Citizens cannot go elsewhere when a service fails, and state-linked actors take an interest in government data. The first steps of an intrusion look familiar, but they end at shared platforms, population records and a rulebook that differs by emirate.
What the rules say about time, and what they do not. Pick a rulebook.
No set clock
The personal data law excludes government data and governmental entities, so its breach notice (Arts. 2 and 9) sets no clock for them.
1 week
In an emergency, Dubai’s security center must report the measures it takes to the public prosecution within one week (Law 11 of 2014, Art. 15(2)). That is the center’s duty, not yours.
In your rulebook
Reporting terms sit in the rules for your entity, such as the ISR for Dubai. Find the exact terms, a named owner and the channel before you need them.
Phishing, a stolen password, or an unpatched system that faces the internet.
40%of Public Administration breaches began with exploitation of a vulnerability (Verizon 2026 DBIR, Public Sector snapshot)Not only domain administrators. Contractors and administrators who work across several entities, and the help desk that can reset them.
Citizen-service platforms, shared services and the suppliers behind them, where one compromise can reach many entities.
36%of Public Administration breaches involved a third party (Verizon 2026 DBIR, Public Sector snapshot)Population records, security-relevant data and policy papers. The aim may be to read quietly, not to demand a ransom.
Work out which of the ISR, the UAE IA standard and the emirate standards apply to each entity, and what each asks for.
List citizen-facing services, trace what each depends on and agree how long each can be down.
Review legacy systems and give each an owner, compensating controls and an end date.
Review privileged access for contractors and for staff who reach platforms shared by several entities.
The UAE Cybersecurity Council sets national direction. The binding rules sit with the emirate or with a federal designation, so the first job is to find out which ones apply to you.
The Information Security Regulation applies to all Dubai government entities, including staff, consultants and contractors. Entities must follow the rules DESC issues and give it the information it needs (Dubai Law 11 of 2014, Art. 12).
The Department of Government Enablement, which replaced the Abu Dhabi Digital Authority, enforces government-wide cybersecurity standards. It runs a 24/7 Government Security Operations Centre that responds to incidents across entities.
Entities formally designated as critical under the UAE CIIP Policy must apply the UAE Information Assurance standard. The personal data law excludes government data and governmental entities (Art. 2).
Applies to all Dubai government entities, their staff and contractors. Formalized by Resolution No. 13 of 2012 and maintained by DESC under Dubai Law No. 11 of 2014.
Read the sourceSets minimum security controls for information assets. Entities formally designated as critical under the UAE CIIP Policy must implement it. A November 2025 version replaced Regulation v1.1; confirm the current text.
Read the sourceThe Department of Government Enablement, which replaced the Abu Dhabi Digital Authority, enforces them and runs a 24/7 Government Security Operations Centre.
Read the sourceExcludes government data and governmental entities that control or process personal data (Art. 2). Check whether your body or supplier counts as governmental.
Read the sourceSource: Dubai Electronic Security Center, ISR and Dubai Law No. 11 of 2014; UAE Cyber Security Council, UAE Information Assurance standard; Abu Dhabi Department of Government Enablement; Federal Decree-Law No. 45 of 2021. This is analysis, not legal advice.
UAE rules, by who you are
Government security is set by the emirate or federal authority that owns the entity. In Dubai that is DESC. UAE IA applies only to designated entities. Contractors meet the contract, not the full government standard, unless brought into scope.
Standard or policyDESC Information Security Regulation (ISR) and applicable DESC policies and standards.
DESC states ISR sets minimum controls for all Dubai Government Entities and requires an applicability review of domains and controls. It covers governance, operation and assurance, and applies to government information in any medium.
Confirm: The public summary sets no single yearly penetration-test cycle for every control.
Standard or policyDESC ICS Standard, DESC CII identification and ISR where applicable. The DESC IoT Standard may also apply; confirm its status with DESC.
Apply the ICS standard to your critical infrastructure and ICS/OT. Other DESC standards depend on the use case.
Standard or policyDESC CSP Security Standard and DESC SOC Security Standard.
DESC states CSP standard compliance is mandatory for cloud providers who want to serve Dubai government and semi-government entities. The SOC standard is mandatory for SOC providers who want to do the same. The certification process includes surveillance and recertification conditions.
Standard or policyThe Abu Dhabi government cybersecurity policies and directions that apply to your entity, with data classification policies. UAE IA and CIIP if designated.
Confirm your emirate baseline and entity directives. Then apply governance, asset and data classification, access control, secure operations, monitoring, incident response, continuity and assurance evidence to that framework.
