Compliance guide · Qatar
Qatar National Information Assurance Standard: a practical guide
Qatar's National Information Assurance Standard sets baseline security controls for organisations in Qatar and works together with the National Data Classification Policy. This guide explains scope and preparation in plain terms. It does not reproduce the standard; NCSA requires written authorisation for commercial reproduction, so use the official document for the requirement text.
What it is and who must comply
Regulator and edition
The standard is issued by the National Cyber Security Agency (NCSA), established by Amiri Decree No. 1 of 2021. Version 2.1 was published in May 2023.
Who it applies to
The standard applies to all organisations and their information assets. If you outsource or subcontract processes, those processes must also meet the standard.
How it works
The standard is used with the National Data Classification Policy. Classifying your information assets under the policy is a mandatory first step. Baseline controls are then mandatory for assets above the lowest security rating, and further controls apply according to each asset's rating. Where the standard overlaps with other laws or regulations, you must meet both, or whichever gives the higher level of security. Controls are grouped into security domains with short codes, for example IG (governance), RM (risk management), AM (access control), IM (incident management), BC (business continuity) and AC (audit and certification).
How to comply
- Obtain the standard and the National Data Classification Policy from NCSA.
- Classify your information assets under the policy.
- Define scope, including outsourced and subcontracted processes.
- Implement the baseline controls for every asset that needs them, then the additional controls each asset's security rating calls for.
- Assign owners and dates to gaps.
- Collect evidence per control with expiry dates.
- Prepare for audit under the standard's audit and certification domain.
Evidence checklist
- Information security governance structure and roles
- Data classification register and labelling records
- Risk assessment and treatment plan
- Third-party security agreements
- Change management records
- Personnel security and awareness records
- Incident management and continuity test records
- Logging and security monitoring records
- Data retention and archival records
- Network, gateway and communications security configuration evidence
- Access control records and reviews
How it maps to ISO/IEC 27001:2022
Domain-level only. This table is Pravitrust's interpretation for planning evidence reuse; it is not a mapping published by the regulator or by ISO.
| Qatar NIA | ISO/IEC 27001:2022 |
|---|---|
| IG governance, RM risk management | Clauses 4-10 (ISMS) |
| DL data labelling | A.5.12 and A.5.13 (classification and labelling) |
| TM third party | A.5.19 to A.5.23 |
| PS personnel, SA awareness | A.6 people controls |
| IM incidents, BC continuity | A.5.24 to A.5.30 |
| AM access control, network, gateway and communications domains | A.5.15 to A.5.18, A.8 technological controls |
How to choose software for Qatar NIA
These criteria are neutral: they apply to any tool you evaluate, including Pravitrust.
- Regulator mapping you can trace. The tool should hold the framework's own identifiers and structure, and show which version it carries. Ask how it is updated when the regulator issues a revision.
- Licence-known content. Ask where the control content came from and on what terms. A vendor that cannot answer has a problem you will inherit.
- Evidence reuse. One piece of evidence should be attachable to every control it supports, across frameworks, without uploading it twice.
- Arabic support. Check the user interface, reports and exports separately; support in one does not imply the others.
- Hosting location. Ask where data and backups are stored, and match that against your own data-residency obligations and any sector rules.
- Honest status. A control with no test or evidence should never display as compliant.
- Exit. Confirm you can export everything, including history, in an open format.
- Classification first. The tool should hold your data classification and drive control applicability from it.
Where Pravitrust stands today
Pravitrust's public catalogue does not currently include a Qatar NIA framework pack.
Moving from ServiceNow or Archer
Pravitrust does not import data from ServiceNow, Archer or any other GRC platform today. An import and migration feature is in design and is not available yet; this page will say so when it ships.
What you can do today:
- Export your current register from the existing tool so you hold a complete copy, including history, before you change anything.
- Adopt the framework pack in Pravitrust at your scope.
- Record control status and attach evidence against each control. Evidence you already hold for ISO/IEC 27001 can be attached to the controls it supports.
- Run both systems in parallel until your next assessment cycle closes, then retire the old one.
Frequently asked questions
Who issues Qatar's National Information Assurance Standard?
The National Cyber Security Agency (NCSA).
Which version does this guide cover?
Version 2.1, published in May 2023. Check NCSA for any later edition.
Who does it apply to?
All organisations and their information assets, including processes they outsource or subcontract.
How does it relate to the National Data Classification Policy?
They are used together. Classifying your information assets under the policy is a mandatory first step; the controls you must apply depend on each asset's classification.
Are the baseline controls optional?
No. The standard marks baseline controls as mandatory for assets that need them, and they form the auditable items.
Can we reproduce the standard in our own tools?
The standard states that reproduction with commercial intent requires written authorisation from NCSA.
How does it relate to ISO/IEC 27001?
Both are risk-based and cover similar ground, so ISO evidence is often reusable, but NIA has its own controls and classification-driven approach.