Service area · Dubai, United Arab Emirates · Reviewed September 2026
Tranquility Cybersecurity serves Dubai as part of its UAE service area from its Gurugram headquarters, with on-site visits across the UAE for kick-off, walkthroughs and audit days. Dubai companies come to us for four things: ISO 27001 for the enterprise and government-linked procurement that dominates the emirate, SOC 2 for the SaaS firms and regional HQs selling into US and global customers, ISO 22301 for technology vendors caught by the CBUAE-driven business-continuity clauses in UAE bank contracts, and readiness for the UAE federal PDPL and the DIFC data protection regime.
Quick facts
The local picture
Dubai’s technology economy is spread across its free zones, and each one carries a different buyer and regulator. The Dubai International Financial Centre (DIFC) houses banks, asset managers, insurers and a dense fintech and payments cluster under the DFSA and the DIFC Commissioner of Data Protection. DMCC in Jumeirah Lakes Towers hosts thousands of trading, commodities and technology firms, while Dubai Internet City and Dubai Media City are where global software vendors and their regional headquarters sit. Dubai Silicon Oasis carries hardware, IoT and engineering start-ups; Dubai South and Expo City Dubai sit beside Jebel Ali and Al Maktoum airport, anchoring logistics and e-commerce fulfilment; Business Bay and the Dubai Future District (with the in5 incubators) hold the proptech, consumer-app and AI start-up base. Around them are DHA-licensed hospitals and clinics, a large real-estate sector, and Dubai government entities whose suppliers are pulled into the DESC Information Security Regulation. Each group faces a different counterparty, and that decides which framework comes first.
Payment firms, wealth platforms and lenders in DIFC answer to the DFSA and the DIFC data protection regime, and their bank partners run vendor assessments that expect ISO 27001, often SOC 2, and increasingly ISO 22301 evidence. PCI DSS scoping follows wherever card data flows.
Internet City, Media City and DMCC software companies sell into UAE enterprises, GCC governments and US or European customers at the same time. ISO 27001 unlocks the Gulf procurement lists; SOC 2 Type II is what US buyers and global partners ask for.
Marketplaces, last-mile platforms and freight-tech firms around Jebel Ali, Dubai South and DP World’s ecosystem hold customer, cargo and payment data and run around-the-clock operations. ISO 27001 with ISO 22301 continuity work is the usual scope, with PCI DSS where they handle cards.
DHA-licensed hospitals, clinics, labs and the digital-health vendors serving them hold sensitive health data under Dubai and federal rules. ISO 27001, ISO 27701 and PDPL readiness are the usual scope, with HIPAA alignment only for those serving US providers.
Developers, property-management platforms and any vendor to a Dubai government entity face DESC ISR expectations flowing down through contracts. An ISO 27001 ISMS aligned to ISR control expectations is the practical way to prepare for the formal assessment.
What we deliver in Dubai
The certificate Dubai enterprises, banks and government-linked buyers recognise first. ISMS scoping, risk assessment, the 93 Annex A controls, internal audit and certification-body coordination — and where a DESC ISR or UAE IA Standard assessment is on the horizon, we align the ISMS to those control expectations so the approved assessor’s review goes smoothly.
ISO 27001 consultingThe report US and global customers ask DIFC fintechs, Internet City SaaS firms and DMCC technology companies for. We scope the Trust Services Criteria, design and implement controls, collect evidence and coordinate the licensed CPA firm through to the signed Type I or Type II report.
SOC 2 guideFor technology vendors and service providers receiving ISO 22301-aligned BCMS clauses from UAE banks under CBUAE continuity and outsourcing expectations: business impact analysis, RTO/RPO, continuity and recovery plans, exercises and certification-audit support. This is the discipline in which our consultants prepared Gulf banks for ISO 22301.
ISO 22301 consultingData inventory and records of processing, lawful-basis records, privacy notices, cross-border transfer safeguards and a breach playbook — built for the UAE’s federal Decree-Law 45 of 2021 and, for DIFC entities, mapped onto the DIFC Data Protection Law. Dubai firms with Saudi customers reuse the same programme for the KSA PDPL.
PDPL compliance guideThe privacy extension to ISO 27001 for Dubai companies juggling the federal PDPL, the DIFC regime and GDPR from European customers. One PIMS gives the Commissioner, your auditors and your enterprise buyers the same evidence set.
ISO 27701 guideManual-first penetration testing that satisfies SOC 2 auditors, ISO 27001 control A.8.8 and the testing evidence UAE banks and government entities ask their vendors for. Retest included; reports written to be read by a counterparty’s vendor-risk team, not just your engineers.