Standard or policyGovernment security and cloud directions and the contract. PDPL where it applies. UAE IA if designated.
Check cloud and supplier risk, identity, data location and transfer, access, logging, resilience, and exit and portability from the binding standard and contract.
Standard or policyThe federal government security policies that apply to you. UAE IA if designated. CIIP for designated critical services.
Find your binding federal framework and any classification and assurance duties. UAE IA is mandatory for entities designated under CIIP. It is not a blanket duty for every private contractor.
Regulator ruleCIIP Policy and the current UAE Information Assurance standard.
CIIP identifies critical national services, assesses risk and sets sector plans. Designated entities implement UAE IA across the information, systems and processes in scope and show compliance.
Contract termContract flow-downs, the PDPL where it applies, and UAE IA only if directly designated.
Contractors that handle government information or systems may carry contractual controls. Do not assume every supplier meets the full government standard. Check the contract and any designation.
Regulator ruleCompetent-authority security directions, classification and accreditation rules. UAE IA and CIIP where designated.
There is no single public control list or test frequency for all defence entities. Get the binding baseline and approved assessor conditions from the competent authority before scoping any assessment. Run only authorised, approved test methods. Never run intrusive tests on classified systems without written authorisation.
Confirm: Entity-specific instructions come from the authority, not from public sources.
Contract termContract security schedules, programme classification, licence conditions and customer flow-downs. PDPL where it applies.
Protect controlled information, engineering systems, privileged access and subcontractor chains. Secure CCTV, access control, alarm and dispatch systems. Government ISR does not apply just because you serve government.
This is analysis, not legal advice. A sector’s presence on a critical-infrastructure list does not make every entity in it critical. We state a test or audit frequency only where the binding instrument or contract does. Some government and security directions reach only the entities they cover. Confirm your status, scope and current versions with your counsel and the competent authority.
Of Public Administration breaches involved state-affiliated actors (Verizon 2026 DBIR, Public Sector snapshot)
The same security decision gets a different answer once citizens, shared platforms and several rulebooks are in the picture.
Contractors and administrators with access across entities, and the identities that run citizen-service platforms.
Usual adviceDomain and cloud administrators.
By the citizen service that stops: identity, payments, permits, health. Rank the service first, then trace what it depends on.
Usual adviceBy the data they hold.
On a shared platform, many entities inherit one risk. Agree who may accept it on behalf of the others, and write it down.
Usual adviceThe system owner.
Quiet access can be the goal. Ask what was read and for how long, not only what was taken.
Usual adviceStolen records or a ransom note.
It depends on the emirate and on any critical designation, and the personal data law does not cover government data. Map this before an incident.
Usual adviceOne regulation and one deadline.
UAE rules come first for a UAE business. These are the main rules elsewhere that can reach you through customers, data or offices abroad. Check scope with your own counsel.
Card, privacy, resilience and assurance standards reach a government entity through what it handles and who it serves. Each card says what kind of rule it is and when it applies. This is not a full list. Check scope with your own counsel.
US Federal Risk and Authorization Management Program
You supply cloud services to a US federal agency.
Two routes run side by side: Rev. 5 and the newer 20x. The 20x moderate pilot closed in May 2026. High impact still goes through Rev. 5.
Source: FedRAMPEU Network and Information Security Directive 2
Central government bodies in EU Member States. Regional bodies are covered where the Member State includes them.
Member States had to transpose it by 17 October 2024. In July 2026 the Commission referred four states to the Court of Justice for failing to notify their measures.
Source: European Commission, NIS2 DirectivePayment Card Industry Data Security Standard
Fees, fines and utility bills paid by card.
Version 4.0.1 is current. Version 4.0 retired on 31 December 2024. The newer requirements have applied since 31 March 2025.
Source: PCI Security Standards CouncilEU General Data Protection Regulation
You offer services to people in the EU or monitor them, for example in consular or trade services.
A controller notifies the authority within 72 hours of becoming aware of a breach, unless it is unlikely to risk people’s rights (Art. 33).
Source: EUR-Lex, Regulation (EU) 2016/679AICPA System and Organization Controls 2
Asked of vendors that host or process citizen data.
An auditor’s report on a provider’s controls for security, availability, processing integrity, confidentiality and privacy. No law requires it. Many buyers do.
Source: AICPA, SOC suite of servicesInformation security management systems
A common evidence point in public tenders.
The 2022 edition is current. Certification is the organization’s choice, not a requirement of the standard.
Source: ISO, ISO/IEC 27001Sources and method. This page is analysis, not legal advice.
