Attackers use ordinary routes: a stolen remote-access login, an exposed service, a trusted supplier. In an energy operator, those routes sit close to control systems that run pumps, turbines and grids, where safety comes before speed.
One login, five layers down. The line turns amber where the office stops and the plant starts.
Outside the fence
A stolen or reused password for a VPN, a jumphost or a vendor remote-access account.
The office
Not only domain administrators. Control engineers, contractors with vendor access, and the jumphost accounts that bridge the office and the plant.
The boundary
The firewalls, shared servers and remote paths between the business network and the control network.
Control and safety
Control systems, safety systems and historians. The question is whether operators can tell a cyber problem from a process fault.
The plant
Someone must decide whether to isolate the plant network, run by hand or stop. Your sector regulator and designation set who must be told.
Source: Dragos OT Cybersecurity Year in Review (2025 vulnerabilities reviewed).
UAE critical infrastructure rules work by naming the operators they cover. Oil and gas, and electricity and water, are listed sectors. Our reading of the policy text found no fixed reporting hours, so check your license and sector regulator.
The UAE Critical Information Infrastructure Protection Policy covers operators the authority designates. It lists Oil & Gas (upstream, midstream, downstream) and Electricity & Water as critical sectors. Dubai’s DESC lists the same two sectors and is identifying the critical services in each.
A designated operator performs threat and vulnerability assessments for each critical asset it manages. It combines them into one operator risk assessment and submits that to its sector regulator (Policy, section 2.2.2).
The authority can ask for evidence, commission tests, and in extreme cases step in directly. Operators agree a plan with their regulator and report progress against it (Policy, sections 2.3.2 and 2.4.2).
Covers designated operators in listed critical sectors, including oil and gas, and electricity and water. Asks for risk assessments, agreed plans and progress reports.
Read the sourceThe national baseline for protecting information assets. Entities formally designated critical under the CIIP Policy must apply it. A November 2025 version replaced Regulation v1.1; confirm the current text.
Read the sourceThe Dubai Electronic Security Center is identifying critical services in sectors including electricity and water, and oil and gas, and asks those organizations to name them.
Read the sourceSecurity requirements for industrial automation and control systems, with duties for asset owners, integrators and product suppliers.
Read the sourceGuide to securing operational technology while respecting its performance, reliability and safety needs.
Read the sourceSource: UAE Cyber Security Council and the Supreme Council for National Security, Critical Information Infrastructure Protection Policy; Dubai Electronic Security Center. This is analysis, not legal advice.
UAE rules, by who you are
Energy duties come from the sector authority, your licence and any critical-infrastructure designation. Nuclear has its own regulator and its own rule. Contractors meet the operator’s contract, not the operator’s full regime.
Regulator ruleAbu Dhabi energy-sector laws and the Department of Energy (DoE) framework. UAE IA and CIIP if designated.
Confirm your licence and DoE requirements. If designated critical, apply UAE IA controls. For OT/ICS, keep an asset inventory, controlled remote access, segmentation, secure configuration and change control, vulnerability risk management, monitoring, incident response and safe recovery as your control framework requires.
Regulator ruleDoE framework where it applies, federal and emirate laws, operator contract requirements. UAE IA and CIIP if designated.
Apply authority- and designation-specific controls. Separate IT and OT risk. Manage remote vendor access, engineering workstations, safety-critical digital assets, patch risk and backup and recovery.
Confirm: A test or audit frequency needs a binding rule or licence behind it.
Standard or policyThe Dubai sector authority and your licence. DESC ICS and CII if in scope. UAE IA and CIIP if designated.
Work out your regulator and designation. In-scope Dubai government and semi-government entities that run critical infrastructure or ICS must check DESC ICS applicability. Do not apply DESC standards to every private utility supplier.
Standard or policySector licence and authority directions. UAE IA and CIIP if designated. DESC CII and ICS where they apply.
