UAE Information Assurance Standard · formerly NESA
NESA / UAE IA Compliance in Sharjah
Intello helps Sharjah organisations meet the UAE Information Assurance (IA) Standard, still widely known as NESA. We confirm whether it applies to you, assess you against the current version, put the missing controls in place with your team, and prepare the evidence federal clients and auditors ask for.
- Minutes from Sharjah, in Al Qusais
- 500+ clients
- 99% client satisfaction
What is NESA / UAE IA compliance?
The UAE Information Assurance Standard sets the minimum security controls for federal government entities and critical information infrastructure in the UAE. It was first issued by NESA (now the Signals Intelligence Agency) and is now published by the UAE Cyber Security Council. Many people still call it “NESA compliance”.
| Current version | UAE IA Standard version 2 (2025), replacing the UAE IA Regulation v1.1 (2020) |
|---|---|
| Published by | UAE Cyber Security Council. Earlier versions came from NESA and TDRA |
| Applies to | Federal government entities and critical information infrastructure, and often their suppliers through contracts |
| Structure | 134 controls in 15 families: 6 management (M1–M6) and 9 technical (T1–T9) |
| In Sharjah | A federal standard, so it applies the same way in Sharjah as anywhere else in the UAE |
| Where we work | From our office in Al Qusais, a few minutes from Sharjah, and remotely |
Information assurance compliance in Sharjah
In Sharjah, the UAE IA Standard usually arrives through a client. A federal entity or critical-sector operator writes it into a contract, and the supplier has to show it complies.
Hamriyah Free Zone
Oil and gas, petrochemical and maritime suppliers in Hamriyah serving critical energy and port operators.
SAIF Zone
Logistics, aviation-linked and trading companies next to Sharjah Airport whose clients include critical transport operators.
Ports and logistics
Operators and contractors around Sharjah’s ports and logistics hubs, where systems the country depends on are in scope.
Sharjah Industrial Areas
Manufacturers and engineering firms supplying federal projects and critical-sector clients.
IT and managed service providers
Sharjah IT, cloud and support companies that run or access systems for federal and critical-sector clients.
Federal entity offices in Sharjah
Branches and service centres of federal entities, which follow the UAE IA Standard directly.
Also available: NESA / UAE IA in Dubai · NESA / UAE IA in Abu Dhabi · Cyber security company in Sharjah
Does NESA / UAE IA compliance apply to your Sharjah organisation?
It almost certainly does if any of these describe you:
- A federal or critical-sector client has written UAE IA (or NESA, or SIA) requirements into your contract
- You host, run or support systems for a federal government entity
- You have been designated as critical information infrastructure
- You supply energy, port, aviation, telecom, health or finance operators that the country depends on
- You were compliant with UAE IA v1.1 and need to move to version 2
- You hold ISO 27001 and a client now asks for UAE IA as well
Not sure whether you are in scope? Many Sharjah suppliers only find out when a contract or tender arrives. We will read the clause with you in the first call and tell you which controls matter most.
What UAE IA compliance involves for a Sharjah organisation
The standard has two groups of controls. We focus first on the P1 controls, which every in-scope organisation must have.
Management controls (M1–M6)
Strategy and planning, risk management, awareness and training, human resources security, compliance, and performance evaluation.
Technical controls (T1–T9)
Asset management, physical security, operations, communications, access control, third-party security, systems development, incident management and continuity.
Risk assessment
A documented risk assessment that decides which risk-based controls apply to you.
Prioritised implementation
P1 controls first, then P2 to P4, so the most important protections are in place early.
Third-party and supplier security
Requirements for your own suppliers, which matter for Sharjah companies deep in a federal supply chain.
Incident management
Detection, response and reporting of cyber incidents in line with national expectations.
New areas in version 2
Cloud, IoT, AI and machine learning, threat intelligence, secure development and post-quantum cryptography.
Evidence and audit readiness
Policies, records and technical evidence organised so clients and auditors can check compliance quickly.
How we deliver NESA compliance in Sharjah
A fixed sequence, so you always know what happens next.
- 1
Scoping call
We read the contract clause with you, confirm whether the UAE IA Standard applies, and agree which systems and sites are in scope.
Week 0 · free
- 2
Gap assessment
Workshops and an evidence review against all applicable controls, with findings ranked by priority (P1 to P4).
Weeks 1–3
- 3
Risk assessment
A documented risk assessment that confirms which risk-based controls apply.
Weeks 2–4
- 4
Remediation
Policies, procedures and technical controls put in place with your team, P1 controls first.
Weeks 4–16
- 5
Readiness review
An internal audit of the controls and evidence, so gaps are closed before your client or auditor checks.
Before the audit
- 6
Ongoing compliance
Yearly reviews, a virtual CISO and support when the standard is updated.
