UAE Information Assurance Regulation assessment
The UAE Information Assurance Regulation, widely known by its former name, the NESA standards, sets management and technical controls for government entities and critical sectors in the UAE. Entities in Dubai may also answer to the Dubai Information Security Regulation. We assess against whichever applies to you, and map one to the other where both do.
Who it is for
- UAE government entities and critical sector organizations.
- Suppliers to UAE government entities.
- Dubai entities subject to the Dubai Information Security Regulation.
What we assess
- Management control families: strategy, governance, risk management, awareness, third parties and compliance.
- Technical control families: asset management, physical and environmental security, operations, communications, access control, systems acquisition, incident management and continuity.
- Control priorities, so the most important gaps are closed first.
- Physical and environmental controls, tested on site.
What you receive
- A control register with evidence and remediation steps.
- A mapping between the UAE IA Regulation and the Dubai ISR where both apply.
- A prioritized remediation plan with price ranges.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically three to six weeks, depending on entity size.
Common questions
Is this the same as the NESA standards?
Yes. The UAE IA Regulation is the current name for what was published as the NESA standards. Many contracts still use the older name.
Do you certify compliance?
No. We assess readiness and give you the evidence and register to work from. We are not a regulator and issue no certificate.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
UAE IA assessment
We reply within one business day.
Nothing you send is shared outside Calibre.