They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
Service area · Dubai, United Arab Emirates · Reviewed September 2026
Compliance Consultants Serving Dubai
ISO 27001, SOC 2 & ISO 22301 for DIFC, DMCC and Internet City companies
Tranquility Cybersecurity serves Dubai as part of its UAE service area from its Gurugram headquarters, with on-site visits across the UAE for kick-off, walkthroughs and audit days. Dubai companies come to us for four things: ISO 27001 for the enterprise and government-linked procurement that dominates the emirate, SOC 2 for the SaaS firms and regional HQs selling into US and global customers, ISO 22301 for technology vendors caught by the CBUAE-driven business-continuity clauses in UAE bank contracts, and readiness for the UAE federal PDPL and the DIFC data protection regime.
1,000+Audits delivered
300+SOC 2 engagements
100+SOC 1 engagements
India, USA, UK, Australia & UAEWhere our clients are
Quick facts
Compliance in Dubai, in six lines
- How we serve Dubai
- Service area, served from our Gurugram headquarters, with on-site visits across the UAE for kick-off, evidence walkthroughs, BIA workshops and audit days as scope requires.
- Frameworks Dubai buyers ask for
- ISO 27001:2022 first, then SOC 2 (Type I and Type II), ISO 22301 for bank-vendor continuity clauses, UAE PDPL and DIFC readiness, ISO 27701, and VAPT for web, mobile and API.
- Who signs what
- SOC 2 reports are issued by independent licensed CPA firms, ISO certificates by accredited certification bodies, and DESC ISR and UAE IA assessments by approved assessors. TCSA prepares you and coordinates — it never issues or certifies.
- Typical readiness budget
- SOC 2 all-in USD 2,500 – 5,000 for Type I and USD 3,000 – 10,000 for Type II, including the independent CPA attestation. ISO 27001 implementation USD 3,000 – 8,000, with certification-body fees separate. Invoiced in USD or INR, AED on request.
- Time zone and travel
- Gulf Standard Time is 1.5 hours behind IST, so a Dubai morning question is answered the same day. Dubai is a short direct flight from Delhi for on-site days.
- Track record
- 1,000+ audits, 300+ SOC 2 engagements and 100+ SOC 1 engagements across India, USA, UK, Australia and UAE, including ISO 22301 preparation for Gulf banks.
Key Takeaways
- Dubai is one of the cities in TCSA’s UAE service area: our Gurugram team runs the engagement, with on-site visits across the UAE for the days that need them.
- ISO 27001 is the more common ask from Dubai enterprises and government-linked buyers, while SOC 2 matters most for DIFC, DMCC and Internet City firms selling to US and global SaaS customers — many end up needing both from one control set.
- Technology vendors to UAE banks are receiving ISO 22301-aligned BCMS clauses that trace back to CBUAE continuity and outsourcing expectations, with the first contract deadlines reported from December 2025.
- Which privacy law applies depends on where you are registered: the federal PDPL (Decree-Law 45 of 2021) on the mainland and in most free zones, the DIFC Data Protection Law for DIFC entities — ISO 27701 gives both a common backbone.
- DESC ISR, the UAE IA Standard and similar assessments are performed by approved assessors. TCSA aligns your ISMS to them so that formal assessment goes smoothly, and quotes a fixed fee in writing after a scoping call.
The local picture
What Dubai’s compliance demand actually looks like
Dubai’s technology economy is spread across its free zones, and each one carries a different buyer and regulator. The Dubai International Financial Centre (DIFC) houses banks, asset managers, insurers and a dense fintech and payments cluster under the DFSA and the DIFC Commissioner of Data Protection. DMCC in Jumeirah Lakes Towers hosts thousands of trading, commodities and technology firms, while Dubai Internet City and Dubai Media City are where global software vendors and their regional headquarters sit. Dubai Silicon Oasis carries hardware, IoT and engineering start-ups. Dubai South and Expo City Dubai sit beside Jebel Ali and Al Maktoum airport, anchoring logistics and e-commerce fulfilment. Business Bay and the Dubai Future District (with the in5 incubators) hold the proptech, consumer-app and AI start-up base. Around them are DHA-licensed hospitals and clinics, a large real-estate sector, and Dubai government entities whose suppliers are pulled into the DESC Information Security Regulation. Each group faces a different counterparty, and that decides which framework comes first.
