Across the Gulf Cooperation Council, cybersecurity has moved from an IT concern to a board-level governance obligation. Saudi Arabia and the United Arab Emirates have led that shift with mature, mandatory frameworks. For organizations operating regionally, understanding how these regimes fit together is the first step toward an efficient compliance program.
Saudi Arabia: the NCA and SAMA
In the Kingdom, the National Cybersecurity Authority (NCA) is the primary regulator. Its Essential Cybersecurity Controls (ECC) establish a baseline across governance, defense, resilience, and third-party security for government entities, critical national infrastructure, and their service providers.
Financial institutions additionally fall under the Saudi Central Bank (SAMA) Cyber Security Framework, while personal data is governed by the Personal Data Protection Law (PDPL), administered by SDAIA. Most regulated organizations therefore manage several overlapping obligations at once.
The UAE: federal standards and emirate-level rules
The UAE combines federal direction with emirate-specific regulation. The UAE Information Assurance (IA) Standards, historically associated with NESA, define national controls for entities supporting critical information infrastructure.
At the emirate level, the Dubai Electronic Security Center (DESC) issues the Information Security Regulation (ISR) for Dubai government bodies and their partners. Data protection is addressed by the UAE federal data protection law, with specialised regimes in financial free zones such as the DIFC and ADGM.
What they share
Despite different authorities, these frameworks rhyme. Each expects documented governance, risk-based controls, asset and identity management, incident readiness, and oversight of third parties and cloud providers. Evidence gathered for one framework very often satisfies another.
That overlap is the opportunity: organizations that map controls once, then track them in a single system, avoid duplicating effort every audit cycle.
Keep reading
Meet GRCLens at the G[P]RC Summit Africa 2026 in Johannesburg
We are growing: in the same week as Kuala Lumpur, GRCLens and Security Solution Consultants are exhibiting at the G[P]RC Summit Africa in Johannesburg on 10 and 11 November 2026.
Meet GRCLens at the PCI SSC 2026 Asia-Pacific Community Meeting in Kuala Lumpur
GRCLens and Security Solution Consultants are exhibiting at the PCI SSC 2026 Asia-Pacific Community Meeting Vendor Showcase in Kuala Lumpur on 11 and 12 November 2026.
From incident to crisis: how ISO/IEC 27035, ISO 22320 and ISO 22361 work together
Incident handling, incident command and crisis leadership are usually run by three teams with three plans. Read together, ISO/IEC 27035, ISO 22320 and ISO 22361 describe one escalation, and the hand-offs between them are where most crises go wrong.