Get audit-ready for UAE IA
UAE Information Assurance Standard (v2) · UAE Cyber Security Council
The UAE's national information assurance baseline (formerly NESA), version 2 published 2025: 6 management and 9 technical control families. Mandatory for federal and local government entities, critical infrastructure and in-scope partners. Tracked here at family level; add controls from your own copy of the standard. The public v1.1 edition (TDRA, 2020: 188 controls with P1–P4 priorities and always-applicable flags) can also be loaded as a separate catalog.
UAE IAWhat is UAE IA?
The UAE's national information assurance baseline (formerly NESA), version 2 published 2025: 6 management and 9 technical control families. Mandatory for federal and local government entities, critical infrastructure and in-scope partners. Tracked here at family level; add controls from your own copy of the standard. The public v1.1 edition (TDRA, 2020: 188 controls with P1–P4 priorities and always-applicable flags) can also be loaded as a separate catalog.
Who it applies to
Federal and local government entities, critical infrastructure operators and the partners in their scope.
How the standard is organised
Management control families (strategy, risk, awareness, third parties, compliance and performance) and technical control families covering assets, operations, access, communications, systems acquisition, incidents, continuity and physical security.
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
UAE IA on the Bitkosh platform
The 15 UAE IA controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- M6Performance evaluation and improvement
Measure, monitor, audit and continually improve the security programme.
Management Controls - T7System acquisition, development and maintenance
Build security into acquiring, developing and maintaining information systems.
Technical Controls - M4Human resource security
Apply security before, during and at the end of employment.
Management Controls - T2Physical and environmental security
Protect facilities and equipment against unauthorised access and environmental threats.
Technical Controls
More information security & cybersecurity frameworks
Frequently Asked Questions
Who publishes UAE IA, and who does it apply to?
How is UAE IA conformance demonstrated?
How is UAE IA structured?
Ready to get audit-ready for UAE IA?
See how the Bitkosh Readiness Platform gets you audit-ready for UAE IA — and the other 47 ready frameworks — from a single control library.