Compliance guide · United Arab Emirates
UAE Information Assurance Regulation: a practical compliance guide
The UAE Information Assurance Regulation sets minimum information assurance requirements for UAE government entities and entities designated as critical. This guide explains scope, structure and preparation in plain terms. It does not reproduce the regulation; use the official document for the requirement text.
What it is and who must comply
Regulator and edition
This guide covers version 1.1, dated March 2020. The regulation names the Telecommunications Regulatory Authority (TRA) as its issuing authority. The UAE regulator for telecommunications and digital government today is the Telecommunications and Digital Government Regulatory Authority (TDRA); check tdra.gov.ae for the latest edition.
Who must comply
- All UAE government entities.
- Other entities that the authority identifies as critical, under the UAE critical information infrastructure protection policy.
The authority recommends that every other entity in the UAE adopt the regulation voluntarily, as applicable.
How it is structured
Controls fall into two groups: management controls (families M1 to M6) and technical controls (families T1 to T9). Two separate settings decide what you implement first:
- Applicability. Some controls are "always applicable" because they are foundational. The rest are selected through your risk assessment.
- Priority. Each control carries a priority from P1 to P4, which guides the order of implementation.
The regulation has a chapter on compliance that defines what compliance means and how the authority evaluates it.
How to comply
- Confirm your status: government entity, designated critical entity, or voluntary adopter.
- Obtain version 1.1 of the regulation from the official source.
- Define the scope of systems and information covered.
- Implement every "always applicable" control. These are not optional for in-scope entities.
- Run a risk assessment and select the further controls that treat your risks, recording why any control is excluded.
- Sequence the work by priority, P1 first.
- Collect evidence per control with expiry dates.
- Measure and improve: performance evaluation and improvement is a management family in its own right (M6).
Evidence checklist
- Information assurance strategy and plan
- Risk assessment, risk treatment plan and statement of selected controls
- Awareness and training records
- HR security records: screening, terms of employment, exit process
- Asset inventory and classification
- Physical security records
- Operations records: change management, malware protection, backup, logging
- Access control records, including periodic reviews
- Third-party agreements and assessments
- Incident management and continuity test records
- Internal audit and performance evaluation reports
How it maps to ISO/IEC 27001:2022
Domain-level only. This table is Pravitrust's interpretation for planning evidence reuse; it is not a mapping published by the regulator or by ISO.
| UAE IA Regulation | ISO/IEC 27001:2022 |
|---|---|
| M1-M6 management families | Clauses 4-10 (ISMS), with A.5 organisational and A.6 people controls |
| T1 asset management, T5 access control | A.5.9 to A.5.18, A.8.2 to A.8.5 |
| T2 physical and environmental | A.7 physical controls |
| T3 operations, T4 communications, T7 acquisition and development | A.8 technological controls |
| T6 third party | A.5.19 to A.5.23 |
| T8 incident management, T9 continuity | A.5.24 to A.5.30 |
How to choose software for UAE IA Regulation
These criteria are neutral: they apply to any tool you evaluate, including Pravitrust.
- Regulator mapping you can trace. The tool should hold the framework's own identifiers and structure, and show which version it carries. Ask how it is updated when the regulator issues a revision.
- Licence-known content. Ask where the control content came from and on what terms. A vendor that cannot answer has a problem you will inherit.
- Evidence reuse. One piece of evidence should be attachable to every control it supports, across frameworks, without uploading it twice.
- Arabic support. Check the user interface, reports and exports separately; support in one does not imply the others.
- Hosting location. Ask where data and backups are stored, and match that against your own data-residency obligations and any sector rules.
- Honest status. A control with no test or evidence should never display as compliant.
- Exit. Confirm you can export everything, including history, in an open format.
- Two baseline axes. The tool should store applicability (always applicable or risk-based) and priority (P1-P4) as separate fields, because you filter on both.
Where Pravitrust stands today
- Adopt a framework pack into your control library at the scope that applies to you, with the pack version recorded so later assessments stay tied to the revision you assessed against.
- Attach evidence to each control, with an expiry date and reminders when evidence goes stale.
- Show a control with no test result as untested, never as healthy.
- Keep an append-only, hash-chained audit trail of changes.
- Export registers to CSV or Excel.
Moving from ServiceNow or Archer
Pravitrust does not import data from ServiceNow, Archer or any other GRC platform today. An import and migration feature is in design and is not available yet; this page will say so when it ships.
What you can do today:
- Export your current register from the existing tool so you hold a complete copy, including history, before you change anything.
- Adopt the framework pack in Pravitrust at your scope.
- Record control status and attach evidence against each control. Evidence you already hold for ISO/IEC 27001 can be attached to the controls it supports.
- Run both systems in parallel until your next assessment cycle closes, then retire the old one.
Frequently asked questions
Who must comply with the UAE IA Regulation?
All UAE government entities, and other entities the authority identifies as critical. Other entities are encouraged to adopt it voluntarily.
Which version does this guide cover?
Version 1.1, dated March 2020. Check TDRA for any later edition.
Who issues it?
The regulation names the Telecommunications Regulatory Authority (TRA) as its issuing authority. Today's UAE telecommunications and digital government regulator is the Telecommunications and Digital Government Regulatory Authority (TDRA).
Do we have to implement every control?
No. Controls marked always applicable must be implemented; the others are selected through your risk assessment. Record the reason for any exclusion.
What do P1 to P4 mean?
They are implementation priorities. Start with P1.
How does it relate to ISO/IEC 27001?
The management families follow a management-system approach similar to ISO/IEC 27001 clauses 4-10, and the technical families cover much of Annex A. ISO evidence is often reusable, but the regulation has its own requirements.