The UAE's information assurance requirements follow a familiar shape for anyone who has worked with the Saudi ECC: a national control catalogue, mandatory for government and critical sectors, and flowing into the private sector through procurement. The structure differs in the detail, and the detail is where programmes get caught.
Who it applies to
- Government entities at federal and emirate level.
- Critical national infrastructure operators — energy, water, finance, health, transport, telecoms.
- Suppliers and service providers to those organisations, contractually rather than directly.
As in Saudi Arabia, most private companies encounter the requirements through a contract or a tender qualification rather than through regulation aimed at them. If you are pursuing UAE government or critical-sector work, assume the requirements will arrive and prepare before the qualification questionnaire does.
How it is structured
The standard organises controls into management controls — governance, risk, compliance, human resources — and technical controls covering asset management, access control, operations, communications, acquisition and development, incident management and continuity. Controls carry priority levels, so implementation is sequenced rather than all-at-once, and applicability depends on your sector and criticality.
The priority tiering matters commercially: it means a first-pass programme targeting the highest-priority controls is a legitimate, recognised position rather than partial compliance — provided you can evidence where you are and where you are going.
Assess against regional and international frameworks together
GRC Copilot maps one control set across UAE, Saudi and international requirements, so a second jurisdiction is a delta rather than a new programme.
Try GRC Copilot free Generate an AI-powered assessment Download checklist Book a demo
Relationship to ISO 27001
The overlap with ISO 27001 is substantial — governance, risk assessment, access control, operations security and incident management all correspond closely. An ISO-certified organisation typically finds the management controls largely satisfied and concentrates on the jurisdiction-specific requirements.
What does not transfer: the sector-specific applicability rules, data residency expectations, and reporting obligations to the national authority. A certificate is a strong foundation and not a substitute.
Emirate-level requirements sit on top
The UAE has federal requirements and emirate-level ones. Organisations operating in Dubai frequently face Dubai-specific information security regulation in addition to federal expectations, and Abu Dhabi has its own arrangements for government and critical entities.
Practical consequence: establish which authorities bind you before scoping. Assuming a single national requirement is the most common planning error for companies entering the UAE market.
Where to start
- Confirm your sector classification and which authorities apply.
- Read the security schedules in existing UAE contracts.
- Establish data residency expectations early — they are architectural.
- Gap assess against the applicable control set, prioritised by the standard's own tiers.
- Map to any international certification you hold, and close only the genuine delta.
Frequently asked questions
Does this apply to private companies?
Directly to government and critical infrastructure; to most private companies through contracts with those entities. Check your agreements before assuming you are out of scope.
Is ISO 27001 enough?
It covers much of the substance and is widely respected, but it does not discharge a national or contractual obligation with its own control catalogue and reporting duties.
How does it compare with the Saudi ECC?
Similar intent and heavy control overlap; different structure, applicability rules and authorities. Organisations operating in both should run one control set mapped to each.
What about data residency?
Expectations vary by sector and data type and can extend to backups and support access. Confirm before designing infrastructure — it is expensive to retrofit.
Key takeaways
- Government and critical infrastructure directly; private companies via contracts.
- Federal and emirate-level requirements can both apply — check before scoping.
- Priority tiering makes a sequenced programme a legitimate position.
- ISO 27001 is a foundation, not a substitute.