Service area · Abu Dhabi, United Arab Emirates · Reviewed September 2026
Tranquility Cybersecurity serves Abu Dhabi as part of its UAE service area from its Gurugram headquarters, with on-site visits across the UAE for kick-off, walkthroughs and audit days. Abu Dhabi buyers are different from Dubai’s: procurement is led by government-linked entities, ADGM-licensed financial firms and the energy and healthcare sectors, so ISO 27001 is the near-universal starting point, ISO 22301 follows for vendors to Abu Dhabi banks, ISO 42001 is rising with the Hub71 AI cohort, and privacy work splits between the federal PDPL and the ADGM Data Protection Regulations.
Quick facts
The local picture
Abu Dhabi’s economy is shaped by large government-linked entities, sovereign-backed investors and the energy sector, and its compliance market follows that shape. Abu Dhabi Global Market (ADGM) on Al Maryah Island is the financial free zone, with banks, asset managers, fintechs and digital-asset firms regulated by the FSRA and the ADGM Office of Data Protection. Hub71, the tech ecosystem in the same district, has drawn a cohort of AI, fintech, healthtech and climate-tech start-ups that sell to those institutions and abroad. Masdar City hosts clean-energy, research and technology firms; Khalifa Economic Zones Abu Dhabi (KEZAD) around Khalifa Port carries industrial, logistics and manufacturing operators; twofour54 and the Yas Creative Hub house media and gaming companies; and Mussafah is the industrial and OT-heavy services belt that supports oil, gas and utilities. Around them sit the Department of Health – Abu Dhabi’s licensed hospitals and clinics, whose ADHICS requirements reach every vendor connected to patient data. Each of these buyers asks a vendor for something slightly different, and that decides which framework comes first.
Banks, asset managers, payment firms and digital-asset businesses regulated by the FSRA face vendor and outsourcing scrutiny of their own and run it onto their suppliers. ISO 27001 plus ISO 22301 is the common combination, with SOC 2 where US counterparties are involved and PCI DSS wherever card data flows.
Technology and engineering vendors to Abu Dhabi’s oil, gas, power and water operators face security requirements written for critical infrastructure, often referencing the UAE IA Standard. An ISO 27001 ISMS mapped to those expectations, with ISO 22301 for continuity of critical services, is the practical route — OT-specific assessments stay with specialist assessors.
Hospitals, clinics, laboratories and the digital-health, telemedicine and insurance-tech vendors serving them fall under the Abu Dhabi Healthcare Information and Cyber Security Standard. ISO 27001 aligned to ADHICS control expectations plus ISO 27701 and PDPL readiness is the usual scope.
Sovereign-backed groups, utilities and departments run supplier security reviews that expect an accredited ISO 27001 certificate, tested continuity arrangements and clean penetration-test reports. Vendors preparing for a UAE IA Standard assessment start from the same ISMS.
Hub71 and Masdar City AI companies selling models and data products to regulated buyers are being asked how they govern AI risk. ISO 42001 integrated with ISO 27001 gives them an auditable AI management system before customers and regulators make it mandatory.
What we deliver in Abu Dhabi
The certificate Abu Dhabi government-linked entities, ADGM firms and energy operators name first in procurement. ISMS scoping, risk assessment, the 93 Annex A controls, internal audit and certification-body coordination — with the UAE IA Standard or ADHICS control expectations mapped into your Statement of Applicability where an approved assessor’s review is on the horizon.
ISO 27001 consultingFor vendors to Abu Dhabi banks receiving ISO 22301-aligned BCMS clauses under CBUAE continuity and outsourcing expectations, and for operators of critical services in energy, utilities and logistics: business impact analysis, RTO/RPO, continuity and recovery plans, exercises and certification-audit support. Our consultants prepared ADIB for ISO 22301 in this discipline.
ISO 22301 consultingThe report Hub71 and ADGM technology firms need when they sell to US customers, global banks or platform partners. We scope the Trust Services Criteria, design and implement controls, collect evidence and coordinate the licensed CPA firm through to the signed Type I or Type II report.
SOC 2 guideData inventory and records of processing, lawful-basis records, privacy notices, transfer safeguards and a breach playbook — built for the UAE’s federal Decree-Law 45 of 2021 and, for ADGM entities, mapped onto the ADGM Data Protection Regulations 2021. Abu Dhabi firms with Saudi customers reuse the same programme for the KSA PDPL.
PDPL compliance guideFor Hub71, Masdar City and ADGM companies building or deploying AI in products sold to regulated buyers: AI risk and impact assessment, roles and accountability, data and model governance, and certification-body coordination — integrated with ISO 27001 so one management system covers both.
