UAE IAR / NESA Compliance Checklist

Scope & Governance

• Designation / applicability memo approved
• IAS version pinned (v2 vs legacy artefacts retired)
• Roles: information-assurance owner, control owners, auditor liaison

Controls

• P1 controls implemented or formally risk-accepted
• P2 plan with dates and owners
• P3–P4 backlog visible to management

Operations

• Logging/monitoring use cases live — guide
• Incident handling and escalation tested
• Supplier assurance for critical ICT

Privacy Cross-Link

• PDPL overlap mapped where personal data is processed — PDPL

How CyberSilo Helps

• IAR / PDPL evidence maps in CyberSilo CSA
• Logging and detection evidence with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Is this an official government checklist?

No. It is a practical CyberSilo programme outline aligned to common IAR/IAS examination themes.

Why does the title still say NESA?

Search demand. Body language uses IAR/IAS; NESA is noted as legacy branding.

How often should we re-run it?

Monthly for P1/P2 status; deeper quarterly before management review or external assessment.

Related UAE Resources

IAR · Audit · CSA