Designation decides UAE IA
The UAE Information Assurance standard applies to entities designated under the critical information infrastructure process. A sector on the critical list does not designate every port or shipping line.
Port, maritime and logistics cybersecurity in the UAE: In shipping and ports, a corporate breach can strand cargo within hours.
Attackers use ordinary routes: a phished login, a vendor account, an exposed gateway. At a port or a shipping line, those routes sit close to terminal systems, vessel connections and shared platforms that cargo depends on.
The road to money
Where an ordinary intrusion goes in a port or shipping operator
The first steps look like any other sector. The last three do not.
- A login that works
A phished or reused password on email, a port community platform or a vendor portal.
- A trusted identity
Not only administrators. Planners, customs agents, dispatchers and the integrators who keep remote access to cranes, gates and vessel systems.
- The shared platform
Terminal operating systems, port community systems and the carriers, agents and trucking firms that connect to them.
~30,000containers reported stranded when DP World Australia suspended terminal operations after a cyber incident (local media reports, Australia) - The corporate estate
A destructive attack on office systems can halt a global operation without touching a ship.
45,000PCs reinstalled by Maersk after NotPetya, with about ten days to restore normal operations (Maersk chairman) - A decision to disconnect
Cutting external links contains an incident. It also stops trucks, shippers and customs from exchanging the data that moves cargo.
What the regulator expects
Rules reach shipping through ships, ports and contracts
No single UAE rule sets one cyber audit cycle for every port or shipowner. Duties come from the port or maritime authority, any critical-infrastructure designation, flag and class rules, and customer contracts.
- 2021IMO Resolution MSC.428(98): cyber risk must be addressed in a ship’s safety management system no later than the first annual verification of the company’s Document of Compliance after 1 January 2021.
- 1 July 2024IACS UR E26 and E27, on the cyber resilience of ships and of on-board systems, apply to new ships contracted for construction on and after this date.
- Your contractPorts, charterers and cargo owners set their own incident-notice and audit terms. Read the clause.
Ships answer to flag, class and port
Mandatory cyber risk management for a vessel comes through flag-state, port-state, class or contract rules. The research found no UAE-wide public yearly cyber audit for every vessel or operator.
Platforms are held by contract
Port community systems and maritime technology suppliers meet security, incident-notice and audit terms by contract, unless a rule or designation reaches them directly.
Rules and frameworks behind this page
- IMO Resolution MSC.428(98)Asks that approved safety management systems address cyber risk, no later than the first annual verification of the Document of Compliance after 1 January 2021.
- IACS UR E26 and E27Class requirements for the cyber resilience of ships and on-board systems. They apply to new ships contracted for construction on and after 1 July 2024.
- UAE Critical Information Infrastructure Protection PolicyIdentifies critical national services. Designated entities apply the UAE IA standard.
- UAE Information Assurance Regulation v1.1 (replaced November 2025)Management and technical controls for designated critical entities. The 2020 text linked here was replaced by a November 2025 version; confirm the current text.
- DESC Critical Information Infrastructure identificationDubai’s process for identifying critical services and the entities in DESC ICS scope.
Source: IMO Resolution MSC.428(98); IACS UR E26 and E27 (press release); UAE CIIP policy and UAE IA standard; DESC. This is analysis, not legal advice.
UAE rules, by who you are
Which UAE rule reaches a port, a shipping line or a logistics firm
Port and terminal duties come from the port or maritime authority, any designation, and contracts. Ships add flag, class and port-state rules. Logistics firms follow data law and customer terms.
Port and terminal operators
FederalRegulator ruleThe port and maritime authority requirements that apply to you. UAE IA and CIIP if designated.
If designated critical, apply UAE IA controls. Protect terminal operating systems, cargo and gate systems, port community platforms, OT and remote vendor access. Keep incident response and continuity in line with any directions.
Dubai port and terminal operators
DubaiStandard or policyDubai and federal maritime authority and port requirements. DESC CII and ICS where in scope.
Confirm whether the service is designated CII or within DESC ICS scope. Where it is, manage critical OT, network separation, vendor access and incident response under that framework.
Shipping companies and vessel operators
FederalRegulator ruleFederal maritime law, flag and port requirements, class rules and international maritime obligations. UAE IA if designated.
Confirm whether your ship or operator falls under mandatory maritime cyber risk management through flag-state, port-state, class or contract rules. Protect bridge, engine and communications systems and shore links.
Confirm: The research found no UAE-wide public yearly cyber audit for every vessel or operator.
Shipping, freight and marine service companies in Dubai
DubaiContract termMaritime licensing and port conditions, contracts, and the PDPL where it applies.
Do not assume DESC or UAE IA covers every private maritime company. Assess your licence, port, client and designation requirements. Protect operational systems and sensitive data.
Maritime logistics, freight and port community systems
FederalContract termLicence and port requirements, the PDPL where it applies, and UAE IA if designated.
Protect customs, manifests, cargo, tracking and customer data. Manage identity, third-party integrations, availability and recovery. Tie any test frequency to a rule or contract.
Port community and maritime technology suppliers
DubaiContract termCustomer and port contracts, data protection law and designation-specific controls.
Security, incident reporting and audit rights are often contractual. Check whether you are directly designated or regulated before calling a duty statutory.
Designated critical transport and maritime services
FederalRegulator ruleCIIP Policy and UAE Information Assurance standard.
UAE IA applies to designated entities. Scope and evidence come from the designation and the sector plan.
Rail, fleet and warehouse automation operators
Abu DhabiRegulator ruleThe sector licence and authority rules that apply. UAE IA and CIIP if designated.