ISO 42001 guideManual-first penetration testing that satisfies ISO 27001 control A.8.8, SOC 2 auditors and the testing evidence Abu Dhabi banks, healthcare entities and government-linked buyers ask their vendors for. Retest included; reports written for a counterparty’s vendor-risk team.
VAPT servicesLaws and regulators
Plain-English summary as of September 2026. Laws change; confirm current obligations with counsel before relying on any line here.
| Law / regulator | Who it covers | What it means in practice |
|---|---|---|
| UAE federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) | Companies on the Abu Dhabi mainland and in free zones such as KEZAD, Masdar City and twofour54 that process personal data of individuals in the UAE — excluding ADGM and DIFC entities, which have their own regimes. | Lawful-basis, notice, data-subject-rights, cross-border transfer and breach-notification duties overseen by the UAE Data Office. Executive regulations have been slower to arrive than the law itself; treat the current status as evolving and build the programme now, since it mirrors GDPR closely enough that the work is reusable. |
| ADGM Data Protection Regulations 2021 | Entities registered in Abu Dhabi Global Market, including FSRA-regulated firms, Hub71 companies incorporated in ADGM and their ADGM-based service providers. | A GDPR-style regime enforced by the ADGM Office of Data Protection: registration, records of processing, DPO appointment in defined cases, data protection impact assessments, transfer rules and breach notification. ISO 27701 on top of ISO 27001 is the cleanest way to evidence it alongside FSRA expectations. |
| Abu Dhabi Healthcare Information and Cyber Security Standard (ADHICS) | Healthcare entities licensed by the Department of Health – Abu Dhabi and, through them, the vendors, platforms and insurers that hold or process patient data. | A control standard for health information security that closely resembles ISO 27001 with healthcare-specific requirements. Compliance is assessed through the Department of Health’s own process and approved assessors; TCSA aligns your ISMS to ADHICS control expectations and prepares the evidence so that assessment goes smoothly, never presenting itself as the assessor. |
| UAE Information Assurance (IA) Standard | Critical-sector entities — energy, utilities, transport, finance, government — designated under the federal information-assurance regime that traces back to NESA and now sits with the TDRA and the UAE Cybersecurity Council, plus the suppliers they push it onto. | Control expectations that map well onto ISO 27001 Annex A. Where an assessment by an approved party is required, an ISO 27001 ISMS mapped to the IA Standard is the practical starting point; we build the mapping into the Statement of Applicability rather than running a parallel programme. |
| Central Bank of the UAE outsourcing and business-continuity expectations | Licensed banks and financial institutions headquartered in Abu Dhabi, flowing down by contract to their critical technology vendors and service providers. | Banks have operationalised CBUAE continuity and outsourcing expectations by writing ISO 22301-aligned BCMS clauses into supplier contracts, with the first deadline wave reported from December 2025. Vendors typically need a working BCMS — BIA, RTO/RPO, tested plans — and in many cases certification by an accredited body. |
How we serve Abu Dhabi
Our Gurugram team works to Gulf Standard Time and the UAE’s Monday-to-Friday week; the 1.5-hour offset from IST means a question raised in an Abu Dhabi morning is answered the same day.
On-site when it matters: kick-off and scoping workshops, control walkthroughs at your ADGM, Hub71 or Masdar City office, BIA sessions and continuity exercises with your bank counterparty in mind, and audit days with the certification body or CPA firm — planned into the schedule and quoted upfront.
Named lead auditors and CISA-certified practitioners run the engagement end to end — the same people who prepared Gulf banks for ISO 22301, not a junior team after the sale.
One combined programme when you need ISO 27001, ISO 22301, ISO 42001 and PDPL together: shared risk assessment, one policy set, one evidence library, and a Statement of Applicability that already carries your ADHICS or UAE IA mapping.
Every UAE engagement starts with a mutual NDA; documents move through access-controlled channels you approve, and artefacts for government-linked or regulated counterparties are prepared to survive their own scrutiny. Fixed fee agreed in writing after a short scoping call.
