Attackers use the common routes: a stolen login, an exposed gateway, a supplier with standing access. In an operator, those routes can end at the devices that run the network and at subscriber identity data, under a regulator that licenses the service.
Choose a ring to see what sits there.
Phishing, a call to a shop or help desk, a stolen password, an exposed management port.
Not only domain administrators. Network engineers with access to routers and core systems, and vendor staff with standing remote access.
The systems that configure routers, switches and core functions. Control here changes how the network behaves.
53.5%of EU digital infrastructure incidents in 2025 hit providers of public electronic communications services, the most targeted subsector (ENISA Threat Landscape 2026, EU scope)
Subscriber identity records, signaling and other organizations’ traffic. A long intrusion can sit here unseen.
40.4%of EU digital infrastructure incidents in 2025 were unauthorized access; 50.6% were DDoS (ENISA Threat Landscape 2026, EU scope)
Phishing, a call to a shop or help desk, a stolen password, an exposed management port.
Not only domain administrators. Network engineers with access to routers and core systems, and vendor staff with standing remote access.
The systems that configure routers, switches and core functions. Control here changes how the network behaves.
53.5%of EU digital infrastructure incidents in 2025 hit providers of public electronic communications services, the most targeted subsector (ENISA Threat Landscape 2026, EU scope)Subscriber identity records, signaling and other organizations’ traffic. A long intrusion can sit here unseen.
40.4%of EU digital infrastructure incidents in 2025 were unauthorized access; 50.6% were DDoS (ENISA Threat Landscape 2026, EU scope)The same security decision gets a different answer once the network itself, subscriber identity and a licensing regulator are in the picture.
Domain and cloud administrators.
Network engineers, the systems that push configuration to devices, and vendor accounts with standing access to production network elements.
An operations matter.
A security event. An unplanned change on a network device raises an alert and has an owner.
One directory for every employee.
A separate authentication path for network administration, kept apart from the corporate store, with phishing-resistant MFA.
Restore servers and data from backup.
Rebuild devices from known-good images and configurations over a management path you can trust, in the order the services must return.
By spend, or by the data they hold.
By standing access to production network elements, and by whether the equipment vendor’s own development process has been assessed.
UAE operators answer to the TDRA under the Telecommunications Law, the UAE Information Assurance standard and their license terms. The Telecommunications Law sets no incident clock. The clocks below apply only to operators that provide services in an EU Member State.
The UAE Information Assurance standard sets a minimum level of protection across entities in the UAE. Entities formally designated under the UAE critical information infrastructure policy must implement it.
The Telecommunications Law lets the TDRA set terms for access to and use of subscriber information (Art. 14). It penalizes disclosing call content (Art. 72) and unauthorized access to a telecom network (Art. 72 bis). The Personal Data Protection Law asks for security measures (Art. 20).
The TDRA registers telecom suppliers and approves telecom equipment. GSMA NESAS adds a voluntary check of vendor development and product security. It is not an official certification and does not prove an absence of backdoors.
Source: UAE TDRA, Federal Decree-Law 3 of 2003 and the UAE Information Assurance standard; GSMA; EU NIS2 Directive. This is analysis, not legal advice.
UAE rules, by who you are
Telecom duties come from the licence and TDRA directions. They are not in one cyber standard. Dubai location alone does not add a separate audit cycle.
Regulator ruleFederal Decree-Law No. 3 of 2003, as amended, with TDRA licences and directions. UAE IA and CIIP if designated.
Operate under the licence. Meet its security, network and service continuity and incident duties. If designated critical, apply the UAE IA standard across in-scope systems and processes.
Confirm: The public sources reviewed show no single yearly penetration-test cycle for every operator. Read your licence.
Regulator ruleTelecom law and TDRA licensing, spectrum and equipment authorisations. CIIP and UAE IA if designated.
Apply licence-specific security and resilience directions. Protect network management, gateways, subscriber systems and privileged access.
Regulator ruleThe national TDRA framework. DESC requirements only where your entity or service is in DESC scope.
Meet TDRA licence conditions. DESC ISR is for Dubai Government Entities. DESC ICS and CII apply to in-scope entities and services, not to every private telecom vendor.
Regulator ruleTDRA or other licensing rules for your activity. CIIP designation or DESC CII where it applies.
Secure operational technology, network management and physical access under your licence or designation. Check any Dubai critical-service direction with DESC.
Regulator ruleCIIP Policy and the current UAE Information Assurance standard.
The regulation applies to entities designated through the national process. Controls cover information, systems and processes that handle information. It does not bind every company in the sector.
Contract termContracts. UAE IA and CIIP only if designated. PDPL where personal data is in scope.
A supplier is not bound by all telecom duties just because it serves an operator. Contracts often require evidence, incident notice, continuity, access limits and audits.
Contract termEquipment approvals, customer contracts and any CII direction. PDPL where relevant.
Equipment type approval does not replace a security program. Supplier duties come from product and telecom rules, contracts and any CII direction.
Binding lawFederal Decree-Law No. 45 of 2021 (PDPL), subject to scope and exclusions.
Where it applies, keep technical and organisational security, protect processing systems, enable recovery and test whether the measures work.
This is analysis, not legal advice. A sector’s presence on a critical-infrastructure list does not make every company in it critical. We state a test or audit frequency only where the binding rule, licence, designation or contract does. Confirm your licence, any designation and the current version of each rule with your counsel.
UAE rules come first for a UAE business. These are the main rules elsewhere that can reach you through customers, data or offices abroad. Check scope with your own counsel.
Card, privacy, resilience and assurance standards reach a telecom operator through what it handles and who it serves. Each card says what kind of rule it is and when it applies. This is not a full list. Check scope with your own counsel.
EU Network and Information Security Directive 2
Providers of public electronic communications networks and services in the EU.
Member States had to transpose it by 17 October 2024. In July 2026 the Commission referred four states to the Court of Justice for failing to notify their measures.
Source: European Commission, NIS2 DirectiveEU General Data Protection Regulation
You have an EU establishment, or serve subscribers in the EU.
A controller notifies the authority within 72 hours of becoming aware of a breach, unless it is unlikely to risk people’s rights (Art. 33).
Source: EUR-Lex, Regulation (EU) 2016/679Payment Card Industry Data Security Standard
Billing, top-ups and online SIM or device sales.
Version 4.0.1 is current. Version 4.0 retired on 31 December 2024. The newer requirements have applied since 31 March 2025.
Source: PCI Security Standards CouncilAICPA System and Organization Controls 2
Asked of business cloud and managed service lines.
An auditor’s report on a provider’s controls for security, availability, processing integrity, confidentiality and privacy. No law requires it. Many buyers do.
Source: AICPA, SOC suite of servicesInformation security management systems
A common evidence point for network and hosting suppliers.
The 2022 edition is current. Certification is the organization’s choice, not a requirement of the standard.
Source: ISO, ISO/IEC 27001Map who and what can change devices, from where, with which accounts, and whether a change raises an alert.
List every vendor with standing access to production network elements, the path they use and how long it lasts.
Run a table-top where the directory, management systems and logs cannot be trusted, and decide which services return first.
Run a gap assessment against the UAE Information Assurance standard, the GSMA baseline controls and ISO/IEC 27001.
Sources and method. This page is analysis, not legal advice.
