UAE Information Assurance Standard · formerly NESA
NESA / UAE IA Compliance in Abu Dhabi
Intello helps Abu Dhabi organisations meet the UAE Information Assurance (IA) Standard, still widely known as NESA. We assess you against the current version, put the missing controls in place with your team, and prepare the evidence federal clients and auditors ask for.
- On site in Abu Dhabi
- 500+ clients
- 99% client satisfaction
What is NESA / UAE IA compliance?
The UAE Information Assurance Standard sets the minimum security controls for federal government entities and critical information infrastructure in the UAE. It was first issued by NESA (now the Signals Intelligence Agency) and is now published by the UAE Cyber Security Council. Many people still call it “NESA compliance”.
| Current version | UAE IA Standard version 2 (2025), replacing the UAE IA Regulation v1.1 (2020) |
|---|---|
| Published by | UAE Cyber Security Council. Earlier versions came from NESA and TDRA |
| Applies to | Federal government entities and critical information infrastructure, and often their suppliers through contracts |
| Structure | 134 controls in 15 families: 6 management (M1–M6) and 9 technical (T1–T9) |
| Prioritisation | Controls ranked P1 to P4, and tagged as always applicable or based on risk |
| Where we work | On site anywhere in Abu Dhabi, and remotely from our Dubai office |
Information assurance compliance in Abu Dhabi
As the capital, Abu Dhabi is home to most federal ministries and authorities and to much of the UAE’s critical infrastructure. That makes it the centre of UAE IA work.
Federal ministries and authorities
Federal entities headquartered in Abu Dhabi that must meet the UAE IA Standard directly.
Energy and utilities
Oil and gas, power and water organisations designated as critical infrastructure.
Suppliers to federal entities
IT providers, consultancies and contractors whose federal clients pass UAE IA requirements down through contracts.
Ports, aviation and logistics
Transport and logistics operators around KEZAD and the Abu Dhabi Airport Free Zone.
Healthcare
Hospitals and health networks that also meet ADHICS for the Department of Health.
Banks and finance
Financial institutions, often working to Central Bank rules as well. See CBUAE compliance.
Also available: UAE IA compliance across the UAE · Cyber security company in Abu Dhabi · NESA / UAE IA in Dubai · NESA / UAE IA in Sharjah
Does NESA / UAE IA compliance apply to your Abu Dhabi organisation?
It almost certainly does if any of these describe you:
- You are a federal government entity or authority
- You have been designated as critical information infrastructure
- A federal or critical-sector client has written UAE IA (or NESA) requirements into your contract
- You run energy, utility, transport, health or finance systems that the country depends on
- You were compliant with UAE IA v1.1 and need to move to version 2
- You hold ISO 27001 and a client now asks for UAE IA as well
Not sure whether you are in scope? Many suppliers only find out when a contract arrives. We will tell you in the first call what applies and which controls matter most.
What UAE IA compliance involves
The standard has two groups of controls. We focus first on the P1 controls, which every in-scope organisation must have.
Management controls (M1–M6)
Strategy and planning, risk management, awareness and training, human resources security, compliance, and performance evaluation.
Technical controls (T1–T9)
Asset management, physical security, operations, communications, access control, third-party security, systems development, incident management and continuity.
Risk assessment
A documented risk assessment that decides which risk-based controls apply to you.
Prioritised implementation
P1 controls first, then P2 to P4, so the most important protections are in place early.
Third-party and supplier security
Requirements for your own suppliers, which matter for organisations deep in a federal supply chain.
Incident management
Detection, response and reporting of cyber incidents in line with national expectations.
New areas in version 2
Cloud, IoT, AI and machine learning, threat intelligence, secure development and post-quantum cryptography.
Evidence and audit readiness
Policies, records and technical evidence organised so clients and auditors can check compliance quickly.
How we deliver NESA compliance in Abu Dhabi
A fixed sequence, so you always know what happens next.
- 1
Scoping call
We confirm whether the standard applies directly or through a contract, and which systems and sites are in scope.
Week 0 · free
- 2
Gap assessment
On-site workshops and evidence review against all applicable controls, with findings ranked by priority (P1 to P4).
Weeks 1–3
- 3
Risk assessment
A documented risk assessment that confirms which risk-based controls apply.
Weeks 2–4
- 4
Remediation
Policies, procedures and technical controls put in place with your team, P1 controls first.
Weeks 4–16
- 5
Readiness review
An internal audit of the controls and evidence, so gaps are closed before your client or auditor checks.
Before the audit
- 6
Ongoing compliance
Yearly reviews, a virtual CISO and support when the standard is updated.
Optional
Organisations with ISO 27001 already in place usually move much faster, because many controls overlap.