VAPT servicesLaws and regulators
Plain-English summary as of September 2026. Laws change; confirm current obligations with counsel before relying on any line here.
| Law / regulator | Who it covers | What it means in practice |
|---|---|---|
| UAE federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) | Companies on the Dubai mainland and in most free zones that process personal data of individuals in the UAE — excluding DIFC and ADGM entities, which have their own regimes. | Lawful-basis, notice, data-subject-rights, cross-border transfer and breach-notification duties overseen by the UAE Data Office. Executive regulations have been slower to land than the law itself; treat the current status as evolving and build the programme now, since the obligations mirror GDPR closely enough that the work is reusable. |
| DIFC Data Protection Law No. 5 of 2020 | Entities registered in the Dubai International Financial Centre, including fintechs, funds, insurers and their DIFC-based service providers. | A GDPR-style regime enforced by the DIFC Commissioner of Data Protection: registration and notification, records of processing, DPO appointment in defined cases, transfer assessments and breach notification. ISO 27701 on top of ISO 27001 is the cleanest way to evidence it alongside DFSA expectations. |
| Dubai Electronic Security Center (DESC) Information Security Regulation (ISR) | Dubai government entities and, through their contracts, the suppliers and cloud providers that hold or process government data. | A control framework that closely resembles ISO 27001 with Dubai-specific additions. Formal assessment and any resulting certification are performed by DESC-recognised parties; TCSA aligns your ISMS to ISR control expectations and prepares the evidence so that assessment goes smoothly. The Dubai Data Law adds classification and sharing rules for data exchanged with government. |
| UAE Information Assurance (IA) Standard | Critical-sector entities designated under the federal information-assurance regime that traces back to NESA and now sits with the TDRA and the UAE Cybersecurity Council; increasingly referenced in supplier questionnaires. | Control expectations that map well onto ISO 27001 Annex A. Where an assessment by an approved party is required, an ISO 27001 ISMS mapped to the IA Standard is the practical starting point; we build that mapping into the Statement of Applicability rather than running a parallel programme. |
| Central Bank of the UAE outsourcing and business-continuity expectations | Licensed banks and financial institutions, flowing down by contract to their critical technology vendors and service providers in Dubai. | Banks have operationalised CBUAE continuity and outsourcing expectations by writing ISO 22301-aligned BCMS clauses into supplier contracts, with the first deadline wave reported from December 2025. Vendors typically need a working BCMS — BIA, RTO/RPO, tested plans — and in many cases certification by an accredited body. |
| Dubai Health Authority (DHA) data and information-security rules | DHA-licensed hospitals, clinics, laboratories and the digital-health vendors that connect to them. | Health-data handling, localisation and security expectations for Dubai’s private healthcare sector, alongside the federal privacy law. An ISO 27001 ISMS with ISO 27701 privacy controls organises the evidence; HIPAA alignment is only needed for providers serving US clients. |
How we serve Dubai
Our Gurugram team works to Gulf Standard Time and the UAE’s Monday-to-Friday week; the 1.5-hour offset from IST means a question raised in a Dubai morning is answered the same day.
On-site when it matters: kick-off and scoping workshops, control walkthroughs at your DIFC, DMCC or Internet City office, BIA sessions and continuity exercises, and audit days with the CPA firm or certification body — planned into the schedule and quoted upfront.
Named lead auditors and CISA-certified practitioners run the engagement end to end — no hand-off to a junior team after the sale.
One combined programme when you need ISO 27001, SOC 2, ISO 22301 and PDPL together: shared risk assessment, one policy set, one evidence library, and a Statement of Applicability that already carries your DESC ISR or UAE IA mapping.
Every UAE engagement starts with a mutual NDA; documents move through access-controlled channels you approve, and bank- or government-facing artefacts are prepared to survive your counterparty’s own scrutiny. Fixed fee agreed in writing after a short scoping call.
