Cyber security compliance in the UAE

Which cybersecurity frameworks apply in the UAE?

It depends on three things: whether you are federal or emirate government, which sector you are in, and whether you sit in a financial free zone. Federal government and critical sectors work to the UAE Information Assurance Standard and the Critical Information Infrastructure Protection Policy. Dubai Government Entities add DESC's Information Security Regulation. Abu Dhabi health entities work to ADHICS. Financial institutions answer to the Central Bank onshore, the DFSA in the DIFC or the FSRA in ADGM.

There is no single federal cybersecurity law. The main cyber statute is Federal Decree-Law 34/2021 on countering rumours and cybercrimes, which is a criminal law rather than a control framework.

Is NESA still the right name?

Only as shorthand. The Information Assurance Standard began life under NESA, and many pages still quote its first edition. The standard is now published by the UAE Cybersecurity Council, which the Cabinet approved in 2020, and version 2 is current. If a vendor page describes the v1 structure as current, treat the rest of its detail with care.

What changed for UAE financial institutions in 2026?

Two things. The Central Bank's Operational Risk Management Regulation, C 1/2026, took effect on 14 September 2026 for all licensed financial institutions. Article 8 covers ICT and cybersecurity management, and the regulation repeals Circular 163/2018 and the 2018 operational risk standards, so policies that still cite Circular 163/2018 need updating.

In ADGM, the FSRA's Cyber Risk Management Framework, issued in July 2025, has required compliance since 31 January 2026. Separately, the Securities and Commodities Authority became the Capital Market Authority from 1 January 2026.

What does DESC's ISR v3 require?

DESC launched version 3.0 of its Information Security Regulation in April 2024, alongside policies for cloud service providers, security operations centres, telecoms and IoT. The ISR is mandatory for Dubai Government Entities and is issued to them on request rather than published openly.

Where does the PDPL stand?

Federal Decree-Law 45/2021 has been in effect since 2 January 2022, but its Executive Regulations have not been published: the official UAE legislation portal listed none as of September 2026. Treat claims that they have been issued with caution. The DIFC and ADGM run their own data protection regimes, both in force and both amended since 2024.

How GRCLens runs UAE frameworks together

Federal, emirate, sector and free zone obligations sit on one shared control model in GRCLens, so a group that includes a Dubai Government Entity, an ADGM-regulated subsidiary and onshore health data can see one control, its evidence and its status against every regime that needs it. The interface and reports run in English and Arabic, and the platform can be hosted inside the UAE or fully on-premises.

Where a regulator runs its own submission portal, such as the Council's National Information Assurance Platform, GRCLens is where the evidence behind the submission is kept and maintained.

Official portals and publications

• UAE Cybersecurity Council
• DESC standards and policies