Sample control mapping (illustrative)
ISO 27001 Annex A access control
SOC 2 logical access criteria. PCI DSS access requirements.
ISO 27001 Annex A incident management
SOC 2 incident criteria. PCI DSS incident response requirement.
UAE IA, DESC, PDPL and DPDP compliance: Pass the audit by building the controls, not the paperwork.
We work out which rules apply to you, close the gaps in the order that matters, and build evidence as the work happens. Audit day becomes a review, not a scramble.
For
Teams facing UAE rules (UAE IA, DESC ISR, PDPL, CBUAE, DFSA, FSRA, ADHICS), India rules (DPDP, CERT-In, RBI, SEBI CSCRF) or ISO 27001, SOC 2 and PCI DSS, from customers, regulators or both.
You get
A map of what applies, a gap assessment, a delivery plan and an evidence set auditors accept.
How it runs
We scope the rules first, then run one program that serves several frameworks where they overlap.
Not included
Legal advice, or the audit opinion itself. Your counsel and an accredited auditor provide those.
Which rules apply to you
Start here. Your counsel confirms the final answer for your business.
| Rule | Applies to | Note |
|---|---|---|
| UAE Information Assurance (IA) standard | Entities formally designated critical under the UAE CIIP Policy. | A November 2025 version replaced Regulation v1.1. Confirm the current text. |
| Dubai Information Security Regulation (ISR) | Dubai government entities, their staff and contractors. | Maintained by the Dubai Electronic Security Center (DESC). |
| CBUAE Operational Risk Management Regulation C 1/2026 | Licensed Financial Institutions supervised by the Central Bank of the UAE. | Notice to the Central Bank within 4 hours when a Critical Operation is hit. |
| DFSA Cyber Risk Management Rules (GEN Module) | DFSA-authorised firms in the Dubai International Financial Centre. | Material incidents notified no later than 72 hours. |
| ADGM FSRA Cyber Risk Management Rules | FSRA-regulated entities in Abu Dhabi Global Market. | Incidents reported to the FSRA no later than 24 hours after you become aware. |
| ADHICS V2 (Abu Dhabi) | Health facilities, payers and health technology providers under the Department of Health Abu Dhabi. | Dubai health entities have their own DHA and NABIDH requirements. |
| UAE PDPL (Federal Decree-Law 45 of 2021) | Organizations that process personal data in the UAE, and those outside the UAE that process UAE residents' data to offer goods or services or to monitor behavior. | Free zones with their own data law are covered separately. |
| DIFC Data Protection Law (Law No. 5 of 2020) | Entities established in the Dubai International Financial Centre. | Its own regulator and its own rules. |
| ADGM Data Protection Regulations 2021 | Entities established in Abu Dhabi Global Market. | Its own regulator and its own rules. |
| India Digital Personal Data Protection Act 2023 and Rules 2025 | Organizations that process digital personal data in India, and those outside India that do so to offer goods or services there. | Rules notified in November 2025; most duties start 18 months later. |
| CERT-In Directions, 28 April 2022 | Service providers, intermediaries, data centers, body corporates and government bodies in India. | Listed incidents reported within 6 hours; ICT logs kept 180 days in India. |
| RBI IT Governance, Risk, Controls and Assurance Practices Directions, 2023 | Banks and larger NBFCs regulated by the Reserve Bank of India. | Board-approved IT and cyber policies, and a CISO who does not report to the head of IT. |
| SEBI Cybersecurity and Cyber Resilience Framework (CSCRF) | SEBI-regulated entities such as stock brokers, mutual funds and alternative investment funds. | Requirements scale with the entity category. |
| PCI DSS v4.0.1 | Any organization that stores, processes or transmits payment card data. | Set by card brands and your acquirer, not by law. |
| ISO/IEC 27001:2022 | Organizations that want a certified security management system. Often a customer or tender requirement. | Certificates to the 2013 edition expired on 31 October 2025. |
| SOC 2 | Service organizations whose customers ask for an independent report on controls. | A Type 2 report covers an observation period. |
One runway, several frameworks
Frameworks overlap heavily. We plan the shared controls once, then add what each one needs.
ISO/IEC 27001
- 1Scope and risk assessment
- 2Build the management system
- 3Internal audit and management review
- 4Certification audit
- 5Surveillance audits
SOC 2
- 1Choose criteria and scope
- 2Readiness gap review
- 3Fix and gather evidence
- 4Observation period
- 5Auditor report
PCI DSS
- 1Define card data scope
- 2Gap assessment
- 3Remediate and segment
- 4Assessment or self-assessment
- 5Annual cycle
UAE data protection
- 1Map personal data
- 2Gap to the law that applies
- 3Notices, contracts and rights process
- 4Breach and transfer procedures
- 5Ongoing review
Checkbox compliance, or controls that work
| Item | Paperwork-first | Controls-first |
|---|---|---|
| Starts with | Templates and policies. | The risk and the control that addresses it. |
| Evidence | Collected in a rush before the audit. | Produced as the control runs. |
| After the audit | Controls drift. Next year is a scramble. | A routine keeps controls working and evidence fresh. |
| Overlap | Each framework gets its own project. | Shared controls are built once and mapped to each. |
What you hold at the end
- Applicability mapEach rule, whether it applies, and why.
- Gap assessmentWhat is missing, ranked, with effort and owners.
- Control setOne set of controls mapped to every framework you answer to.
- Evidence packPolicies, records and screenshots organized the way auditors ask for them.
- Audit supportWe sit with your team through the audit and handle follow-ups.
Dates that have moved or passed
ISO 27001
Initial certifications to the 2013 edition ended on 1 May 2024. Certificates to that edition expired on 31 October 2025. Only the 2022 edition is current.
PCI DSS v4.0.1
Future-dated requirements in v4.0 became mandatory on 31 March 2025.
UAE PDPL
Federal enforcement is still developing. Free zones such as DIFC and ADGM have their own active regulators. We track both.
Works well with
- Audit ReadinessA focused sprint when the audit date is already set.
- Compliance AssessmentsAn independent view of where you stand today.
- Third-Party & Supply Chain RiskHandles supplier evidence that auditors now ask for.
Questions we hear
Which framework should we start with?
The one your customers or regulator ask for first. We plan the others on the same controls so the next one costs less.
Can you act as our auditor?
No. Certification and attestation come from an accredited body or licensed firm. Keeping advisers and auditors separate protects the value of the result.
Do you give legal advice on the UAE PDPL?
We map the law to controls and processes. For legal interpretation and regulator dealings, your counsel advises, and we work to their view.
How long until we are ready?
It depends on your starting point and scope. A gap assessment gives you a dated plan.
Know what applies before you spend.
Tell us who is asking: a customer, a regulator or an auditor. We map the shortest route.
