UAE Information Assurance Standard · formerly NESA
NESA / UAE IA Compliance in Dubai
Intello helps Dubai organisations meet the UAE Information Assurance (IA) Standard, still widely known as NESA. We confirm whether it applies to you, assess you against the current version, put the missing controls in place with your team, and prepare the evidence federal clients and auditors ask for.
- Dubai-based team since 2003
- 500+ clients
- 99% client satisfaction
What is NESA / UAE IA compliance?
The UAE Information Assurance Standard sets the minimum security controls for federal government entities and critical information infrastructure in the UAE. It was first issued by NESA (now the Signals Intelligence Agency) and is now published by the UAE Cyber Security Council. Many people in Dubai still call it “NESA compliance”.
| Current version | UAE IA Standard version 2 (2025), replacing the UAE IA Regulation v1.1 (2020) |
|---|---|
| Published by | UAE Cyber Security Council. Earlier versions came from NESA and TDRA |
| Applies to | Federal government entities and critical information infrastructure, and often their suppliers through contracts |
| Structure | 134 controls in 15 families: 6 management (M1–M6) and 9 technical (T1–T9) |
| Dubai Government entities | Follow the Dubai Electronic Security Center’s Information Security Regulation (ISR), a separate standard |
| Where we work | From our Dubai office in Al Qusais, on site anywhere in Dubai and remotely |
Information assurance compliance in Dubai
Most federal ministries sit in Abu Dhabi, but many of the companies that supply them are in Dubai. For them, the UAE IA Standard usually arrives in a contract, not a law.
Dubai Internet City and Silicon Oasis
IT, software, cloud and managed service providers whose federal and critical-sector clients pass UAE IA requirements down through contracts.
Aviation, ports and logistics
Operators and suppliers around Dubai’s airports, ports and Jebel Ali Free Zone, where systems the country depends on are in scope.
Energy and utilities suppliers
Engineering, maintenance and technology contractors serving critical energy and utility operators.
Banks and finance
Financial institutions in Dubai that work to Central Bank rules and supply critical financial services. See CBUAE compliance.
Telecoms and data centres
Carriers, hosting and data-centre providers whose infrastructure supports federal services.
Federal entity offices in Dubai
Branches and service centres of federal entities, which follow the UAE IA Standard directly.
Also available: NESA / UAE IA in Abu Dhabi · NESA / UAE IA in Sharjah · UAE IA compliance across the UAE
Does NESA / UAE IA compliance apply to your Dubai organisation?
It almost certainly does if any of these describe you:
- A federal or critical-sector client has written UAE IA (or NESA, or SIA) requirements into your contract
- You host, run or support systems for a federal government entity
- You have been designated as critical information infrastructure
- You run aviation, port, energy, telecom, health or finance systems that the country depends on
- You were compliant with UAE IA v1.1 and need to move to version 2
- You hold ISO 27001 and a client now asks for UAE IA as well
Working for a Dubai Government entity rather than a federal one? Your client will usually ask for the Dubai Electronic Security Center’s Information Security Regulation instead. Read your contract first; we will help you confirm which standard it names in the first call.
What UAE IA compliance involves for a Dubai organisation
The standard has two groups of controls. We focus first on the P1 controls, which every in-scope organisation must have.
Management controls (M1–M6)
Strategy and planning, risk management, awareness and training, human resources security, compliance, and performance evaluation.
Technical controls (T1–T9)
Asset management, physical security, operations, communications, access control, third-party security, systems development, incident management and continuity.
Risk assessment
A documented risk assessment that decides which risk-based controls apply to you. This is what clients often call an SIA risk assessment.
Prioritised implementation
P1 controls first, then P2 to P4, so the most important protections are in place early.
Third-party and supplier security
Requirements for your own suppliers, which matter for Dubai companies deep in a federal supply chain.
Incident management
Detection, response and reporting of cyber incidents in line with national expectations.
New areas in version 2
Cloud, IoT, AI and machine learning, threat intelligence, secure development and post-quantum cryptography.
Evidence and audit readiness
Policies, records and technical evidence organised so clients and auditors can check compliance quickly.
How we deliver NESA compliance in Dubai
A fixed sequence, so you always know what happens next.
- 1
Scoping call
We read the contract clause with you, confirm whether the UAE IA Standard applies, and agree which systems and sites are in scope.
Week 0 · free
- 2
Gap assessment
Workshops at your Dubai office and an evidence review against all applicable controls, with findings ranked by priority (P1 to P4).
Weeks 1–3
- 3
Risk assessment
A documented risk assessment that confirms which risk-based controls apply.
Weeks 2–4
- 4
Remediation
Policies, procedures and technical controls put in place with your team, P1 controls first.
Weeks 4–16
- 5
Readiness review
An internal audit of the controls and evidence, so gaps are closed before your client or auditor checks.
Before the audit
- 6
Ongoing compliance
Yearly reviews, a virtual CISO and support when the standard is updated.
Optional
Organisations with ISO 27001 already in place usually move much faster, because many controls overlap.