DIFC (Dubai International Financial Centre)DMCC (Jumeirah Lakes Towers)Dubai Internet City / Dubai Media CityDubai Silicon OasisDubai South / Expo City DubaiBusiness Bay and Dubai Future District (in5)
Fintech and DIFC-licensed financial firms
Payment firms, wealth platforms and lenders in DIFC answer to the DFSA and the DIFC data protection regime, and their bank partners run vendor assessments that expect ISO 27001, often SOC 2, and increasingly ISO 22301 evidence. PCI DSS scoping follows wherever card data flows.
SaaS and regional HQs of global technology firms
Internet City, Media City and DMCC software companies sell into UAE enterprises, GCC governments and US or European customers at the same time. ISO 27001 unlocks the Gulf procurement lists, while SOC 2 Type II is what US buyers and global partners ask for.
E-commerce, logistics and supply-chain tech
Marketplaces, last-mile platforms and freight-tech firms around Jebel Ali, Dubai South and DP World’s ecosystem hold customer, cargo and payment data and run around-the-clock operations. ISO 27001 with ISO 22301 continuity work is the usual scope, with PCI DSS where they handle cards.
Healthcare and healthtech (DHA-regulated)
DHA-licensed hospitals, clinics, labs and the digital-health vendors serving them hold sensitive health data under Dubai and federal rules. ISO 27001, ISO 27701 and PDPL readiness are the usual scope, with HIPAA alignment only for those serving US providers.
Real estate, proptech and government suppliers
Developers, property-management platforms and any vendor to a Dubai government entity face DESC ISR expectations flowing down through contracts. An ISO 27001 ISMS aligned to ISR control expectations is the practical way to prepare for the formal assessment.
What we deliver in Dubai
The frameworks Dubai buyers ask for, and why
ISO 27001:2022 certification
The certificate Dubai enterprises, banks and government-linked buyers recognise first. ISMS scoping, risk assessment, the 93 Annex A controls, internal audit and certification-body coordination — and where a DESC ISR or UAE IA Standard assessment is on the horizon, we align the ISMS to those control expectations so the approved assessor’s review goes smoothly.
ISO 27001 consultingSOC 2 attestation
The report US and global customers ask DIFC fintechs, Internet City SaaS firms and DMCC technology companies for. We scope the Trust Services Criteria, design and implement controls, collect evidence and coordinate the licensed CPA firm through to the signed Type I or Type II report.
SOC 2 guideISO 22301 business continuity
For technology vendors and service providers receiving ISO 22301-aligned BCMS clauses from UAE banks under CBUAE continuity and outsourcing expectations: business impact analysis, RTO/RPO, continuity and recovery plans, exercises and certification-audit support. This is the discipline in which our consultants prepared Gulf banks for ISO 22301.
ISO 22301 consultingPDPL readiness (UAE federal PDPL & KSA PDPL)
Data inventory and records of processing, lawful-basis records, privacy notices, cross-border transfer safeguards and a breach playbook — built for the UAE’s federal Decree-Law 45 of 2021 and, for DIFC entities, mapped onto the DIFC Data Protection Law. Dubai firms with Saudi customers reuse the same programme for the KSA PDPL.
PDPL compliance guideISO 27701 privacy management
The privacy extension to ISO 27001 for Dubai companies juggling the federal PDPL, the DIFC regime and GDPR from European customers. One PIMS gives the Commissioner, your auditors and your enterprise buyers the same evidence set.
ISO 27701 guideVAPT — web, mobile, API
Manual-first penetration testing that satisfies SOC 2 auditors, ISO 27001 control A.8.8 and the testing evidence UAE banks and government entities ask their vendors for. Retest included, with reports written to be read by a counterparty’s vendor-risk team, not just your engineers.
