UAE Information Assurance Regulation (IAR) Explained: TDRA, Scope and Who Must Comply

Who Typically Must Comply

Federal and emirate-level critical-sector entities, government entities, and organisations designated under UAE information-assurance programmes. Exact applicability depends on sector designation, licensing, and contract flow-down — confirm with counsel and your competent authority / sector regulator.

How the UAE Stack Fits Together

• IAR / IAS — national information-assurance baseline (this pillar)
• UAE PDPL — Federal Decree-Law No. 45 of 2021 — PDPL explained
• DESC ISR — Dubai entities — DESC ISR
• ADHICS — Abu Dhabi healthcare — ADHICS
• CBUAE — banks and licensed financial institutions — CBUAE IA

Programme Start Points

• Confirm designation and scope boundaries
• Score controls by priority — P1–P4
• Stand up logging/monitoring evidence — SIEM requirements
• Use the IAR / NESA checklist

How CyberSilo Helps

• IAR / PDPL evidence maps in CyberSilo CSA
• Logging and detection evidence with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Is NESA the same as IAR/IAS?

NESA is the legacy brand. Current buyer and tender language usually says IAR (regulation/assurance framework) and IAS (control standard). Map old NESA references to IAR/IAS rather than running two programmes.

Does IAR replace UAE PDPL?

No. IAR/IAS is information assurance; PDPL is personal-data protection under Federal Decree-Law No. 45 of 2021. Many entities need both.

Do Dubai entities only follow DESC?

Dubai entities often face DESC ISR plus federal/sector obligations. Map emirate and federal scopes explicitly.

Related UAE Resources

IAS v2 · Audit · vs ISO 27001 · CSA