What you get
- Clear answer on whether and how the UAE IA Standard applies to you
- Gap assessment against all applicable controls
- Risk assessment and list of applicable controls
- Prioritised remediation roadmap (P1 to P4)
- Policy and procedure set aligned to the standard
- Mapping to ISO 27001 where you hold it
- Evidence pack for clients and auditors
- Management summary of your compliance position
Choose how we work with you
UAE IA gap assessment
2–3 weeksBest for: Knowing exactly where you stand
- · Scope confirmation
- · Gap report by priority
- · Roadmap
Full UAE IA implementation
3–6 monthsBest for: Becoming compliant end to end
- · Risk assessment
- · Policies and technical controls
- · Readiness review
Version 1.1 to version 2 upgrade
6–10 weeksBest for: Already compliant with the old version
- · Delta assessment
- · New v2 controls
- · Updated evidence
Has a federal client asked for NESA compliance in Dubai?
Tell us what your contract says. A 30-minute call is enough to tell you what applies and what it will take.
UAE IA Standard, DESC ISR and ISO 27001 in Dubai
Dubai organisations can meet three different security standards. Which one you need depends on who your client is.
| UAE IA Standard | DESC ISR | ISO 27001 | |
|---|---|---|---|
| Issued by | UAE Cyber Security Council (formerly NESA) | Dubai Electronic Security Center | International Organization for Standardization |
| Who needs it | Federal entities, critical infrastructure and their suppliers | Dubai Government entities and their suppliers | Voluntary; often required by clients and tenders |
| Approach | Prescribed controls, ranked P1 to P4 | Prescribed controls for Dubai Government information | Risk-based management system |
| Result | Compliance with the national standard | Compliance with the Dubai regulation | A certificate from an accredited body |
What affects the cost of NESA compliance in Dubai
You get a written scope and a fixed fee after the scoping call. These are the factors that move it:
- Scope
- Whether the whole organisation or only the systems used for a federal client are in scope.
- Size and sites
- The number of staff, offices and systems involved.
- Technical environment
- Legacy systems, several clouds and many sites add work to the technical controls.
- Starting point
- Existing ISO 27001 or v1.1 work can be reused.
- Version
- A first implementation or an upgrade from version 1.1.
- Ongoing support
- Whether you need yearly reviews or a virtual CISO afterwards.
Why organisations choose Intello as their NESA consultants in Dubai
23+
years in UAE cybersecurity
500+
clients served
99%
client satisfaction
Current version, not the old one. We work to version 2 of the UAE IA Standard and help you move from version 1.1.
One programme for several rules. UAE IA mapped to ISO 27001, so the same controls serve both.
Security and compliance together. We test and fix the technical controls, not only write the policies.
Based in Dubai. Our team works from Al Qusais, with workshops and evidence reviews at your Dubai office.
Frequently asked questions
Is NESA compliance the same as UAE IA compliance?
Yes, in practice. The standard was first issued by NESA, which is now the Signals Intelligence Agency, and is now published by the UAE Cyber Security Council as the UAE Information Assurance Standard. Many contracts in Dubai still call it “NESA compliance”.
What is an SIA risk assessment in Dubai?
SIA stands for the Signals Intelligence Agency, the new name for NESA, so SIA compliance in Dubai means the same as UAE IA compliance. When a client asks a Dubai supplier for an “SIA risk assessment”, they usually mean the documented risk assessment the UAE IA Standard requires, which decides which risk-based controls apply. It is the first step of our gap assessment.
How much does NESA compliance cost in Dubai?
It depends on scope (the whole company or only the systems used for a federal client), your size, your technical environment and how much is already in place, such as ISO 27001. We give a fixed fee after a free scoping call, and a gap assessment on its own is a low-cost first step.
Does the UAE IA Standard apply to Dubai Government suppliers?
Not usually. Dubai Government entities follow the Dubai Electronic Security Center’s Information Security Regulation (ISR), and pass those requirements to their suppliers. The UAE IA Standard applies to federal entities, critical infrastructure and their suppliers, wherever they are based.
What changed in version 2?
Version 2 (2025) replaced the UAE IA Regulation v1.1 from 2020. It has 134 controls in 15 families, ranked P1 to P4, and adds areas such as cloud, IoT, AI and machine learning, threat intelligence, secure development and post-quantum cryptography.
How long does UAE IA compliance take?
A gap assessment takes two to three weeks. Full implementation usually takes three to six months, depending on scope and starting point. Organisations that already hold ISO 27001 are usually faster.
Does ISO 27001 cover the UAE IA Standard?
Not fully, but the overlap is large. An ISO 27001 ISMS gives you most of the management structure, and we add the specific UAE IA controls and evidence. See ISO 27001 certification in Dubai.
Related services
Get NESA compliance in Dubai right first time
Tell us a little about your organisation and what your clients are asking for. We will set up a free 30-minute gap call.
What happens next
- 1We get in touch to arrange a call
- 2A 30-minute gap call
- 3A written scope, timeline and fixed fee
Prefer to talk now? Call +971 55 355 6787