For OT, keep an asset inventory, network zones, vendor access control, secure changes, vulnerability risk management and recovery where your risk framework requires it.
RTA and other Dubai government transport entities
DubaiStandard or policyDESC ISR, applicable transport rules, and DESC ICS where in scope. The the DESC security standard for autonomous and connected vehicles applies to government and semi-government entities that plan to use autonomous vehicles.
ISR requires an applicability review of domains and controls. Apply ICS to critical infrastructure and OT. Apply the vehicle standard where the entity and use case are in scope.
Logistics, warehousing and fleet firms
FederalContract termCommercial and licensing requirements, customer contracts, and the PDPL where it applies. DESC only if in scope.
No blanket yearly cyber audit applies to private logistics firms. Protect WMS and TMS, fleet telematics, remote access and customer data. Private status alone does not trigger DESC.
This is analysis, not legal advice. A sector’s presence on a critical-infrastructure list does not make every company in it critical. We state a test or audit frequency only where the binding rule, licence, designation or contract does. Confirm your licence, any designation and the current version of each rule with your counsel.
Beyond the UAE
If you also operate in the US, the UK, India or Australia
UAE rules come first for a UAE business. These are the main rules elsewhere that can reach you through customers, data or offices abroad. Check scope with your own counsel.
United Kingdom
- Network and Information Systems Regulations 2018 (SI 2018/506), water transportLarge shipping companies, harbour authorities, port facility operators and vessel traffic services above set thresholds. Notify the Secretary of State for Transport within 72 hours of an incident.
- Ports and Port Systems Cyber Security Code of PracticePublished by the Department for Transport and the MCA, 2020 version. Practical advice on risk assessment, governance and incident response for port technical systems. The page does not call it mandatory.
India
- CERT-In Directions under section 70B(6), 28 April 2022Service providers, intermediaries, data centers, body corporates and government bodies report listed incidents within 6 hours and keep ICT logs for a rolling 180 days within India.
- DGMA Circular 46 of 2026, cyber risk for ISPS port facilitiesDated 4 August 2026. Port facilities and their vendors are invited to add cyber risk to security assessments and plans. Most wording is advisory; certification and audit are strongly advocated.
Australia
- Security of Critical Infrastructure Act 2018: cyber incident reportingResponsible entities of covered assets, including transport assets such as critical ports, report critical incidents within 12 hours and other reportable incidents within 72 hours of becoming aware.
- Cyber Security Act 2024: ransomware payment reportingBusinesses with annual turnover above A$3 million, and responsible entities for critical infrastructure assets, report a ransomware payment within 72 hours of paying. Active from 30 May 2025.
What changes
What changes for a port or shipping operator
The same security decision gets a different answer once cargo, a vessel and a port authority are in the picture.
Who to protect first
Domain and cloud administrators.
The people and integrators who can change terminal, crane, gate and vessel systems, and the accounts that bridge the office and the quay.
How to rank suppliers
By spend, or by the data they hold.
By the platform each one can stop, and by standing remote access to terminal or vessel systems.
Containing an incident
Isolate the affected hosts.
Decide in advance what a disconnection stops, for how long, and who may order it. Cutting links can strand trucks and customs data.
What recovery means
Restore servers and data from backup.
Rebuild the estate from clean media in an agreed order, and move cargo by a manual fallback while systems are down.
Ship and shore
One network and one set of controls.
Two environments joined by satellite and port links. Remote access, updates and crew devices need their own rules.
First asks
What we are asked first
Map what can be reached
List terminal, crane, gate and vessel systems, every vendor with remote access, and the path each one uses.
Decide the disconnection
For each node, write down what runs offline, what stops, and who may order a disconnect.
Rank shared platforms
Rank the platforms the business cannot work without by how many operations each would stop.
Check scope with your authority
Confirm whether any of your services are designated, and which port, flag or class rules reach you.
First moves
Where we would start with a port or shipping operator
Manage Cyber Risk & Exposure
Name the shared platforms and connected assets the business cannot run without, and who can reach them.
- Crown Jewel Identification
- Cyber Risk Assessments
- Third-Party & Supply-Chain Risk
Protect What Matters
Separate terminal and vessel systems from office IT and put one controlled route in front of all remote access.
- OT/ICS & IoT Security
- Security Architecture
- Identity & Access Security
Detect, Respond & Recover
Rehearse a disconnection and a manual fallback with operations, and test a rebuild of the corporate estate.
- Crisis Management
- Cyber Resilience
- Resilience Testing
Read next
What to read before you talk to us
Industry Brief Industry Brief: Logistics and Transportation Cyber Risk Priorities Five priorities for ports, terminals and hubs, from shared platforms to manual fallback. Cybrilliant Risk Management SME Industry Brief Industry Brief: Critical Infrastructure Cyber Risk Priorities How to rank critical-infrastructure risk by consequence. Cybrilliant Risk Management SME Article Third-Party Risk Beyond the Questionnaire Why a questionnaire does not show what a supplier can reach. Cybrilliant Supply Chain Risk SME Executive Briefing Cyber Resilience: What Happens When Preventive Controls Fail? What recovery looks like when preventive controls fail. Cybrilliant Cyber Resilience SME
Sources and method. This page is analysis, not legal advice.
- IMO, Maritime cyber risk management
- IACS, UR E26 and E27 press release
- UAE Critical Information Infrastructure Protection Policy
- UAE Information Assurance standard
- DESC Critical Information Infrastructure identification
- UAE Legislation portal
- Federal Decree-Law No. 45 of 2021 on Personal Data Protection
- DESC Information Security Regulation and Standards
- DESC Cloud Service Provider / Data Centre / SOC security standards