Governance and Policy ManagementISR V3.0 in Dubai: What DESC Expects Government Entities to Prove
Dubai ISR V3 compliance becomes difficult when organizations treat the regulation as a library of controls rather than an operating security programme.
The Dubai Electronic Security Center’s Information Security Regulation Version 3.0 sets the minimum information security requirements for Dubai Government Entities. DESC describes it as a technology-neutral framework intended to protect the confidentiality, integrity and availability of government information while reducing the likelihood and impact of security incidents.
The regulation is structured across 13 domains, covering governance, asset management, cyber risk, incident management, access control, operations, business continuity, system development, physical security, human resources, compliance, assurance and cloud security.
Complyan has previously examined how Dubai ISR V3.0 changed the security requirements placed on government entities. The more useful question for teams responsible for compliance now is how to translate those requirements into controls, evidence and accountable actions that remain defensible when DESC or an auditor asks to see them.
ISR V3.0 Within DESC's Wider Package
The Dubai Electronic Security Center included ISR Version 3.0 highlights in the package of projects and policies it announced at GISEC Global on 23 April 2024, according to Digital Dubai. It was announced alongside several related pieces:
How the Six Functions Apply to AI
Component | What DESC says it does |
ISR Version 3.0 | Sets minimum information security controls, in a technology-neutral framework, for all Dubai Government Entities |
Cloud Security Policy | Defines requirements for cloud providers, certification bodies, and cloud consumers, with a certification program for providers serving government, semi-government, and critical information infrastructure entities |
SOC Security Policy | Sets requirements for SOC providers serving the same entity types, plus minimum requirements for SOC consumers |
ASAAS | Provides information on compliance and maturity of applied regulations, and accelerates the audit process |
Telecommunication Security Standard | Sets a baseline for telecom providers, including no storage or processing of critical entity information outside the UAE |
IoT Security Standard 2.0 | Updates the 2018 standard with extended controls |
Two connections matter for implementation. First, the cloud and SOC policies give government entities a certified route for outsourced services, which is likely where the expectation of DESC-certified providers in Complyan’s earlier guide becomes practical. Second, DESC describes ASAAS as an accelerator for audits. That is an implication to plan around, not a stated requirement: evidence organized by regulation and maturity will move through that process faster than evidence assembled on request.
What Changed From V2, in Evidence Terms
Complyan’s earlier guide describes the version 3 shift as moving from open-ended to prescriptive. Each expectation below produces something an assessor can ask to see.
ISR V3.0 expectation | Typical evidence |
A living asset register with owners and custodians, and classification that drives access, retention, and disposal | Register with named owners, change history, and classification-linked access rules |
A documented risk methodology, updated periodically and approved by senior management or the steering committee | Methodology document, update log, and signed approvals |
Minimum policy review cycles with executive involvement | Review dates, reviewer sign-offs, and executive minutes |
Training for all staff and signed acknowledgements | Completion records and signed acknowledgements for all staff |
Information Security Champions at division level | Appointment letters and a record of what each champion did |
Independent, qualified internal audit | Auditor qualifications, independence statement, and audit reports |
Contracts with data protection and resilience clauses | Executed contracts and third-party risk assessments |
The right column is practical guidance, not a quotation from the regulation. The assessor’s own checklist governs.
Cloud Security Is Now a Defined ISR Domain
Cloud security has its own domain within ISR V3.
That matters because cloud compliance cannot be demonstrated by showing that a provider holds certifications.
The government entity still needs to account for its own configurations, identities, information classification and operating controls.
DESC has also developed separate Cloud Service Provider security policies and certification requirements for providers serving Dubai government, semi-government and critical information infrastructure entities. Digital Dubai reported in 2024 that the updated cloud policy was designed to clarify responsibilities for CSPs, certification bodies and cloud consumers.
The compliance programme therefore needs to distinguish provider assurance from the controls the entity remains responsible for operating.
