UAE NESA/SIA & Dubai ISR: Security Monitoring for Compliance

TL;DR — In the UAE, two overlapping regimes govern security operations: the federal UAE Information Assurance (IA) Standard, overseen by the SIA (Signals Intelligence Agency, formerly NESA), and Dubai's Information Security Regulation (ISR), enforced by DESC. Both mandate a security-operations/monitoring capability. NESA/SIA's 39 Priority-One (P1) controls are mandatory for in-scope entities; ISR structures requirements across security domains including SOC operations.

Global vendors rarely write a word about NESA, SIA or DESC — yet for a bank, government supplier or critical-infrastructure operator in the UAE, these are the frameworks an assessor actually tests. Add ADHICS in Abu Dhabi healthcare and the sector-specific overlays, and the common thread is clear: continuous monitoring, run and evidenced.

The two regimes, briefly

• UAE IA Standard (SIA / ex-NESA) — federal, 188 controls, with 39 P1 controls mandatory for all in-scope entities; covers IAM, patch management, data protection, incident response and monitoring. The 2025 v2 update tightened cloud, OT and supply-chain requirements.
• Dubai ISR (DESC) — mandatory for Dubai government entities and their suppliers; ISR v3 spans domains including governance, access control, cloud security, SOC operations and supplier risk.

What both regimes need from your SOC

Strip away the control-numbering and the operational demand is consistent: continuous detection, log retention, incident response readiness, and the ability to show it is running — not just that a policy exists.

Mapping controls to operations

Frequently asked questions

Is NESA still called NESA?

The authority is now the SIA (Signals Intelligence Agency); "NESA" is still widely used for the IA Standard it oversees. The controls and obligations carry over.

We operate in both India and the UAE — one MSSP or two?

One is better. Cloud Armor runs from Hyderabad, Dubai and New York, so a single MSSP can cover both jurisdictions with per-region data residency and fluency in each regulator.

Does ISR require data to stay in Dubai/UAE?

Residency expectations are strongest for government-linked data; in-region or in-tenancy deployment is the clean answer. Talk to us to scope your obligations.

Meeting NESA/SIA or Dubai ISR? Talk to Cloud Armor about a Dubai-operated managed SOC, and price it per asset — in-region data, predictable cost.