the evidence for their engagement, and produce PDF reports for management review.
Questions
UAE Information Assurance Standard, answered
Is NESA compliance still required?
The standard many people call NESA is now the UAE Information Assurance Standard, published by the UAE Cyber Security Council. Under the 2020 regulation it is mandatory for government entities and designated critical entities, and encouraged for everyone else.
Who must comply with the UAE IA Standard?
UAE government entities and entities identified as critical are obliged to implement it. Other organisations are encouraged to adopt it, and are often asked to show alignment by government or critical-sector customers.
What does P1 mean in the UAE IA Standard?
Controls are ranked P1 to P4. P1 controls are the highest priority, and critical entities are expected to implement them first.
What are "Always Applicable" controls?
Controls that are mandatory whatever your risk assessment concludes. Other controls apply only when the risk assessment shows the related threat is relevant to you.
Which version of the standard should we follow?
Version 1.1 was issued as a regulation in March 2020. The UAE Cyber Security Council has since published a newer edition. Check the current text on the Council's website and confirm with your regulator or contracting authority which edition they expect.
Is there a UAE IA certification?
The standard is assessed by the relevant authority or an assessor, and the Council runs a compliance platform for government entities. Confirm the assessment route that applies to you with your authority.
Does Certifyi make us compliant with the UAE IA Standard?
No. Compliance depends on your controls, your risk assessment and your authority's review. Certifyi holds the priority controls, your mapping and the evidence.
Map your UAE IA priority controls in a 30-minute call.
Bring your current ISO 27001 controls or your last assessment. We will show how the P1 and P2 controls, your risk decisions and the evidence sit together in Certifyi.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them