Protect SCADA, control networks, engineering stations and third-party links. Use risk-based vulnerability management and controlled change and remote-access procedures. Frequencies come from the standard and the operator’s directions.
Regulator ruleCIIP Policy and the current UAE Information Assurance standard.
CIIP identifies critical national services and their supporting infrastructure. Designated entities apply UAE IA controls and the sector plan.
Regulator ruleFANR-REG-08 V2, Article 24, with licence conditions and FANR directions.
Keep a Cyber Security Plan covering governance, detection, protection and response. Assess cyber risk before and after facility changes. Train employees, vendors and service providers. Identify the critical digital assets behind nuclear safety, security, safeguards and emergency preparedness. Use defence in depth. Plan response, recovery and continuity of safe operation.
Confirm: Read the full regulation and licence for test intervals. The 24-hour nuclear security event log is not a cyber-incident notice deadline.
Contract termThe licensee’s approved programme and contract requirements.
Access, technical controls and assessment scope follow the licensee’s approved plan. Testing must be authorised and safety-aware. A general technology supplier with no access to nuclear systems has no nuclear control duty without a contract or licence scope.
Contract termContract requirements from licensed operators. UAE IA and CIIP only if independently designated.
Supplier status alone does not put a contractor under the operator’s full regime. Contracts often pass down access, security, incident, evidence and personnel duties.
This is analysis, not legal advice. A sector’s presence on a critical-infrastructure list does not make every company in it critical. We state a test or audit frequency only where the binding rule, licence, designation or contract does. Confirm your licence, any designation and the current version of each rule with your counsel.
The same security decision gets a different answer once a physical process and a safety case are in the picture.
The highest severity score, as fast as possible.
What can reach the process. Many OT fixes wait for a maintenance window, so compensating controls such as segmentation and access limits come first.
Domain and cloud administrators.
Control engineers, vendor remote-access accounts and the jumphosts that bridge office and plant.
By spend, or by the data they hold.
By what they can touch: equipment vendors, integrators and maintenance contractors with remote access to controllers.
As soon as the threat is confirmed.
After operations and safety agree the plant can run safely cut off. Decide who may order it before the night it happens.
Restore the systems from backup.
Restore a safe, known-good process state, with clean engineering files and configurations, and run by hand in the meantime.
Trace every route from business IT, vendors and the internet to the control network, then show which ones are open today.
Run a table-top where the plant network is cut off, with named owners for the decision, the manual operation and the regulator call.
List every contractor and equipment vendor connection to controllers and decide which need approval, monitoring or removal.
Compare current practice with the critical infrastructure policy and IEC 62443, then set owners and evidence.
UAE rules come first for a UAE business. These are the main rules elsewhere that can reach you through customers, data or offices abroad. Check scope with your own counsel.
Card, privacy, resilience and assurance standards reach a energy operator through what it handles and who it serves. Each card says what kind of rule it is and when it applies. This is not a full list. Check scope with your own counsel.
EU Network and Information Security Directive 2
EU electricity, oil, gas, hydrogen and district heating operators.
Member States had to transpose it by 17 October 2024. In July 2026 the Commission referred four states to the Court of Justice for failing to notify their measures.
Source: European Commission, NIS2 DirectiveEU General Data Protection Regulation
You have an EU establishment, or sell to people in the EU.
A controller notifies the authority within 72 hours of becoming aware of a breach, unless it is unlikely to risk people’s rights (Art. 33).
Source: EUR-Lex, Regulation (EU) 2016/679Payment Card Industry Data Security Standard
Fuel retail, fleet cards and customer billing.
Version 4.0.1 is current. Version 4.0 retired on 31 December 2024. The newer requirements have applied since 31 March 2025.
Source: PCI Security Standards CouncilInformation security management systems
A common evidence point for operators and contractors.
The 2022 edition is current. Certification is the organization’s choice, not a requirement of the standard.
Source: ISO, ISO/IEC 27001Sources and method. This page is analysis, not legal advice.
