Skip to content
Emergency helpGet started
Compliance & Governance

What is the UAE Information Assurance Standard (formerly NESA)?

The UAE Cybersecurity Council's IA Standard v2.1 sets 134 controls in 15 families for federal entities and critical infrastructure. Scope and structure.
By VigilbasePublished
Read the guideMore Topics

The UAE Information Assurance (IA) Standard is the UAE Cybersecurity Council's set of management and technical security controls for critical information infrastructure. Version 2.1 was published in November 2025. It applies to ministries and federal authorities, to non-government critical information infrastructure (CII) entities, and to emirate government entities where the emirate has no CIIP program of its own. It has 15 control families and 134 controls, 70 of which are always applicable. Older references, such as Dubai's Cyber Security Strategy, call it the National Electronic Security Authority (NESA) Information Assurance Standard.

Who issues the UAE IA Standard?

The UAE Cybersecurity Council (CSC) developed the current standard and published version 2.1 in November 2025. Annex G maps it to the earlier version 1.1: the UAE Information Assurance Regulation that the Telecommunications and Digital Government Regulatory Authority (TDRA) published in March 2020, which applied to the critical entities it designated under the UAE CIIP Policy.

Who must apply the UAE IA Standard?

Applicability depends on the type of entity and on whether the emirate runs its own critical information infrastructure protection (CIIP) program.
1.Ministries and federal authorities.
2.Non-government critical information infrastructure (CII) entities.
3.Emirate government entities, where the emirate has no CIIP program of its own.
4.Where an emirate CIIP program exists, the emirate lead carries out applicability assessment, enforcement, and monitoring for emirate government entities and non-government CII entities.

How is the UAE IA Standard structured?

Version 2.1 has 15 families, 47 sub-families, 134 controls, and 449 sub-controls, split into management and technical families.
1.Management families: M1 Strategy and Planning, M2 Information Security Risk Management, M3 Awareness and Training, M4 Human Resource Security, M5 Compliance, and M6 Performance Evaluation and Improvement.
2.Technical families: T1 Information Asset Management, T2 Physical and Environmental Security, T3 Operations Management, T4 Network Security, T5 Identity and Access Management, T6 Third-Party Security, T7 Information Systems Acquisition, Development, and Maintenance, T8 Information Security Incident Management, and T9 Information Systems Continuity Management.

Which controls always apply?

Seventy controls are always applicable, and omitting any of them is a non-conformity. The other 64 apply based on the entity's risk assessment, and excluding one needs a justification and evidence that the risk was accepted by accountable persons or authorizing entities. Without a risk assessment, every control is treated as applicable. Controls also carry priorities from P1 to P4 to sequence implementation: all applicable controls are mandatory, entities start with P1, and only P1 priorities cannot be changed by the risk assessment.

How does it align with ISO 27001 and other standards?

The standard aligns with ISO/IEC 27001:2022, ISO/IEC 27002:2022, and ISO/IEC 27005:2022, NIST SP 800-53 Revision 5, CIS Critical Security Controls Version 8, and the Dubai Electronic Security Center's Information Security Regulation version 3. An annex maps each control to ISO 27001 and 27002, NIST SP 800-53, and the ISR.

How is compliance monitored?

The Council reviews entities' compliance self-assessment reports and can perform or commission compliance audits and compliance tests where appropriate. The always-applicable controls and the risk-based controls an entity selects together form the basis of the compliance monitoring scheme.

Where does Vigilbase help with IA Standard evidence?

Logging (T3.2.2) is always applicable: entities must produce, store, protect, and analyze logs of activities, exceptions, faults, and other relevant events, and the monitoring policy defines retention. Incident management (T8) asks for a plan, classification, documentation, and evidence collection. Vigilbase OS connects the security tools you already pay for and keeps their logs and events auditable and queryable in one place, and each investigation records the evidence, action, and verification, which helps you produce evidence for those families. Managed Cloudflare operates WAF and DDoS controls in scope. Default retention is set per dataset, typically 30 to 90 days, so match it to the retention your monitoring policy sets.

About this guide

This guide summarizes version 2.1 of the UAE IA Standard published by the UAE Cybersecurity Council and the TDRA's version 1.1, as available in October 2026. It is not legal advice. Confirm with the Council, your emirate lead, and your compliance owners whether and how the standard applies to your entity.

Key Takeaways

✓The UAE Cybersecurity Council publishes the UAE IA Standard; version 2.1 dates from November 2025.
✓It applies to federal entities, non-government critical information infrastructure, and some emirate government entities.
✓Of its 134 controls, 70 always apply and the rest follow the entity's risk assessment.
✓It aligns with ISO/IEC 27001:2022, NIST SP 800-53, CIS Controls, and Dubai's ISR.

Sources

Related Solutions

Vigilbase services related to this guide

Managed SOC

Learn more

Managed Cloudflare

Learn more

Get started with Vigilbase OS

Learn more

Managed cybersecurity in the UAE

Learn more

Frequently Asked Questions

Is NESA the same as the UAE IA Standard?

The UAE Information Assurance Standard is the current name. Older references, such as Dubai's Cyber Security Strategy, call it the National Electronic Security Authority (NESA) Information Assurance Standard. The UAE Cybersecurity Council now publishes it, at version 2.1.

Who must comply with the UAE IA Standard?

Ministries and federal authorities, non-government critical information infrastructure entities, and emirate government entities where the emirate has no CIIP program. Where an emirate program exists, its lead handles applicability and enforcement.

What is the difference between always-applicable and risk-based controls?

Always-applicable controls must be implemented by any entity claiming compliance; omitting one is a non-conformity. Risk-based controls apply according to the entity's risk assessment, and any exclusion must be justified with evidence that the risk was accepted.

Does the UAE IA Standard map to ISO 27001?

Yes. It aligns with ISO/IEC 27001:2022 and 27002:2022, and an annex maps its controls to those standards, NIST SP 800-53 Revision 5, and Dubai's ISR.

Related Topics

Security Basics

What is SIEM?

Compliance & Governance

ADHICS

Compliance & Governance

UAE PDPL

Compliance & Governance

Dubai ISR

Get Started

Ready to Improve Your Security?

Our team can help you implement the security measures discussed in this guide. Get expert guidance tailored to your organization.
Get started Continue Learning