UAE Compliance
One ISMS. Federal, emirate, and sector frameworks.
The UAE's cybersecurity landscape spans federal standards (NESA IAS), emirate-level requirements (ADDA, DESC), and sector-specific frameworks (CBUAE). ISO 27001 is the international foundation they all reference. We implement the controls once in your Microsoft 365 environment — then map the evidence to every framework you're measured against.
The UAE cybersecurity framework landscape
Unlike centralised models, the UAE operates a federated approach — federal baseline standards with emirate-level and sector-specific extensions. ISO 27001 certification provides the strongest foundation for compliance across all layers.
The international foundation. All UAE frameworks were built on or reference it.
Federal baseline for all government entities and critical national infrastructure.
UAE's federal personal data protection law. Enforced by the UAE Data Office.
Our ISO 27001 controls cover UAE requirements
of 93 ISO controls map to NESA IAS
of 93 ISO controls map to CBUAE
NESA IAS controls covered via ISO 27001 mapping
Framework details
NESA Information Assurance Standards (IAS v2.0)
The federal cybersecurity baseline, originally issued by NESA and now overseen by the UAE Cybersecurity Council. Explicitly based on ISO/IEC 27001:2013, with more prescriptive requirements tailored to UAE national security priorities.
Policy, roles, risk management, compliance oversight
Asset management, access control, data protection, network and endpoint security
Secure design, cryptography, application security, cloud security
Log management, event monitoring, vulnerability management, penetration testing
Incident response planning, handling, business continuity, disaster recovery
Applies to: All UAE government entities and critical national infrastructure operators
Browse controls by IAS domainAbu Dhabi Digital Authority (ADDA) Standards
ADDA's Cyber Security Policy and supporting standards extend the federal NESA IAS with Abu Dhabi-specific requirements. They provide more detailed implementation guidance tailored to Abu Dhabi government entities and their third-party service providers.
Applies to: All Abu Dhabi government entities, contractors, and partners handling government data
Our Abu Dhabi office ensures direct alignment with ADDA requirements for all local engagements.
CBUAE Cyber Resilience Framework
Mandatory for all CBUAE-regulated financial institutions. Covers governance, cyber operations, threat intelligence, incident management, business continuity, and third-party risk management. Uses a maturity model approach.
Applies to: Banks, insurance companies, payment service providers, and other CBUAE-regulated entities
Assess your compliance across all UAE frameworks
Our free assessment evaluates your Microsoft 365 configuration against ISO 27001 and maps findings to NESA IAS and CBUAE requirements — showing you exactly where you stand across all applicable frameworks.