UAE Information Assurance Standard v2 · formerly NESA
UAE IA and NESA Compliance Services
We help government entities, critical infrastructure operators and their suppliers meet the UAE Information Assurance (IA) Standard, the national security standard first issued by NESA. We assess you against the 134 controls of version 2, close the gaps, and prepare the evidence your regulator will review.
Based in Abu Dhabi? See our NESA compliance in Abu Dhabi.
Based in Dubai? See our NESA compliance in Dubai.
Based in Sharjah? See our NESA compliance in Sharjah.
Based in Abu Dhabi? See our cyber security services in Abu Dhabi.
- 23+ years in UAE cybersecurity
- 500+ clients
- 99% client satisfaction
What is the UAE IA Standard?
The UAE Information Assurance (IA) Standard is the UAE’s national information security standard for government entities and critical information infrastructure. Originally issued by the National Electronic Security Authority (NESA), it is now published by the UAE Cyber Security Council. Version 2, released in 2025, sets 134 management and technical controls.
| Current version | UAE IA Standard v2 (2025), replacing the UAE IA Regulation v1.1 (2020) |
|---|---|
| Published by | UAE Cyber Security Council. Earlier versions came from NESA (now the Signals Intelligence Agency) and TDRA |
| Applies to | Federal government entities and organisations designated as critical information infrastructure. Sector regulators and government buyers often require it too |
| Structure | 134 controls in 15 families: 6 management (M1–M6) and 9 technical (T1–T9) |
| Prioritisation | Controls are ranked P1 to P4, and tagged as always applicable or based on risk |
| New in v2 | AI and machine learning, IoT, cloud, threat intelligence, secure development and post-quantum cryptography |
| Related rules | DESC Information Security Regulation (Dubai Government), ADHICS (Abu Dhabi healthcare), CBUAE requirements (banks) |
Does the UAE IA Standard apply to you?
You will almost certainly need to meet it if any of these describe you:
- You are a federal ministry, authority or government-owned entity
- You operate critical infrastructure such as energy, water, telecoms, transport, health or finance
- A regulator or government client has asked you for UAE IA or NESA compliance evidence
- You supply IT, cloud, managed security or software services to government or critical entities
- You are bidding for a government or semi-government tender that lists the standard
Dubai Government entities also follow the DESC Information Security Regulation, Abu Dhabi healthcare follows ADHICS, and banks follow CBUAE rules. The controls overlap heavily, so we map them once and build one programme.
What UAE IA compliance involves
The 15 control families fall into eight areas of work. Controls marked “always applicable” must be in place; the rest depend on your risk assessment.
Governance and strategy (M1)
An information security strategy, defined roles and senior accountability. Version 2 puts more weight on executive risk decisions and oversight.
Risk management (M2)
A documented method to identify, assess and treat information security risk, in line with the national cyber risk management framework.
People and awareness (M3, M4)
Security awareness and role-based training, plus security checks across the employee lifecycle.
Compliance and improvement (M5, M6)
Internal audits, compliance monitoring, security metrics and a cycle of continuous improvement.
Assets, facilities and operations (T1–T3)
Asset inventory and classification, physical security, and secure day-to-day operations such as patching, logging and malware protection.
Networks, access and third parties (T4–T6)
Network security, identity and access control, and security requirements for suppliers and cloud providers.
Secure development and new technology (T7)
Security built into system acquisition and development, with new v2 expectations for AI, IoT and cloud.
Incidents and continuity (T8, T9)
Incident detection, response and reporting, and continuity of critical services when something goes wrong.
How we get you UAE IA compliant
A fixed sequence, so you always know what happens next and what you will have at the end of each stage.
- 1
Scoping call
We confirm whether you are in scope, which regulator or client will assess you, and which version of the standard they expect.
Week 0 · free
- 2
Scope and asset definition
We agree the critical services, information assets, locations and systems in scope, so the programme covers what matters and nothing more.
Weeks 1–2
- 3
Gap assessment
Interviews, evidence review and technical checks against all 134 controls. Each gap is rated by its P1–P4 priority and its risk to you.
Weeks 2–5
- 4
Risk assessment and applicability
A risk assessment that decides which risk-based controls apply, recorded in a statement of applicability your assessor can follow.
Weeks 4–6
- 5
Remediation
Policies, procedures and technical controls, with P1 controls first. We can implement the technical side as well as the documentation.
Months 2–5
- 6
Internal audit and readiness
A mock assessment against the standard and a complete evidence pack before your regulator or client reviews you.
Final 3–4 weeks
Organisations starting from scratch typically take 4 to 6 months. With ISO 27001 already in place, 2 to 3 months is common.