Optional
Organisations with ISO 27001 already in place usually move much faster, because many controls overlap.
What you get
- Clear answer on whether and how the UAE IA Standard applies to you
- Gap assessment against all applicable controls
- Risk assessment and list of applicable controls
- Prioritised remediation roadmap (P1 to P4)
- Policy and procedure set aligned to the standard
- Mapping to ISO 27001 where you hold it
- Evidence pack for clients and auditors
- Management summary of your compliance position
Choose how we work with you
UAE IA gap assessment
2–3 weeksBest for: Knowing exactly where you stand
- · Scope confirmation
- · Gap report by priority
- · Roadmap
Full UAE IA implementation
3–6 monthsBest for: Becoming compliant end to end
- · Risk assessment
- · Policies and technical controls
- · Readiness review
Version 1.1 to version 2 upgrade
6–10 weeksBest for: Already compliant with the old version
- · Delta assessment
- · New v2 controls
- · Updated evidence
Has a client asked for NESA compliance in Sharjah?
Tell us what your contract says. A 30-minute call is enough to tell you what applies and what it will take.
UAE IA Standard vs ISO 27001 for Sharjah companies
Many Sharjah suppliers are asked for both. The overlap is large, so one programme can carry most of the work.
| UAE IA Standard | ISO 27001 | |
|---|---|---|
| Who needs it | Federal entities, critical infrastructure and their suppliers | Voluntary; often required by clients and tenders |
| Approach | Prescribed controls, ranked P1 to P4 | Risk-based management system |
| Result | Compliance with the national standard | A certificate from an accredited body |
| Overlap | Large: risk, access, incidents, suppliers, continuity | The same areas, organised differently |
What affects the cost of UAE IA compliance in Sharjah
You get a written scope and a fixed fee after the scoping call. These are the factors that move it:
- Scope
- Whether the whole company or only the systems used for a federal or critical-sector client are in scope.
- Size and sites
- The number of staff, offices, plants and warehouses involved.
- Technical environment
- Legacy systems, production networks and several sites add work to the technical controls.
- Starting point
- Existing ISO 27001 or v1.1 work can be reused.
- Version
- A first implementation or an upgrade from version 1.1.
- Ongoing support
- Whether you need yearly reviews or a virtual CISO afterwards.
Why organisations choose Intello as their NESA consultants in Sharjah
23+
years in UAE cybersecurity
500+
clients served
99%
client satisfaction
Current version, not the old one. We work to version 2 of the UAE IA Standard and help you move from version 1.1.
Sized for suppliers. We scope the work to the systems your client cares about, so a mid-sized supplier is not buried in controls.
Security and compliance together. We test and fix the technical controls, not only write the policies.
Close by. Our Al Qusais office is minutes from Sharjah, so it is easy to meet in person for workshops and evidence reviews.
Frequently asked questions
Is NESA compliance the same as UAE IA compliance?
Yes, in practice. The standard was first issued by NESA, which is now the Signals Intelligence Agency, and is now published by the UAE Cyber Security Council as the UAE Information Assurance Standard. Many contracts and people still call it “NESA compliance”.
What is SIA compliance in Sharjah?
SIA stands for the Signals Intelligence Agency, the new name for NESA. When a client asks a Sharjah supplier for “SIA compliance”, they usually mean compliance with the UAE Information Assurance Standard.
Does the UAE IA Standard apply in Sharjah?
Yes. It is a federal standard, so it applies to federal entities and critical information infrastructure wherever they are, including Sharjah. Most Sharjah companies meet it as suppliers, because a federal or critical-sector client has written it into their contract.
What changed in version 2?
Version 2 (2025) replaced the UAE IA Regulation v1.1 from 2020. It has 134 controls in 15 families, ranked P1 to P4, and adds areas such as cloud, IoT, AI and machine learning, threat intelligence, secure development and post-quantum cryptography.
How much does NESA compliance cost in Sharjah?
It depends on scope (the whole company or only the systems used for one client), your size, your technical environment and how much is already in place, such as ISO 27001. We give a fixed fee after a free scoping call, and a gap assessment on its own is a low-cost first step.
How long does UAE IA compliance take?
A gap assessment takes two to three weeks. Full implementation usually takes three to six months, depending on scope and starting point. Organisations that already hold ISO 27001 are usually faster.
Does ISO 27001 cover the UAE IA Standard?
Not fully, but the overlap is large. An ISO 27001 ISMS gives you most of the management structure, and we add the specific UAE IA controls and evidence. See ISO 27001 certification in Sharjah.
Related services
Get NESA compliance in Sharjah right first time
Tell us a little about your company and what your clients are asking for. We will set up a free 30-minute gap call.
What happens next
- 1We get in touch to arrange a call
- 2A 30-minute gap call
- 3A written scope, timeline and fixed fee
Prefer to talk now? Call +971 55 355 6787