NESA Compliance Services in the UAE

NESA is not optional. If you operate in a critical sector in the UAE, energy, government, banking, telecom, transport or healthcare. The Information Assurance Standards framework applies to you, whether you have started the work or not. A naming note: in 2020, the National Electronic Security Authority (NESA) was absorbed into the UAE Signals Intelligence Agency, with policy responsibility now sitting with the UAE Cyber Security Council. The standards did not change. The controls are still in force, still audited, and still universally called NESA compliance. The term has stuck.

The UAE IAS is a tiered control framework across six management domains (M1-M6, covering governance, risk management, awareness, HR security, compliance and performance evaluation) and nine technical domains (T1-T9, covering asset management, physical security, operations, communications, access control, third-party security, information systems, incident management and continuity). There are 188 controls in total, though not every control applies to every organisation, applicability is determined by your sector and risk profile. Each control carries a priority rating from P1 (critical) through P5 (advisory). Audit enforcement focuses on P1 and P2, which is where remediation effort needs to be concentrated first.

NESA audits are scheduled, not surprise visits. They run through your sector regulator depending on your sector. The auditor pre-issues an Information Assurance Maturity Model (IAMM) questionnaire scoring each control on a 0-5 scale, followed by a site visit with interviews and evidence sampling. The most common issue at first audit is not missing controls. It is missing evidence. Controls exist but are not documented, dated, named to an owner or tested on a verifiable schedule. The fix is operational: an evidence repository, named control owners and calendar-driven attestation.

Sector overlays on top of NESA. Banking: the banking sector regulator layers additional requirements around payment systems, third-party risk and incident reporting. The two frameworks share substantial coverage, so a single programme can address both. Energy: energy and federal entities add OT security expectations, IT/OT segmentation, ICS/SCADA hardening, vendor remote-access controls, with T6 (third-party) and T8 (incident management) typically the heaviest workstreams. Healthcare: healthcare regulators reference NESA as the baseline for licensed facilities, with patient data classification and clinical system continuity as the typical focus areas. Telecom: the telecom regulator enforces the framework through operator licensing, with deeper scrutiny on operations management and communications security.

A NESA programme typically runs through gap assessment, a prioritised remediation roadmap, technical and policy control implementation, a mock audit, and formal audit support, with ongoing controls operation available as a managed service afterwards. Programme scope and timeline vary significantly by organisation size, existing control maturity and sector overlay complexity. We scope engagements after the initial gap assessment and provide a fixed-price proposal per phase, so you have cost clarity before committing to each stage, not after.