What you get
- Scope statement and register of critical information assets
- Gap assessment against all 134 controls, rated by priority
- Risk assessment and treatment plan
- Statement of applicability for risk-based controls
- Information security policy and procedure set aligned to the standard
- Prioritised remediation roadmap with owners and dates
- Control mapping between the UAE IA Standard and ISO 27001
- Security metrics for management review
- Internal audit report and evidence pack
- Board-level summary of your compliance position
Choose how we work with you
UAE IA gap assessment
4–6 weeksBest for: Knowing exactly where you stand
- · Scope and asset register
- · Gap report against 134 controls
- · Remediation roadmap
Full UAE IA implementation
3–6 monthsBest for: Getting compliant end to end
- · Everything in the gap assessment
- · Policies, controls and evidence
- · Internal audit and readiness
Version 1.1 to v2 upgrade
4–8 weeksBest for: Already compliant with the 2020 regulation
- · Delta assessment
- · New v2 controls and policies
- · Updated evidence pack
Not sure which version you will be assessed against?
A 30-minute call is enough to confirm whether the standard applies, which version your assessor expects and how far you are from it.
UAE IA Standard v2 vs the v1.1 regulation
If you complied with the 2020 regulation, most of your work carries over. These are the main changes.
| Topic | v1.1 regulation (2020) | v2 standard (2025) |
|---|---|---|
| Published by | TDRA, based on the original NESA standard | UAE Cyber Security Council |
| Number of controls | 188 | 134, with more detailed sub-controls |
| Control families | 6 management, 9 technical | Same 15 families, reorganised |
| New topics | Not covered | AI and machine learning, IoT, threat intelligence, secure development, post-quantum cryptography |
| National policies | Not included | Linked to national policies on encryption, cloud, third parties, remote work, data exchange, AI and IoT |
| Priorities | P1 to P4 | P1 to P4 retained |
What affects cost and timeline
You get a written scope and quote after the scoping call. These are the factors that move it:
- Services in scope
- The number of critical services, systems and locations that must meet the standard.
- Existing certifications
- ISO 27001 or a previous v1.1 programme can be reused, which shortens the project.
- Technology environment
- Operational technology, legacy systems and multiple clouds need more technical work.
- Third parties
- The number of suppliers and cloud providers that must meet your security requirements.
- Who implements
- Advisory only, or advisory plus our engineers implementing the technical controls.
- Assessment deadline
- A fixed regulator or tender date may need a larger team working in parallel.
Why organisations choose Intello for UAE IA
23+
years in UAE cybersecurity
500+
clients served
99%
client satisfaction
Policy and engineering under one roof. Our team implements the technical controls, such as logging, access management and testing, not only the documents.
One programme for many frameworks. UAE IA, ISO 27001, ADHICS, CBUAE and DESC requirements are mapped once, so you do not repeat work.
Dubai-based team. We work on site with your teams across the UAE.
Version 2 ready. Your programme is built on the 2025 standard, including its new AI, cloud and IoT expectations.
Frequently asked questions
Is NESA compliance still required?
Yes, under a different name. NESA is now the Signals Intelligence Agency, and the standard it created is published today by the UAE Cyber Security Council as the UAE Information Assurance (IA) Standard. Many regulators, tenders and contracts still call it “NESA compliance”; they mean the same standard.
Who must comply with the UAE IA Standard?
Federal government entities and organisations designated as critical information infrastructure must comply. In practice, sector regulators and government clients also require it from banks, healthcare providers, telecom operators and suppliers of IT and security services. Other organisations are encouraged to adopt it voluntarily.
What changed in version 2 of the UAE IA Standard?
Version 2, released in 2025, replaces the 2020 regulation. It reduces the controls from 188 to 134 with more detailed sub-controls, keeps the 15 management and technical families and the P1 to P4 priorities, and adds coverage for AI, IoT, cloud, threat intelligence, secure development and post-quantum cryptography.
Is there an official NESA or UAE IA certificate?
Not in the way ISO 27001 works. Compliance is assessed by your regulator, or by the government client that requires it, usually through self-assessment, evidence review and audit. Confirm the assessment method with your regulator early; we prepare the evidence to match it.
Does ISO 27001 certification cover the UAE IA Standard?
Partly. The two overlap heavily, so an ISO 27001 programme gives you a strong head start. The UAE IA Standard adds its own controls, priorities and national policy requirements, so a gap assessment against the UAE standard is still needed.
How long does UAE IA compliance take?
A gap assessment takes 4 to 6 weeks. Full implementation usually takes 4 to 6 months from a low starting point, or 2 to 3 months if you already hold ISO 27001.
Does the UAE IA Standard apply to private companies?
Only by designation or by contract. A private company falls in scope if it is designated as critical infrastructure, if its sector regulator adopts the standard, or if a government client writes it into a contract or tender.
How does the UAE IA Standard relate to the DESC ISR and ADHICS?
They are separate rules for specific groups: the DESC Information Security Regulation for Dubai Government entities, and ADHICS for Abu Dhabi healthcare. Their controls overlap with the UAE IA Standard, so organisations covered by more than one can run a single, mapped programme.
Related services
Get a clear view of your UAE IA position
Tell us a little about your organisation and we will set up a free 30-minute readiness check.
What happens next
- 1We reply within one business day
- 2A 30-minute call to scope your UAE IA requirements
- 3A written scope, timeline and quote
Prefer to talk now? Call +971 55 355 6787
Last reviewed: October 2026. This page is general guidance, not legal advice.
Sources: UAE Information Assurance Regulation (u.ae, the UAE Government portal)