Dubai has built one of the region's most structured approaches to information security governance. For entities serving the Dubai government, and the companies that supply them, the Dubai Electronic Security Center's Information Security Regulation (ISR) is the reference point.
The role of DESC
DESC was established to protect Dubai's information assets and elevate the emirate's cyber resilience. Its ISR sets information security controls that Dubai government bodies are expected to adopt, with assurance activities to confirm compliance.
Suppliers and partners frequently inherit these expectations contractually, making ISR-awareness a commercial requirement, not just a public-sector one.
Aligning with national standards
At the federal level, the UAE Information Assurance Standards provide a national baseline for entities linked to critical information infrastructure. Dubai's regulation operates within that broader context, so well-run programs treat the two as complementary layers.
The practical implication: a control library that maps both ISR and UAE IA lets a Dubai entity report once and satisfy multiple stakeholders.
Governance first
As with KSA's ECC, the emphasis is on governance: clear ownership, documented policies, risk management, and oversight of third parties. Technology controls follow from that structure rather than substituting for it.
Entities should validate current ISR requirements with DESC, as versions and scope are periodically updated.
Keep reading
ISO 22000 certification in 2026: what a food safety management system has to show, site by site
ISO 22000:2018 certification is won or lost at the plant, not at head office. What the standard requires, how the HACCP plan and prerequisite programmes fit, which food laws apply in Australia, New Zealand, the Pacific, Southeast Asia, the Gulf and South Asia, and how to run one FSMS across many sites without a major nonconformity.
GRC Platform Requirements for Regulated Entities: A Buyer's Checklist
A GRC platform holds your risk register, control weaknesses and incident records, and your regulator may treat its vendor as material. What to require from the product, the contract and the hosting before you sign.
Post-Quantum TLS in 2026: How to Test, Evidence and Govern Hybrid Key Exchange
Most browsers already offer post-quantum key exchange. Whether your connections actually use it depends on servers, load balancers and suppliers you control. How to test it, fix it and prove it to an auditor.