VAPT servicesLaws and regulators
What applies to a Dubai company
Plain-English summary as of September 2026. Laws change, so confirm current obligations with counsel before relying on any line here.
| Law / regulator | Who it covers | What it means in practice |
|---|---|---|
| UAE federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) | Companies on the Dubai mainland and in most free zones that process personal data of individuals in the UAE — excluding DIFC and ADGM entities, which have their own regimes. | Lawful-basis, notice, data-subject-rights, cross-border transfer and breach-notification duties overseen by the UAE Data Office. Executive regulations have been slower to land than the law itself. Treat the current status as evolving and build the programme now, since the obligations mirror GDPR closely enough that the work is reusable. |
| DIFC Data Protection Law No. 5 of 2020 | Entities registered in the Dubai International Financial Centre, including fintechs, funds, insurers and their DIFC-based service providers. | A GDPR-style regime enforced by the DIFC Commissioner of Data Protection: registration and notification, records of processing, DPO appointment in defined cases, transfer assessments and breach notification. ISO 27701 on top of ISO 27001 is the cleanest way to evidence it alongside DFSA expectations. |
| Dubai Electronic Security Center (DESC) Information Security Regulation (ISR) | Dubai government entities and, through their contracts, the suppliers and cloud providers that hold or process government data. | A control framework that closely resembles ISO 27001 with Dubai-specific additions. Formal assessment and any resulting certification are performed by DESC-recognised parties. TCSA aligns your ISMS to ISR control expectations and prepares the evidence so that assessment goes smoothly. The Dubai Data Law adds classification and sharing rules for data exchanged with government. |
| UAE Information Assurance (IA) Standard | Critical-sector entities designated under the federal information-assurance regime that traces back to NESA and now sits with the TDRA and the UAE Cybersecurity Council. It is increasingly referenced in supplier questionnaires. | Control expectations that map well onto ISO 27001 Annex A. Where an assessment by an approved party is required, an ISO 27001 ISMS mapped to the IA Standard is the practical starting point. We build that mapping into the Statement of Applicability rather than running a parallel programme. |
| Central Bank of the UAE outsourcing and business-continuity expectations | Licensed banks and financial institutions, flowing down by contract to their critical technology vendors and service providers in Dubai. | Banks have operationalised CBUAE continuity and outsourcing expectations by writing ISO 22301-aligned BCMS clauses into supplier contracts, with the first deadline wave reported from December 2025. Vendors typically need a working BCMS — BIA, RTO/RPO, tested plans — and in many cases certification by an accredited body. |
| Dubai Health Authority (DHA) data and information-security rules | DHA-licensed hospitals, clinics, laboratories and the digital-health vendors that connect to them. | Health-data handling, localisation and security expectations for Dubai’s private healthcare sector, alongside the federal privacy law. An ISO 27001 ISMS with ISO 27701 privacy controls organises the evidence. HIPAA alignment is only needed for providers serving US clients. |
How we serve Dubai
From our Gurugram team, on-site when it matters
- Our Gurugram team works to Gulf Standard Time and the UAE’s Monday-to-Friday week. The 1.5-hour offset from IST means a question raised in a Dubai morning is answered the same day.
- On-site when it matters: kick-off and scoping workshops, control walkthroughs at your DIFC, DMCC or Internet City office, BIA sessions and continuity exercises, and audit days with the CPA firm or certification body — planned into the schedule and quoted upfront.
- Named lead auditors and CISA-certified practitioners run the engagement end to end — no hand-off to a junior team after the sale.
- One combined programme when you need ISO 27001, SOC 2, ISO 22301 and PDPL together: shared risk assessment, one policy set, one evidence library, and a Statement of Applicability that already carries your DESC ISR or UAE IA mapping.
- Every UAE engagement starts with a mutual NDA. Documents move through access-controlled channels you approve, and bank- or government-facing artefacts are prepared to survive your counterparty’s own scrutiny. Fixed fee agreed in writing after a short scoping call.
Pricing
Indicative bands for Dubai engagements
Indicative bands for Dubai engagements. Scope, headcount, cloud footprint, number of sites and starting maturity move the number. We give you a fixed figure in writing after a 30-minute scoping call. Engagements are invoiced in USD or INR, with AED on request. SOC 2 is quoted all-in, including the independent CPA attestation. Certification-body fees are always separate.
| Engagement | Indicative band | Note |
|---|---|---|
| SOC 2 readiness and CPA attestation (Type I or Type II) | USD 2,500 – 5,000 (Type I), USD 3,000 – 10,000 (Type II) | All-in, including the independent CPA attestation. |
| ISO 27001:2022 implementation and internal audit | USD 3,000 – 8,000 | Certification-body fees separate. DESC ISR or UAE IA mapping included where in scope. |
| ISO 22301 BCMS for bank-vendor clauses | Scoped to sites and critical services | BIA, RTO/RPO, plans, exercises and certification-audit support. |
| VAPT (web application, typical SaaS scope) | From about USD 1,000 per test | Retest included. Mobile and API scoped separately. |
| vCISO / vDPO retainer | Monthly retainer, scoped to hours | Named practitioner for bank questionnaires, DIFC Commissioner correspondence and board reporting. |
Proof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
Compliance in Dubai: FAQs
Straight answers for Dubai companies on SOC 2, ISO 27001, local regulation, timelines and cost.