Zero Trust and Synthetic Data
Version 3 added language on Zero Trust architecture and synthetic data protection, per Complyan’s earlier guide. Zero Trust shifts access decisions from network location to continuous verification of each request. The synthetic data language acknowledges AI and machine learning use, which in practice means safeguards for training data, model security, and validation of AI-generated output wherever an entity builds or deploys such systems.
Where to Look for Gaps Before an Assessor Does
Static registers: an asset register updated before each audit rather than when assets change cannot show a living process. Compare change history against procurement and cloud account records.
Reviews without executives: a policy with a review date but no executive record meets the letter of a review cycle, not the expectation of leadership involvement.
Champions on paper: an appointment letter proves a role exists. Meeting notes, issues raised, and training delivered show it works.
Supplier contracts that predate version 3: older agreements often lack the data protection and resilience clauses the regulation now expects. List which contracts have been amended and which have not.
Outsourced services without certification checks: where cloud or SOC services are outsourced, confirm each provider’s DESC certification status and record the check.
Building the Evidence Base With Complyan
Policy cycles and acknowledgements: Complyan’s governance and policy management tools track review dates, approvers, and staff acknowledgements in one place.
Risk methodology and approvals: Complyan’s cyber risk management platform holds the documented methodology, scored risks, and the approvals that make results defensible.
Supplier assurance: Complyan’s third-party risk management tools keep assessments, contract clauses, and certification checks attached to each supplier.
Audit evidence: Complyan’s audit and compliance management platform maps evidence to controls, so a request for a record is a lookup, not a search.
Leadership reporting: Complyan’s executive and board reporting gives senior management a current view of control status, which supports the involvement ISR V3.0 expects.
Public sector context: Complyan’s public sector solutions are built around government entity requirements, and Complyan’s DESC compliance guide covers the thirteen domains in full.
Conclusion: ISR V3 Compliance Has to Be Traceable
Dubai ISR V3 gives organizations detailed security requirements, but the framework also makes something else clear: controls need context.
The organization should be able to show why a control applies, which risk it addresses, who owns it and what current evidence proves that it is working.
That traceability is what turns an ISR checklist into a functioning compliance programme.
Complyan provides a single GRC environment for Dubai ISR controls, risk management, third-party oversight, evidence and cross-framework mapping. Its framework library includes Dubai ISR alongside other GCC and international standards, allowing teams to manage common controls without rebuilding the compliance record for every assessment.
For organizations preparing for their next DESC review, the useful question is no longer simply whether a control has been marked complete. It is whether the organization can prove why that status is correct.
Frequently Asked Questions
What is ISR V3.0?
It is the Dubai Government Information Security Regulation. Digital Dubai describes it as setting key practices and minimum, technology-neutral information security controls for all Dubai Government Entities.
Who does it apply to?
Dubai Government Entities are its core scope. Complyan’s DESC compliance guide describes a wider reach, including semi-government bodies, critical infrastructure operators, and organizations handling government data. Confirm your own status against your contract or with DESC.
What changed from version 2?
Per Complyan’s earlier guide, version 3 is more prescriptive: a living asset register, a documented and approved risk methodology, minimum policy review cycles with executive involvement, staff acknowledgements, and Information Security Champions at division level.
Does ISR V3.0 cover Zero Trust and AI?
Complyan’s earlier guide reports new language on Zero Trust architecture and synthetic data protection, which covers safeguards for AI training data, models, and outputs.
Does it require DESC-certified providers?
Complyan’s earlier guide describes an expectation that security-related services come from DESC-certified providers. DESC’s Cloud Security Policy and SOC Security Policy, per Digital Dubai, set the certification routes for cloud and SOC providers. Check the exact requirement in your contract.
What is ASAAS?
Digital Dubai describes it as a DESC project that provides information on compliance and maturity of applied regulations and accelerates the audit process.
How can an entity keep evidence audit-ready?
Map each control to a named owner and a current record. Complyan’s audit and compliance management platform holds that mapping, so a request for a record is a lookup.