Dubai has built one of the region's most structured approaches to information security governance. For entities serving the Dubai government, and the companies that supply them, the Dubai Electronic Security Center's Information Security Regulation (ISR) is the reference point.
The role of DESC
DESC was established to protect Dubai's information assets and elevate the emirate's cyber resilience. Its ISR sets information security controls that Dubai government bodies are expected to adopt, with assurance activities to confirm compliance.
Suppliers and partners frequently inherit these expectations contractually, making ISR-awareness a commercial requirement, not just a public-sector one.
Aligning with national standards
At the federal level, the UAE Information Assurance Standards provide a national baseline for entities linked to critical information infrastructure. Dubai's regulation operates within that broader context, so well-run programs treat the two as complementary layers.
The practical implication: a control library that maps both ISR and UAE IA lets a Dubai entity report once and satisfy multiple stakeholders.
Governance first
As with KSA's ECC, the emphasis is on governance: clear ownership, documented policies, risk management, and oversight of third parties. Technology controls follow from that structure rather than substituting for it.
Entities should validate current ISR requirements with DESC, as versions and scope are periodically updated.
Keep reading
Meet GRCLens at the G[P]RC Summit Africa 2026 in Johannesburg
We are growing: in the same week as Kuala Lumpur, GRCLens and Security Solution Consultants are exhibiting at the G[P]RC Summit Africa in Johannesburg on 10 and 11 November 2026.
Meet GRCLens at the PCI SSC 2026 Asia-Pacific Community Meeting in Kuala Lumpur
GRCLens and Security Solution Consultants are exhibiting at the PCI SSC 2026 Asia-Pacific Community Meeting Vendor Showcase in Kuala Lumpur on 11 and 12 November 2026.
From incident to crisis: how ISO/IEC 27035, ISO 22320 and ISO 22361 work together
Incident handling, incident command and crisis leadership are usually run by three teams with three plans. Read together, ISO/IEC 27035, ISO 22320 and ISO 22361 describe one escalation, and the hand-offs between them are where most crises go wrong.