Skip to content
Emergency helpGet started
Compliance & Governance

What is the Dubai Information Security Regulation (DESC ISR)?

The DESC Information Security Regulation sets minimum security controls for Dubai Government entities and their contractors. Scope, domains and audits.
By VigilbasePublished
Read the guideMore Topics

The Information Security Regulation (ISR) is the Dubai Electronic Security Center's minimum set of information security controls for Dubai Government Entities. It applies to those entities, including their employees and the consultants, contractors, and visitors engaged with them, and to all government information in any form. The ISR is a technology-neutral framework of thirteen domains, and DESC monitors government entities' compliance with it. Dubai's Cyber Security Strategy describes the ISR as mandatory for Dubai's public and semi-public sectors.

Who issued the ISR?

The Dubai Government Information Security Regulation was formalized under Resolution No. 13 of 2012, based on leading information security regulations, frameworks, and practices. Under Dubai Law No. 11 of 2014, the Dubai Electronic Security Center (DESC) maintains and continuously improves it. DESC provides the ISR on request rather than as a public download, and the UAE IA Standard version 2.1 refers to it as version 3.

Who must comply with the ISR?

The ISR applies to all Dubai Government Entities, including employees, consultants, contractors, and visitors who are not government employees but are engaged with them. It covers any government information regardless of type or medium, across all business functions and divisions. Dubai's Cyber Security Strategy recommends that the private sector also apply the ISR or a similar standard, such as ISO/IEC 27001, particularly organizations that are part of critical information infrastructure.

How is the ISR structured?

The ISR is broken down into thirteen domains, each covering one or more classes of information security. Entities must run an applicability review to decide which domains and controls apply to them, and implement a right-fit set based on their risk assessment.
1.Governance domains set high-level requirements for structuring and managing information security.
2.Operation domains are technical and non-technical controls an entity uses depending on its risk assessment.
3.Assurance domains check that the implemented controls work as intended.

How does DESC check ISR compliance?

Among its functions, DESC monitors government entities' compliance with the information security requirements it issues and follows up their implementation. Its strategy describes an auditing function that verifies the standard has been implemented correctly. In January 2026 DESC briefed ISR officers from government and semi-government entities on its ISR Officer Certification Program and demonstrated ASAAS 2.0, its AI-powered auditing engine.

Which DESC standards matter for security providers?

DESC also publishes standards for the providers that serve Dubai government and semi-government entities. Check them before you scope outsourced security work.
1.SOC Security Standard: mandatory for all SOC providers offering SOC services to Dubai government and semi-government entities, for in-house or outsourced SOC provision.
2.Cloud Service Provider (CSP) Security Standard: mandatory for cloud providers offering services to those entities, with certification following the ISO/IEC 27001 scheme, yearly surveillance audits, and recertification every three years.
3.Data Center (DC) Security Standard: requirements and guidance for data centers and the organizations that use them.

Where does Vigilbase help with ISR evidence?

The Assurance domains ask entities to show that controls work as intended. Vigilbase OS connects the security tools you already pay for and keeps their logs and events auditable and queryable in one place, and each investigation records the evidence, the action taken, and the verification result. Managed Cloudflare operates WAF and DDoS controls within the agreed scope, with changes recorded. Because DESC makes its SOC and CSP standards mandatory for providers serving Dubai government and semi-government entities, raise them during scoping and confirm what an engagement can cover before you sign.

About this guide

This guide summarizes what the Dubai Electronic Security Center publishes about the ISR and its related standards, as available in October 2026. It is not legal advice. The ISR text itself is available from DESC on request, and it takes precedence over this summary.

Key Takeaways

✓The ISR sets the minimum information security controls for Dubai Government Entities and the contractors and consultants engaged with them.
✓It has thirteen domains across governance, operation, and assurance, applied through an applicability review.
✓DESC monitors and audits compliance, and its SOC and CSP standards are mandatory for providers serving Dubai government entities.
✓Private organizations, especially critical infrastructure, are encouraged to apply the ISR or a similar standard.

Sources

Related Solutions

Vigilbase services related to this guide

Managed SOC

Learn more

Managed Cloudflare

Learn more

Get started with Vigilbase OS

Learn more

Managed cybersecurity in the UAE

Learn more

Frequently Asked Questions

Who must comply with the Dubai ISR?

All Dubai Government Entities, including their employees and the consultants, contractors, and visitors engaged with them. Dubai's Cyber Security Strategy describes it as mandatory for the public and semi-public sectors and recommends it for private organizations.

Is the ISR the same as the UAE IA Standard?

No. The ISR is Dubai's regulation, maintained by the Dubai Electronic Security Center. The UAE IA Standard is the federal standard published by the UAE Cybersecurity Council, which maps its controls to the ISR.

Where can we get the ISR document?

DESC provides it on request through its standards and policies page rather than as a public download.

Does a managed SOC need DESC approval in Dubai?

DESC's SOC Security Standard is mandatory for all SOC providers offering SOC services to Dubai government and semi-government entities. Check whether it applies to your engagement before you choose a provider.Security operations responsibilitiesEvaluate a managed security provider

Related Topics

Security Basics

What is MSSP?

Security Basics

What is SOC?

Compliance & Governance

UAE PDPL

Compliance & Governance

UAE IA Standard

Compliance & Governance

Choosing an MSSP in the UAE

Get Started

Ready to Improve Your Security?

Our team can help you implement the security measures discussed in this guide. Get expert guidance tailored to your organization.
Get started Continue Learning