NESA IAS Compliance
Consulting

NESA — the National Electronic Security Authority, now operating as the UAE’s Signals Intelligence Agency (SIA) — is the federal authority responsible for cyber security. It issued the UAE Information Assurance Standards (the IAS, also called the NESA IAS or UAE IA Standards), a set of 188 security controls that form the national baseline for protecting government and critical information infrastructure. The IAS is openly derived from international standards — most notably ISO/IEC 27001 and NIST — and organises its controls into management and technical families, each control carrying a priority level from P1 to P4.

The IAS is directed primarily at UAE federal and local government entities, semi-government and government-linked organisations, and operators of Critical Information Infrastructure (CII) — sectors such as energy, ICT and telecommunications, finance, transport, and health. Its Third Party Security family also extends obligations to suppliers, outsourcers, and cloud providers, which is why private SaaS and services vendors are increasingly asked to show IAS alignment to win UAE government and CII contracts. Exact applicability for a given entity is set by the national authority and the relevant sector regulator — treat sector-level detail as something we confirm during scoping.

The IAS defines 188 controls — around 60 in the management families and around 128 in the technical families. A subset of roughly 35 controls (all within the management families) is always applicable regardless of your risk assessment; the technical controls apply according to the results of that assessment. Separately, the framework marks 39 controls as Priority 1 (P1) — the mandatory baseline that NESA says addresses about 80% of the threats it identified. Exact counts vary slightly between sources and IAS versions, so we confirm the definitive applicable set for your entity during the scoping and applicability assessment.

Every IAS control carries a priority from P1 (highest) to P4 (lowest). P1 is the mandatory baseline — 39 controls that must be implemented by every in-scope entity and that may be strengthened but never dropped. P2, P3, and P4 are applied on a risk basis: your risk assessment determines which of them are required, with P2 typically expected wherever sensitive data or higher-value systems are involved, and P4 reserved for optional best practice. This risk-driven model is why two IAS implementations in the same sector can legitimately differ below the P1 line.

ISO 27001 is a voluntary international standard you certify against once an accredited body audits your ISMS. The NESA IAS is a national assurance regime: mandatory for in-scope UAE entities, assessed against a fixed control set and priority model, with oversight from the national authority rather than a certificate. Because the IAS is explicitly built on ISO 27001 and NIST, the two overlap heavily — one well-built, ISO 27001-aligned ISMS produces most of the governance, risk, and control evidence the IAS management and technical families require. An ISO 27001 certificate is strong supporting evidence for IAS compliance, but it does not by itself discharge IAS-specific obligations, which we close explicitly in the gap register.

The NESA IAS is the federal baseline. On top of it, individual emirates and sectors run their own regimes: the Dubai Electronic Security Center (DESC) issues the Information Security Regulation (ISR) for Dubai Government entities, and the Department of Health – Abu Dhabi issues ADHICS (the Abu Dhabi Healthcare Information and Cyber Security standard) for the Abu Dhabi health sector. These regimes are closely aligned with the IAS and with ISO 27001, so the approach is the same one we use for SAMA in Saudi Arabia — build one ISO 27001-aligned ISMS, then map the same control set to whichever emirate or sector standard also applies, so nothing is implemented twice.

For a typical mid-size CII operator or a supplier being pulled into scope, plan on roughly 8–14 weeks of consulting work to reach a defensible IAS posture: scoping and applicability, ISMS documentation, control implementation across the applicable families, and assurance. Engagements are custom-scoped to your size, sector deadlines, and existing maturity — we provide a fixed, all-inclusive quote after a short scoping call (in AED or USD for Gulf engagements), with no hourly billing and no scope creep. Large government estates take longer; ISO 27001 certification-body fees, if you choose to certify, are billed separately. TCSA is an independent consultancy — we prepare and implement; the UAE authorities supervise. We are not affiliated with, or endorsed by, NESA / the Signals Intelligence Agency.