Dubai Information Security Regulation (ISR) v3 — DESC compliance software
Assess and evidence Dubai's Information Security Regulation v3 — including its cloud, data residency, IoT and supply-chain provisions.
What Dubai DESC ISR requires
The Information Security Regulation is issued by the Dubai Electronic Security Center and defines the controls every Dubai Government entity, semi-government body and their key suppliers must implement to protect the confidentiality, integrity and availability of information.
Version 3 strengthened the regulation in the areas where Dubai's digital estate has changed fastest: cloud services, IoT and operational technology, supply-chain security, asset classification, incident-response readiness and governance accountability. It also tightened data residency expectations, restricting where critical information may be stored and processed. The regulation aligns with ISO/IEC 27001 and NIST CSF, so entities already running those benefit from shared evidence.
Compliance is assessed by DESC, and suppliers to Dubai Government entities are routinely required to demonstrate ISR alignment as a condition of contract — which makes maintained, evidenced assessment a commercial necessity as much as a regulatory one.
Who it applies to
- Dubai Government entities and semi-government bodies
- Contractors and service providers to Dubai Government entities
- Operators of Dubai smart-city, IoT and OT environments
- Organisations required to evidence ISR alignment in tenders
At a glance
- Regulator: Dubai Electronic Security Center (DESC)
- Current version: ISR v3
- Coverage: Governance, risk, assets, HR, physical, operations, network, IAM, cloud, third party, IoT/OT, incident, continuity
- v3 emphasis: Cloud & data residency, IoT/OT, supply chain, incident readiness
How GRCLens supports Dubai DESC ISR
Dubai DESC ISR runs on the same shared control model as every other framework in GRCLens, so evidence captured once can satisfy several obligations at the same time.
Full ISR v3 domain catalogue
All thirteen security domains pre-loaded as assessable controls with guidance and expected deliverables, including the v3 cloud, IoT/OT and supply-chain additions.
Data residency evidence
Record data location per cloud service, provider residency attestations and approved exceptions — the evidence the residency provisions demand.
Control owners and accountability
Assign each control to a named owner with status, comments and dated evidence, so the programme holds between DESC assessments.
Connector-validated evidence
Validation pulled from vulnerability management, identity, SIEM, cloud posture and ITSM systems, suggested against ISR controls for human confirmation.
Assurance workflow
Gaps become owned register items tracked through remediation and verification, with DESC notification obligations captured as controls in their own right.
Bilingual operation
Full Arabic and English operation with right-to-left layout for Dubai entities.
Dubai DESC ISR frequently asked questions
Who must comply with DESC ISR?
All Dubai Government entities and semi-government bodies, and their contractors and service providers where contracts require it. Suppliers are frequently asked to evidence ISR alignment during procurement.
What changed in ISR v3?
Version 3 strengthened cloud security and data residency, IoT and OT security, supply-chain requirements, asset classification, incident-response readiness and governance accountability, with closer alignment to ISO/IEC 27001 and NIST CSF.
Does GRCLens handle the data residency requirement?
Yes. Cloud services are recorded with their data location, provider residency attestations and any approved exceptions, evidenced against the specific residency controls.
Can ISR run alongside ISO 27001 and UAE IA?
Yes. All three share the platform's control model, so overlapping evidence — access reviews, vulnerability management, incident procedures — is captured once and reused.
One platform, many obligations
Talk to us about Dubai DESC ISR
Security Solution Consultants provides Dubai ISR readiness and advisory alongside the platform, so you can combine tooling with hands-on expertise.
Contact us