Pricing
Indicative bands for Dubai engagements. Scope, headcount, cloud footprint, number of sites and starting maturity move the number; we give you a fixed figure in writing after a 30-minute scoping call. Engagements are invoiced in USD or INR, with AED on request. CPA attestation and certification-body fees are always separate.
| Engagement | Indicative band | Note |
|---|---|---|
| SOC 2 readiness consulting (Type I or Type II) | USD 2,500 – 6,000 | CPA attestation fee quoted separately by the licensed CPA firm. |
| ISO 27001:2022 implementation and internal audit | USD 3,000 – 8,000 | Certification-body fees separate; DESC ISR or UAE IA mapping included where in scope. |
| ISO 22301 BCMS for bank-vendor clauses | Scoped to sites and critical services | BIA, RTO/RPO, plans, exercises and certification-audit support. |
| VAPT (web application, typical SaaS scope) | From about USD 1,000 per test | Retest included; mobile and API scoped separately. |
| vCISO / vDPO retainer | Monthly retainer, scoped to hours | Named practitioner for bank questionnaires, DIFC Commissioner correspondence and board reporting. |
Straight answers for Dubai companies on SOC 2, ISO 27001, local regulation, timelines and cost.
No. We do not have an office in Dubai or anywhere else in the UAE. Dubai is part of our UAE service area: we are headquartered in Gurugram, India, and serve Dubai from there, with on-site visits across the UAE for kick-off, control walkthroughs, BIA workshops and audit days. Most of an ISO 27001 or SOC 2 engagement runs over video and shared trackers regardless of where the consultant sits, and the on-site days are planned and quoted upfront.
It depends on where you are registered. A company on the Dubai mainland or in free zones such as DMCC, Internet City or Silicon Oasis falls under the federal Personal Data Protection Law, Decree-Law 45 of 2021, overseen by the UAE Data Office. A DIFC-registered entity is instead governed by the DIFC Data Protection Law No. 5 of 2020 and its Commissioner; ADGM entities in Abu Dhabi follow the ADGM Data Protection Regulations 2021. Groups with entities in more than one zone usually run one ISO 27701-style privacy programme and document the jurisdictional differences on top of it.
ISO 27001 is the more common ask from UAE enterprises, banks and government-linked buyers, and it is the certificate most Gulf procurement checklists name. SOC 2 matters when you sell to US or global SaaS customers, who expect a Type II report rather than a certificate. Many DIFC and Internet City firms need both; we build one control set and sequence the certification audit and the CPA examination so evidence is collected once.
Increasingly, yes. UAE banks have translated CBUAE continuity and outsourcing expectations into ISO 22301-aligned BCMS requirements for critical vendors, with the first contract deadlines reported from December 2025. In practice you need a working BCMS — business impact analysis, defined RTO and RPO, tested continuity and recovery plans — and in many cases certification by an accredited body. TCSA builds the BCMS and prepares you for that audit; our consultants have prepared Gulf banks themselves for ISO 22301.
No, and no consultant can. DESC ISR assessments and UAE IA Standard assessments are performed by approved or recognised assessors, and certification decisions sit with those bodies. What we do is align your ISO 27001 ISMS to the ISR or IA control expectations, build the mapping into your Statement of Applicability and prepare the evidence, so the formal assessment goes smoothly and you are not running two parallel programmes.
Engagements run in English — policies, reports, working sessions and audit-facing documents — which is the working language of UAE compliance, vendor-risk and audit teams. This site has Arabic pages for the Gulf, but we do not promise Arabic-language deliverables; where a regulator or counterparty requires Arabic artefacts, we plan translation into the engagement schedule with you.
Gulf Standard Time is 1.5 hours behind IST, so the working days overlap almost completely. We schedule workshops and evidence reviews to Dubai’s Monday-to-Friday week, and a question raised in a Dubai morning is answered the same day. Dubai is a short direct flight from Delhi, which keeps on-site days easy to plan.
Fixed fee, agreed in writing after a scoping call. Typical bands are USD 2,500 – 6,000 for SOC 2 readiness consulting and USD 3,000 – 8,000 for ISO 27001 implementation; ISO 22301 is scoped to your sites and critical services. We invoice in USD or INR, with AED available on request. CPA attestation and certification-body fees are quoted separately by those firms, and we help you scope them so there are no surprises.
Keep Exploring
How we serve Gulf banks, vendors and enterprises, remote + on-site.
Read moreThe ISMS standard — the baseline certificate global buyers ask for.
Read moreThe AICPA attestation US and global enterprise buyers ask for.
Read moreWhat a BCMS is, who demands it, and how certification works.
Read moreSaudi Arabia's SDAIA-enforced privacy law and the UAE's federal PDPL.
Read moreThe UAE's Information Assurance Standards — 188 controls, mapped to ISO 27001.
Read moreTalk to a real auditor
Book a free 30-minute call. We will tell you which framework your buyers or regulator actually need, what it will cost, and how long it takes — and whether we are the right fit.
