Qatar's National Information Assurance framework: classification-driven compliance

Qatar's national information assurance approach is built around classification. Rather than a flat control set applied uniformly, obligations follow from how information is classified and how critical the system is — which changes the order in which you have to do the work.

Classification comes first

Before selecting controls you classify information by sensitivity and assess the criticality of the systems handling it. Control requirements then follow from that assessment. The practical consequence is that classification is not a documentation exercise you do afterwards — it is the input that determines everything else.

Organisations that start by implementing controls and classify later routinely find they have over-protected low-sensitivity systems while under-protecting the ones that mattered, and have to redo the analysis.

Who is in scope

• Government agencies and ministries.
• Critical sector organisations — energy, finance, telecoms, transport, health.
• Suppliers and contractors handling government or critical-sector information, through contractual flow-down.

As across the GCC, the private sector most often encounters the requirements through procurement. If you are bidding for Qatari government or energy sector work, the security schedule will carry them.

The control domains

The domains will be familiar: governance and risk management, personnel security, physical security, access control, communications and operations, information handling and exchange, incident management, business continuity, and third-party and outsourcing security. The distinguishing feature is not the domains but the way applicability is derived from classification and criticality.

What suppliers should expect

• Classification obligations flowing to you — you may be required to handle client information according to their classification scheme, not yours.
• Personnel screening for staff with access, evidenced.
• Incident notification with contractual timelines, often shorter than any general legal requirement.
• Restrictions on offshore access and processing, including support teams in other countries.
• Right to audit or to provide assurance reports.
• Flow-down to your own subcontractors.

Alongside data protection

Qatar also has personal data privacy legislation operating alongside the assurance framework. The two address different things — one protects information assets generally, the other protects individuals' personal data — and both can apply to the same system. Treat them as separate obligations mapped to one control set rather than assuming one covers the other.

Where to start

Classify first, then assess criticality, then derive the applicable controls, then gap assess. If you hold ISO 27001, much of the control substance will already exist — the work is the classification analysis and the jurisdiction-specific obligations.

Key takeaways

• Classification drives control applicability — do it first, not last.
• Suppliers inherit classification handling obligations, not just controls.
• Assurance and privacy obligations are separate and can both apply.
• Offshore access restrictions can reshape your support model.