Dubai DESC Information Security Regulation (ISR v3) Explained

DESC ISR is Dubai’s information-security regulation for in-scope entities. It sits alongside federal IAR/IAS and privacy obligations — not instead of them.

Related: UAE IAR · UAE PDPL · CSA.

Scope habit: Confirm whether your Dubai entity is designated under DESC ISR (including the ISR version cited in your engagement letter — commonly discussed as v3 in current market language) and map additive controls against your federal IAS baseline.

Where DESC Fits

Emirate-level information security regulation for Dubai
Often additive to UAE IAR/IAS for the same organisation
Contract flow-down common for Dubai government suppliers

The Dubai Electronic Security Center (DESC) publishes and maintains the Information Security Regulation (ISR) for entities under its jurisdiction. ISR is not a replacement for federal information-assurance requirements — it is an emirate overlay. Organisations headquartered in Dubai but operating nationally still map IAS priorities while implementing DESC-specific reporting, testing, or maturity expectations cited in their engagement letters.

Typical Scope Triggers

Applicability is fact-specific. Triggers often include: (1) Dubai government or semi-government contracts referencing DESC or ISR; (2) critical infrastructure or smart-city services operated from Dubai; (3) regulated sectors where DESC coordinates cyber supervision with other UAE authorities; (4) free-zone entities that nonetheless process Dubai government data or connect to emirate-wide platforms. Free-zone status alone does not automatically exempt an entity — review licensing terms and data-flow diagrams with legal counsel.

Preparation Themes

Asset and service inventory for Dubai operations
Control mapping DESC ↔ IAS ↔ ISO 27001
Logging/monitoring and incident evidence for Dubai-hosted systems
Supplier assurance for services supporting Dubai entities

ISR Control Themes (Operational View)

Assessors generally expect demonstrable programmes — not policy PDFs alone — in areas that mirror international best practice but are labelled under DESC / ISR language in your contract:

Security governance — steering committee, approved ISR implementation plan, periodic management review
Identity & access — MFA, privileged access management, periodic recertification for admin accounts on Dubai systems
Network & platform security — segmentation for production vs management, secure configuration baselines for cloud workloads hosted in or serving Dubai
Monitoring & response — SIEM or equivalent centralized logging, alert runbooks, retained investigation records
Resilience — backup and recovery tested for systems supporting Dubai services; BC/DR alignment where ISR cites continuity
Third parties — security clauses and evidence from MSSPs, SaaS vendors, and data centres in the supply chain

Building a DESC Evidence Pack

Reduce last-minute audit panic by maintaining a single evidence repository tagged by control ID and system owner. Minimum useful artefacts include: network and data-flow diagrams for Dubai scope, change tickets for production changes, sample log-review sign-offs, vulnerability scan reports with remediation tracking, and incident tabletop minutes. Align retention with both ISR contractual language and UAE PDPL where personal data is processed in the same environments.

Mapping DESC ISR with IAR and PDPL

Run one unified control matrix instead of three parallel programmes. List each Dubai system once, tag applicable frameworks (DESC ISR, UAE IAS priorities, PDPL processing activities), and attach shared evidence — MFA configuration, SIEM alert reviews, backup test results — with framework labels. Privacy teams add DPIA and breach notification procedures; security operations supply technical logs. During DESC assessments, walk assessors through the matrix so duplicate requests for the same firewall change ticket do not consume calendar time.

Contractors serving multiple emirates should document which legal entity signs the attestation and which infrastructure is in scope. A MSSP hosting Dubai government workloads may inherit ISR flow-down even when the MSSP headquarters sits in another emirate — clarify inheritance in SLAs and subprocessor registers early.

How CyberSilo Helps

IAR / PDPL evidence maps in CyberSilo CSA
Logging and detection evidence with ThreatHawk SIEM
Advisory scoping — contact CyberSilo

Map Dubai and Federal Scopes Together

Use CSA to track DESC and IAR evidence without duplicate spreadsheets.

Talk to CyberSilo UAE IAR Guide

Frequently Asked Questions

Does DESC replace UAE IAR?

No. Treat DESC ISR as an emirate overlay. Federal/sector obligations may still apply. Your compliance programme should list both frameworks on a single matrix so control owners upload evidence once and tag it for DESC, IAS, and PDPL reviewers as needed.

Is ISR v3 the only version that matters?

Use the version cited by DESC / your assessor for your entity. Market language often references v3 — confirm the text you are contracted against.

Do free-zone companies ignore DESC?

Not automatically. Applicability depends on designation, licensing, and contracts — get a jurisdictional map.

Typical Implementation Timeline

Most Dubai entities need four to eight weeks for initial ISR readiness if an IAS baseline already exists: two weeks for scope and gap assessment, two to four weeks for logging and access-control remediation, and one to two weeks for evidence packaging and management review. Greenfield startups without prior assurance should add time for policy creation and asset discovery. Plan DESC-specific workshops with operations teams that own Dubai production systems — not only the compliance function.

IAR · ADHICS · CSA