Does Tranquility Cybersecurity have an office in Dubai?
No. We do not have an office in Dubai or anywhere else in the UAE. Dubai is part of our UAE service area: we are headquartered in Gurugram, India, and serve Dubai from there, with on-site visits across the UAE for kick-off, control walkthroughs, BIA workshops and audit days. Most of an ISO 27001 or SOC 2 engagement runs over video and shared trackers regardless of where the consultant sits, and the on-site days are planned and quoted upfront.
Which data protection law applies to my Dubai company — the federal PDPL, DIFC or ADGM?
It depends on where you are registered. A company on the Dubai mainland or in free zones such as DMCC, Internet City or Silicon Oasis falls under the federal Personal Data Protection Law, Decree-Law 45 of 2021, overseen by the UAE Data Office. A DIFC-registered entity is instead governed by the DIFC Data Protection Law No. 5 of 2020 and its Commissioner, while ADGM entities in Abu Dhabi follow the ADGM Data Protection Regulations 2021. Groups with entities in more than one zone usually run one ISO 27701-style privacy programme and document the jurisdictional differences on top of it.
Do Dubai buyers care more about ISO 27001 or SOC 2?
ISO 27001 is the more common ask from UAE enterprises, banks and government-linked buyers, and it is the certificate most Gulf procurement checklists name. SOC 2 matters when you sell to US or global SaaS customers, who expect a Type II report rather than a certificate. Many DIFC and Internet City firms need both. We build one control set and sequence the certification audit and the CPA examination so evidence is collected once.
Our bank client has sent us an ISO 22301 clause. Do we really need a BCMS?
Increasingly, yes. UAE banks have translated CBUAE continuity and outsourcing expectations into ISO 22301-aligned BCMS requirements for critical vendors, with the first contract deadlines reported from December 2025. In practice you need a working BCMS — business impact analysis, defined RTO and RPO, tested continuity and recovery plans — and in many cases certification by an accredited body. TCSA builds the BCMS and prepares you for that audit, and our consultants have prepared Gulf banks themselves for ISO 22301.
Can TCSA certify us against DESC ISR or the UAE IA Standard?
No, and no consultant can. DESC ISR assessments and UAE IA Standard assessments are performed by approved or recognised assessors, and certification decisions sit with those bodies. What we do is align your ISO 27001 ISMS to the ISR or IA control expectations, build the mapping into your Statement of Applicability and prepare the evidence, so the formal assessment goes smoothly and you are not running two parallel programmes.
Do you deliver policies and reports in Arabic?
Engagements run in English — policies, reports, working sessions and audit-facing documents — which is the working language of UAE compliance, vendor-risk and audit teams. This site has Arabic pages for the Gulf, but we do not promise Arabic-language deliverables. Where a regulator or counterparty requires Arabic artefacts, we plan translation into the engagement schedule with you.
How does the time difference with India work in practice?
Gulf Standard Time is 1.5 hours behind IST, so the working days overlap almost completely. We schedule workshops and evidence reviews to Dubai’s Monday-to-Friday week, and a question raised in a Dubai morning is answered the same day. Dubai is a short direct flight from Delhi, which keeps on-site days easy to plan.
How is pricing structured and in which currency do you invoice?
Fixed fee, agreed in writing after a scoping call. Typical bands are USD 2,500 – 5,000 for SOC 2 Type I and USD 3,000 – 10,000 for SOC 2 Type II, all-in, including the independent CPA attestation, and USD 3,000 – 8,000 for ISO 27001 implementation. ISO 22301 is scoped to your sites and critical services. We invoice in USD or INR, with AED available on request. Certification-body fees are quoted separately by the certification body, and we help you scope them so there are no surprises.
Talk to a real auditor
Scoping compliance in Dubai?
Book a free 30-minute call. We will tell you which framework your buyers or regulator actually need, what it will cost, and how long it takes — and whether we are the right fit.