Dubai DESC Information Security Regulation (ISR v3) Explained

Where DESC Fits

• Emirate-level information security regulation for Dubai
• Often additive to UAE IAR/IAS for the same organisation
• Contract flow-down common for Dubai government suppliers

Preparation Themes

• Asset and service inventory for Dubai operations
• Control mapping DESC ↔ IAS ↔ ISO 27001
• Logging/monitoring and incident evidence for Dubai-hosted systems
• Supplier assurance for services supporting Dubai entities

How CyberSilo Helps

• IAR / PDPL evidence maps in CyberSilo CSA
• Logging and detection evidence with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Does DESC replace UAE IAR?

No. Treat DESC ISR as an emirate overlay. Federal/sector obligations may still apply.

Is ISR v3 the only version that matters?

Use the version cited by DESC / your assessor for your entity. Market language often references v3 — confirm the text you are contracted against.

Do free-zone companies ignore DESC?

Not automatically. Applicability depends on designation, licensing, and contracts — get a jurisdictional map.

Related UAE Resources

IAR · ADHICS · CSA