Governance and Policy ManagementNESA Compliance in the UAE: What the UAE IA Standards Require in Practice
For UAE organizations responsible for government information or critical systems, cybersecurity compliance has to be provable. It is not enough to have security policies, a risk register or technical controls in place. Teams need to show which requirements apply, who owns them, what risks they address and what evidence proves they are working.
That is where NESA compliance, more precisely addressed today through the UAE Information Assurance Regulation, becomes important. The framework sets management and technical requirements for protecting information and the systems that process it, with mandatory application across relevant government entities and organizations identified as critical.
NESA no longer exists under that name, yet tenders, auditors, and security questionnaires across the UAE still ask for NESA compliance. CybersecurityMEA notes that RFPs and auditors use “NESA,” “SIA,” and “UAE IA” to mean the same control set. Complyan’s UAE Information Assurance Regulation guide covers the regulation’s background. This piece covers how the control set is built, who it reaches, and what an assessor can ask to see.
One Control Set, Three Names
The National Electronic Security Authority was restructured and renamed the Signals Intelligence Agency, per HLB HAMT and ManageEngine. ImmuniWeb describes the UAE IA Regulation as delivered through the Telecommunications and Digital Government Regulatory Authority (TDRA) and overseen by the SIA, and Magnus Gulf adds that national coordination now sits with the UAE Cyber Security Council, created by Cabinet decision in 2020. The control set underneath all three names is the UAE Information Assurance Standards.
How the Standards Are Built
Element | Detail |
Controls | 188 in total: 60 management and 128 technical |
Priorities | P1 has 39 controls, P2 has 69, P3 has 35, and P4 has 45 |
Always applicable | 35 management controls; no technical control is always applicable |
Mandatory sub-controls | 136 across those 35 controls, per PACMap |
P1 intent | Designed to address roughly 80 percent of identified threats, per PACMap and iConnect IT |
The counts come from Dionach’s breakdown of the standards unless noted. Two rules shape every program. P2 to P4 priorities can change based on risk assessment, but P1 controls can only be augmented, never reduced, per Dionach and SecurityWall. Technical controls apply or not depending on the risk assessment, so the scoping decision itself becomes evidence.
Who Is in Scope
Gerab System Solutions describes scope as every UAE government and semi-government entity plus organizations classified as critical information infrastructure operators. Paramount’s reading of the regulation adds that the competent authority designates the critical entities required to implement the controls. Other organizations often meet NESA through a customer contract or tender instead. iConnect IT notes they apply controls according to the standards’ risk model.
Overlap is common. A Dubai government entity also answers to the DESC Information Security Regulation, and Complyan’s DESC compliance guide covers that regime. Telecom operators meet NESA next to TDRA rules, and Complyan’s telecoms solution lists NESA among the frameworks it maps.
What an Assessor Asks to See
Dionach’s breakdown gives control counts per family. The evidence examples are practical guidance, not quotations from the standards.
Risk management (M2, 11 controls): a documented methodology, a current risk register, and recorded treatment decisions with approvals.
Asset management (T1, 10 controls): an inventory with named owners and classification, updated as assets change.
Operations management (T3, 17 controls): operating records such as malware protection coverage, backups, and monitoring logs.
Patch management (T5): patch status measured against a documented timeline for critical fixes, a gap SecurityWall flags when no such timeline exists.
Incident management (T8, 13 controls): an incident register, a response plan, and records that the plan was tested.
Continuity (T9, 4 controls): recovery plans and results from tests that show recovery works.
A P1 Readiness Check in Four Steps
This is practical guidance for testing a program before an assessor does.
List the 39 P1 controls with an owner each: a control without a named owner has no one accountable for its evidence.
Attach current evidence and a date: a record from two years ago shows a control existed once, not that it works now.
Ask a non-owner to retrieve one record per family: if the answer takes more than a day, the evidence lives in people’s heads, not in a system.
Write down every applicability decision: for each technical control marked not applicable, record the risk-based reason and who approved it.
Where Programs Stall
NESA run as a separate project: CybersecurityMEA reports that the IA control set overlaps with ISO 27001, so entities with a working ISMS reach compliance faster. Running the two separately repeats the same evidence collection.
Quiet downgrading of P1: the P1 set is the floor. A control that looks inconvenient is documented and fixed, not reprioritized.
Applicability left unrecorded: because no technical control is always applicable, a skipped control needs a written risk-based reason, or it looks like a gap.
Suppliers outside the program: Atlant Security notes the standards emphasize supplier risk, so an assessor can ask for evidence on critical suppliers, not only internal systems.
Evidence rebuilt for each audit: records assembled the week before an assessment cannot show controls working through the year.
Building the Program With Complyan
Map controls once: Complyan’s cybersecurity compliance tools let one control and its evidence count toward NESA, ISO 27001, and any other framework it overlaps.
Hold the risk record: Complyan’s cyber risk management platform keeps the methodology, register, and approvals together, which covers the M2 family.
Assign policy owners: Complyan’s governance and policy management tools record owners, review dates, and staff acknowledgements.
Cover suppliers: Complyan’s third-party risk management keeps supplier assessments current after onboarding.
Keep evidence ready: Complyan’s audit and compliance management platform maps records to controls, so an assessor’s request becomes a lookup.
Conclusion
NESA compliance in the UAE comes down to one control set with several names: 188 controls, a fixed P1 floor, and applicability decisions that need written reasons. Organizations that map it once alongside their other frameworks, and keep risk, asset, incident, and supplier records current, can answer an assessor with evidence on the day it is asked for.