NESA is not optional. If you operate in a critical sector in the UAE — energy, government, banking, telecom, transport or healthcare — the Information Assurance Standards framework applies to you, whether you have started the work or not.
A quick naming note before we go deeper. The framework was published by the National Electronic Security Authority (NESA) in 2014. In 2020 NESA was absorbed into the UAE Signals Intelligence Agency (SIA), and policy responsibility now sits with the UAE Cyber Security Council. The standards themselves did not go away — they are still in force, still audited, and still universally referred to as "NESA compliance" or the "UAE Information Assurance Standards" (UAE IAS). When clients ask whether NESA is still a thing because the agency name changed, the answer is yes. The controls did not change. Only the letterhead did.
Most of the calls we get start the same way: an audit notice landed, and the internal team has 90 days to close gaps that took three years to open. We can help. But the version of this story where you are not panicking starts twelve months earlier.
IP Care has delivered end-to-end NESA programmes from our Abu Dhabi office for two decades — gap assessment, remediation roadmaps, control implementation, IAS audit preparation and ongoing controls operation across financial services, government, energy, healthcare and critical infrastructure. We are not a Big Four consultancy with a templated workbook. We are a working IT and security operations company that lives inside these environments every day, which is why our remediation work is implementable instead of theoretical.
This page explains what NESA / UAE IAS actually requires, what an audit looks like, how long a real programme takes, what it costs, and how to sequence the work so the first audit becomes a routine checkpoint rather than a fire drill. If you are at the start of your compliance journey, read it through. If you have an audit notice in hand, skip to "If you have 90 days" below — we have run that play many times.
— What the framework actually is —
The UAE IAS is a tiered control framework similar in spirit to ISO 27001 and NIST 800-53, but specifically scoped to UAE critical-sector entities. It defines six management domains (M1–M6) covering governance, risk management, awareness, human resources security, compliance and performance evaluation, and nine technical domains (T1–T9) covering asset management, physical security, operations, communications, access control, third-party security, information systems acquisition and development, incident management and continuity. There are 188 controls in total, though not every control applies to every organisation — applicability is determined by your sector and your risk profile.
Each control is assigned one of five priority levels (P1 critical through P5 advisory). Most audit findings cluster at P1 and P2, which is also where regulators focus enforcement attention. A defensible compliance posture means closing every P1 and P2 gap with evidence — control description, owner, frequency, last-tested date, and an artefact that proves the control actually runs.
— What the audit looks like —
NESA audits are not surprise visits. They are scheduled, often through your sector regulator (UAE Central Bank, TDRA, ADNOC GRP, FAHR depending on sector). The auditor will request evidence in advance through an Information Assurance Maturity Model (IAMM) questionnaire that scores each control on a 0–5 scale. Site visits follow, typically two to five working days for a mid-size organisation, during which the auditor walks the floor, interviews control owners and pulls sample evidence.
The most common reason organisations fail the first audit is not missing controls — it is missing evidence. Controls exist, they just are not documented, dated, owned or tested on a schedule the auditor can verify. The fix is unglamorous: an evidence repository, named control owners, calendar-driven attestation, and a quarterly internal review. We build that operating rhythm into every engagement.
— Sector-specific notes —
Banking and financial services. The UAE Central Bank Information Security Regulation (CB IBR) and the SCA cyber rules layer additional requirements on top of NESA — particularly around payment systems, third-party risk and incident reporting. Banking clients run NESA and CB IBR as a single programme; the overlap is roughly 80%.
Energy and utilities. ADNOC and federal energy entities apply additional operational technology (OT) security expectations on top of NESA — segmentation of IT and OT networks, ICS/SCADA hardening, vendor remote-access controls. NESA T6 (third-party) and T8 (incident management) are typically the heaviest workstreams.
Government and federal entities. UAE government bodies operate under a stricter version of the framework with additional classification, data residency and personnel vetting requirements. The Federal Authority for Government Human Resources (FAHR) requirements on cleared personnel are often the slowest path-item on the critical path.
Healthcare. DOH Abu Dhabi and DHA Dubai both reference NESA as the baseline information security standard for licensed health facilities. Patient data classification, medical device security and clinical system continuity are the typical hot spots.
Telecom. TDRA enforces the framework directly through the operator licensing regime. Telecom audits tend to be deeper on T4 (operations management) and T5 (communications security) than other sectors.
— Timeline and cost —
For a mid-size enterprise (500–2,000 users, single primary data centre, moderate cloud footprint) starting from "we have controls but no NESA mapping", expect a 6–9 month first pass. Gap assessment is 4–6 weeks. Roadmap and prioritisation, 2 weeks. Remediation, 4–7 months, with about a third spent on policy and process work and two-thirds on technical controls. Mock audit and evidence consolidation, 4 weeks. Real audit, typically 5–10 working days on site.
Indicative cost ranges, all in AED, for the same mid-size profile: gap assessment AED 60,000–120,000; remediation roadmap and programme management AED 80,000–180,000; technical control implementation AED 250,000–900,000 depending on what tooling needs to be deployed (a SIEM, DLP, PAM or vulnerability management platform are the biggest cost drivers); annual ongoing controls operation and attestation AED 180,000–360,000. These are real numbers from real engagements. We will give you a fixed-price scoped proposal after the initial assessment — never an hourly meter.
— If you have 90 days —
A 90-day window is tight but workable if you start right. We run a compressed engagement: weeks 1–2 are an emergency gap triage focused only on P1 controls; weeks 3–10 are parallel-track remediation with us doing the heavy lifting alongside your team; weeks 11–13 are evidence consolidation and a mock audit. The deliverable is not full compliance — it is a defendable audit position with a credible remediation plan for the P2–P3 controls that did not close in time. Auditors will accept this if the plan is real, costed, owned and on a published timeline. They will not accept "we will get to it eventually."