Three UAE Security Regimes Now Reach the Same Organisations
An organisation in Dubai can sit inside an emirate regulation, a federal standard and a federal data protection law at once. The three overlap in what they cover and share nothing in what they accept as evidence.
The overlap is structural, not accidental
Three separate regimes can reach one organisation in the United Arab Emirates at the same time. Each was written by a different authority for a different purpose.
DESC ISR v3 is issued by the Dubai Electronic Security Center and applies in the emirate of Dubai. It sets 13 control domains.
UAE IAS v2 is issued federally by the Signals Intelligence Agency. It applies across all seven emirates to critical national infrastructure and government entities. It sets 188 controls, of which 39 carry Priority One status.
The UAE PDPL is Federal Decree-Law No. 45 of 2021 and governs personal data across the country, supervised by the UAE Data Office.
How an organisation ends up inside all three
A Dubai entity operating infrastructure that matters nationally, and processing personal data, meets the scope test of each one separately.
It falls under ISR v3 because of where it is. It falls under IAS v2 because of what it runs. It falls under the PDPL because of what it processes. None of those tests references the others.
Suppliers reach the same position by a different route. ISR v3 extends to key suppliers handling Dubai government data. That obligation arrives through a contract clause rather than through the regulation directly.
Where they converge and where they do not
The control content converges substantially. Access management, cryptography, logging, incident response and supplier assurance appear in both ISR v3 and IAS v2. Much of the same work also satisfies the PDPL requirement for appropriate technical measures.
The filings do not converge at all. Each regime has its own assessment process, its own supervisor and its own evidence expectations. A single control set can serve all three. A single evidence pack cannot.
Free zones add a fourth path. Firms registered in the DIFC or ADGM sit under their own data protection regimes rather than the federal PDPL. Supervisors and penalty ceilings differ.
What the ransomware data shows about scope
Government and Defense is the second most claimed UAE sector on this tracker with 13 claimed organisations. Financial Services carries 11 and Energy and Utilities carries 4.
Those three sectors cover most of the population that sits inside more than one regime at once. The combined figure is small against the site total of 112. That is the point worth making. Regulatory exposure is not proportional to claim volume, and a sector with few claims can carry the heaviest consequence per incident.
The cost of treating them as one programme
Organisations usually discover the overlap late, during a first assessment, and respond by building a single combined programme. That works for the controls and fails for the evidence.
Each supervisor asks for artefacts in its own form. A combined evidence pack has to be disassembled under time pressure, once per assessment. That is exactly when the work is hardest to do well.
The cheaper sequence is the opposite. Build one control set deliberately, then produce the evidence packs separately from it. Each assessment then draws from a common source without sharing a format.
What this means for UAE organisations
- Test scope against each regime separately, because none of the three scope tests references the others.
- Build one control set across all applicable regimes, since the technical content converges.
- Build separate evidence packs, because the assessment processes do not.
- Check contracts for flowed-down obligations, which is how most private firms enter ISR scope.
- Confirm whether any group entity is registered in the DIFC or ADGM, since that changes the data protection regime entirely.
- Keep dated test results, because every regime here judges the appropriateness of technical measures after an incident rather than before.
Summary
DESC ISR v3, UAE IAS v2 and the UAE PDPL can reach one organisation simultaneously through three unrelated scope tests. Their control requirements overlap and their evidence requirements do not. Marsad Cyber describes what these frameworks require and holds no accreditation from any UAE authority.