What you get
- Clear answer on whether and how the UAE IA Standard applies to you
- Gap assessment against all applicable controls
- Risk assessment and list of applicable controls
- Prioritised remediation roadmap (P1 to P4)
- Policy and procedure set aligned to the standard
- Mapping to ISO 27001 and ADHICS where relevant
- Evidence pack for clients and auditors
- Board-level summary of your compliance position
Choose how we work with you
UAE IA gap assessment
2–3 weeksBest for: Knowing exactly where you stand
- · Scope confirmation
- · Gap report by priority
- · Roadmap
Full UAE IA implementation
3–6 monthsBest for: Becoming compliant end to end
- · Risk assessment
- · Policies and technical controls
- · Readiness review
Version 1.1 to version 2 upgrade
6–10 weeksBest for: Already compliant with the old version
- · Delta assessment
- · New v2 controls
- · Updated evidence
Has a federal client asked for NESA compliance in Abu Dhabi?
Tell us what your contract says. A 30-minute call is enough to tell you what applies and what it will take.
UAE IA Standard vs ISO 27001 in Abu Dhabi
Many Abu Dhabi organisations need both. The overlap is large, so one programme can carry most of the work.
| UAE IA Standard | ISO 27001 | |
|---|---|---|
| Who needs it | Federal entities, critical infrastructure and their suppliers | Voluntary; often required by clients and tenders |
| Approach | Prescribed controls, ranked P1 to P4 | Risk-based management system |
| Result | Compliance with the national standard | A certificate from an accredited body |
| Overlap | Large: risk, access, incidents, suppliers, continuity | The same areas, organised differently |
What affects the cost of UAE IA compliance in Abu Dhabi
You get a written scope and a fixed fee after the scoping call. These are the factors that move it:
- Scope
- Whether the whole organisation or only the systems used for a federal client are in scope.
- Size and sites
- The number of staff, sites and systems involved.
- Technical environment
- Legacy systems, several clouds and many sites add work to the technical controls.
- Starting point
- Existing ISO 27001, ADHICS or v1.1 work can be reused.
- Version
- A first implementation or an upgrade from version 1.1.
- Ongoing support
- Whether you need yearly reviews or a virtual CISO afterwards.
Why organisations choose Intello as their NESA consultants in Abu Dhabi
23+
years in UAE cybersecurity
500+
clients served
99%
client satisfaction
Current version, not the old one. We work to version 2 of the UAE IA Standard and help you move from version 1.1.
One programme for several rules. UAE IA mapped to ISO 27001 and ADHICS, so the same controls serve all of them.
Security and compliance together. We test and fix the technical controls, not only write the policies.
On site in Abu Dhabi. Workshops and evidence reviews at your premises.
Frequently asked questions
Is NESA compliance the same as UAE IA compliance?
Yes, in practice. The standard was first issued by NESA, which is now the Signals Intelligence Agency, and is now published by the UAE Cyber Security Council as the UAE Information Assurance Standard. Many contracts and people still call it “NESA compliance”.
What is SIA compliance in Abu Dhabi?
SIA stands for the Signals Intelligence Agency, the new name for NESA. When an Abu Dhabi client asks for “SIA compliance”, they usually mean compliance with the UAE Information Assurance Standard.
Who must comply with the UAE IA Standard?
Federal government entities and organisations designated as critical information infrastructure. In practice, many suppliers to those organisations must comply too, because the requirements are written into their contracts.
What changed in version 2?
Version 2 (2025) replaced the UAE IA Regulation v1.1 from 2020. It has 134 controls in 15 families, ranked P1 to P4, and adds areas such as cloud, IoT, AI and machine learning, threat intelligence, secure development and post-quantum cryptography.
How long does UAE IA compliance take?
A gap assessment takes two to three weeks. Full implementation usually takes three to six months, depending on scope and starting point. Organisations that already hold ISO 27001 are usually faster.
Does ISO 27001 cover the UAE IA Standard?
Not fully, but the overlap is large. An ISO 27001 ISMS gives you most of the management structure, and we add the specific UAE IA controls and evidence. See ISO 27001 in Abu Dhabi.
Do you work on site in Abu Dhabi?
Yes. Gap assessment workshops, evidence reviews and the readiness review are done at your Abu Dhabi premises, with document work done remotely.
Related services
Get NESA compliance in Abu Dhabi right first time
Tell us a little about your organisation and what your clients are asking for. We will set up a free 30-minute gap call.
What happens next
- 1We get in touch to arrange a call
- 2A 30-minute gap call
- 3A written scope, timeline and fixed fee
Prefer to talk now? Call +971 55 355 6787