UAE Information Assurance (IA) Regulation: What It Is and Who It Applies To

What is the UAE Information Assurance (IA) Regulation?

It is a national set of information security requirements. The official document is titled "UAE Information Assurance Regulation", Version 1.1, March 2020. Its stated purpose is "to provide requirements to raise the minimum level of protection of information assets and supporting systems across all implementing entities in the UAE".

The document says "TRA" developed it as "a critical element of the National Information Assurance Framework (NIAF)". It never spells out "TRA", and it does not say which body administers it today. Section 3.1 calls it "the sole point of reference for compliance against its requirements, as measured by the criteria associated with each of its security controls".

Who must comply with the UAE IA Regulation?

According to the document, government entities and other entities identified as critical by TRA. Section 1.1 says all UAE government entities and other entities identified as critical by TRA are "obligated to implement" the Regulation, while TRA "highly recommends all entities in the UAE to adopt" it "on a voluntary basis, as applicable".

Section 2.1 says TRA will designate the critical entities "as per the UAE CIIP Policy". The Critical Information Infrastructure Protection (CIIP) Policy is described as setting the list of sectors and the process for identifying critical entities. The Regulation does not list them, and it does not mention free zones.

If you are unsure whether your organisation has been designated, ask the relevant authority or take advice. This is general information, not legal advice.

How is the Regulation structured?

Section 1.3 describes seven chapters: introduction, overview, implementation, compliance, security controls, annexes and appendices. The controls sit in two groups:

• Six management families: Strategy and Planning; Information Security Risk Management; Awareness and Training; Human Resources Security; Compliance; Performance Evaluation and Improvement.
• Nine technical families: Asset Management; Physical and Environmental Security; Operations Management; Communications; Access Control; Third-Party Security; Information Systems Acquisition, Development and Maintenance; Information Security Incident Management; Information Systems Continuity Management.

How does the risk-based approach decide which controls apply?

Each entity runs a risk assessment and selects controls from the results. Section 3.2 describes eight activities: establishing the environment, risk identification, estimation, evaluation, treatment, acceptance, monitoring and review, and communication and consultation.

Before the assessment, all controls are considered applicable. An entity may exclude some on the basis of the outcome, "provided that adequate justification is submitted to TRA". "Always Applicable" controls must be implemented regardless. Without an entity risk assessment, all controls are deemed applicable and mandatory (section 3.3).

Controls fall into four priority levels. Critical entities implementing the Regulation are required to begin with P1 controls, and a P1 control, if applicable, "may be augmented but never reduced" (section 3.4).

How is compliance measured?

Chapter 4 defines compliance as the comparison between the requirements and the actual state of implementation, measured control by control and overall. The compliance monitoring scheme it describes is based on four elements: controls, sub-controls, performance indicators, and information on automation, threats and vulnerabilities, and implementation guidance (the last is provided "for information purposes only").

Omitting an "Always Applicable" control "constitutes non-conformity". Other deviations from sub-controls are allowed if justified, with evidence that accountable persons or authorising entities have accepted the risk.

Entities report progress to their sector regulator, or to TRA if there is none. Sector regulators report to TRA. TRA reviews self-assessment reports and may "perform or commission compliance audits" and tests. Chapter 4 does not mention certification, and the document does not use the word "penalty".

Which standards is the Regulation based on?

Section 1.1 lists ISO/IEC 27001:2005, 27002:2005, 27005:2005, 27010:2012 and 27032:2012, NIST SP 800-53 Revision 4, the Abu Dhabi Information Security Standards (Versions 1 and 2) and the SANS 20 Critical Security Controls (Version 4.1). Annex C maps the Regulation's controls against ISO 27001 and 27002, NIST SP 800-53 Revision 4 and the Abu Dhabi (ADSIC) Information Security Standards, versions 1.0 and 2.0.

The ISO/IEC 27001 edition it cites is 2005. The current edition is ISO/IEC 27001:2022; see our ISO 27001 page.

Is Version 1.1 still the current text?

This page cannot confirm that. It describes Version 1.1 (March 2020), the document TDRA's website served on 24 October 2026. This page also cannot confirm whether a newer official edition exists, or which body administers the Regulation now. Check the issuing authority's website before relying on this summary.

Can a GRC platform or advisory service help with a control catalogue like this?

It can help a team organise policies, controls, risks and audit actions in one place, but the duties sit with the implementing entity. Neither a platform nor an adviser makes an organisation compliant.

Purplecop GRC's page describes "75+ frameworks mapped once and reused everywhere" and "One control library. Test a control once, satisfy every framework mapped to it." See Purplecop GRC. Purplecop Security's GRC & Compliance Advisory page describes a "Gap assessment against your target framework, with a prioritised remediation plan" and invites you to "Tell us the obligation you are trying to meet and who is asking for it."

These are general statements. Neither page lists the UAE IA Regulation by name, so confirm with Purplecop Security what it covers before relying on either.

What is the UAE IA Regulation?

The document titled "UAE Information Assurance Regulation", Version 1.1, March 2020, hosted by TDRA. It sets management and technical information security controls for implementing entities in the UAE.

Who must implement the UAE IA Regulation?

According to the document, all UAE government entities and other entities identified as critical by TRA are obligated to implement it. It highly recommends that other UAE entities adopt it voluntarily.

How many control families does it have?

Fifteen: six management families (M1 to M6) and nine technical families (T1 to T9). Controls are also grouped into four priority levels, P1 to P4.

What are "Always Applicable" controls?

Controls that must be implemented whatever the risk assessment says. Omitting any of them constitutes non-conformity. Annex A lists them.

Does the UAE IA Regulation require certification?

Its compliance chapter describes self-assessment reports, audits and testing by TRA. That chapter does not mention certification.

Can Purplecop make my organisation compliant with the UAE IA Regulation?

No product or service can do that on its own, because the Regulation places the duties on the implementing entity. Purplecop's product and service pages do not list the UAE IA Regulation by name.