Pricing
Indicative bands for Abu Dhabi engagements. Scope, headcount, cloud and OT footprint, number of sites and starting maturity move the number; we give you a fixed figure in writing after a 30-minute scoping call. Engagements are invoiced in USD or INR, with AED on request. Certification-body and CPA fees are always separate.
| Engagement | Indicative band | Note |
|---|---|---|
| ISO 27001:2022 implementation and internal audit | USD 3,000 – 8,000 | Certification-body fees separate; ADHICS or UAE IA mapping included where in scope. |
| ISO 22301 BCMS for bank-vendor clauses and critical services | Scoped to sites and critical services | BIA, RTO/RPO, plans, exercises and certification-audit support. |
| SOC 2 readiness consulting (Type I or Type II) | USD 2,500 – 6,000 | CPA attestation fee quoted separately by the licensed CPA firm. |
| VAPT (web application, typical SaaS scope) | From about USD 1,000 per test | Retest included; mobile, API and infrastructure scoped separately. |
| vCISO / vDPO retainer | Monthly retainer, scoped to hours | Named practitioner for regulator-facing responses, ADGM data-protection correspondence and board reporting. |
Straight answers for Abu Dhabi companies on SOC 2, ISO 27001, local regulation, timelines and cost.
No. We do not have an office in Abu Dhabi or anywhere else in the UAE. Abu Dhabi is part of our UAE service area: we are headquartered in Gurugram, India, and serve Abu Dhabi from there, with on-site visits across the UAE for kick-off, control walkthroughs, BIA workshops and audit days. Gulf Standard Time is 1.5 hours behind IST, so the working days overlap almost completely, and Abu Dhabi is a direct flight from Delhi for on-site weeks.
Generally no — ADGM has its own regime, the ADGM Data Protection Regulations 2021, enforced by the ADGM Office of Data Protection, and DIFC likewise has its own law. The federal PDPL, Decree-Law 45 of 2021, applies to mainland companies and to most other free zones such as KEZAD, Masdar City and twofour54. Groups with both an ADGM entity and a mainland operating company usually run one privacy programme, built on ISO 27701 controls, and document the two sets of obligations on top of it rather than maintaining two programmes.
No, and no consultant can. ADHICS compliance is assessed through the Department of Health – Abu Dhabi’s own process and approved assessors, and the decision sits with them. What we do is align your ISO 27001 ISMS to the ADHICS control expectations, build the mapping into your Statement of Applicability, prepare the policies and evidence, and run an internal audit against it — so the formal assessment goes smoothly and you are not maintaining two programmes.
If your buyers are banks, government-linked entities or healthcare providers, it is becoming worth it early. Those buyers are starting to ask how AI risk is governed, and ISO 42001 gives an auditable answer — AI risk and impact assessments, roles and accountability, data and model governance — that a security questionnaire alone does not. We integrate it with ISO 27001 so that one management system, one internal audit and one certification-body relationship cover both; the certificate itself is issued by the accredited certification body.
A working business continuity management system, not a policy document. UAE banks have translated CBUAE continuity and outsourcing expectations into ISO 22301-aligned clauses for critical vendors, with the first contract deadlines reported from December 2025. They typically expect a business impact analysis, defined RTO and RPO for the services you provide them, tested continuity and recovery plans, and in many cases certification by an accredited body. Our consultants prepared ADIB for ISO 22301, so we know what the bank side of that assessment looks like.
Rarely as a substitute. Abu Dhabi government-linked entities, energy operators and ADGM institutions overwhelmingly name an accredited ISO 27001 certificate in procurement, and several also reference the UAE IA Standard. SOC 2 is valued by the same firms’ US and global counterparties, so Hub71 and ADGM technology companies often need both. We build one control set and sequence the certification audit and the CPA examination so evidence is collected once.
Engagements run in English — policies, reports, working sessions and audit-facing documents — which is the working language of UAE compliance, vendor-risk and audit teams. This site has Arabic pages for the Gulf, but we do not promise Arabic-language deliverables; where a government-linked counterparty or regulator requires Arabic artefacts, we plan translation into the engagement schedule with you.
Fixed fee, agreed in writing after a scoping call. Typical bands are USD 3,000 – 8,000 for ISO 27001 implementation and USD 2,500 – 6,000 for SOC 2 readiness consulting; ISO 22301 is scoped to your sites and critical services, and OT-adjacent scopes are priced after we understand the environment. We invoice in USD or INR, with AED available on request. Certification-body and CPA fees are quoted separately by those firms, and we help you scope them so there are no surprises.
Keep Exploring
How we serve Gulf banks, vendors and enterprises, remote + on-site.
Read moreThe ISMS standard — the baseline certificate global buyers ask for.
Read moreWhat a BCMS is, who demands it, and how certification works.
Read moreThe world's first AI management system standard, for AI builders.
Read moreSaudi Arabia's SDAIA-enforced privacy law and the UAE's federal PDPL.
Read moreThe UAE's Information Assurance Standards — 188 controls, mapped to ISO 27001.
Read moreTalk to a real auditor
Book a free 30-minute call. We will tell you which framework your buyers or regulator actually need, what it will cost, and how long it takes — and whether we are the right fit.
