DESC ISR certification is the Information Security Regulation issued by the Dubai Electronic Security Center. It applies to Dubai government entities, semi-government organisations and companies handling Dubai government data, and requires a documented information security management system assessed by an authorised auditor. Certification is granted after an independent audit confirms the mandated controls are implemented and operating.
Key Takeaways
- DESC ISR is mandatory for Dubai government entities, semi-government bodies and their service providers handling government data.
- The regulation is control-based and covers governance, asset management, access control, operations, incident response and business continuity.
- Certification requires an independent audit by a DESC-authorised assessor, not a self-declaration.
- ISO 27001 work transfers substantially, but ISR adds Dubai-specific requirements that ISO alone does not cover.
- Annual surveillance keeps certification valid — it is an ongoing programme, not a one-time project.
What is DESC ISR?
The Dubai Electronic Security Center (DESC) is the authority responsible for information security across the Emirate of Dubai. The Information Security Regulation, usually shortened to ISR, is the control standard DESC issues and enforces.
ISR defines a set of mandatory security controls organised into domains familiar to anyone who has worked with ISO 27001 or NIST: governance and risk, human resources security, asset management, access control, cryptography, physical security, operations security, communications, acquisition and development, supplier relationships, incident management, continuity and compliance.
The difference from a voluntary framework is enforcement. ISR is a regulatory obligation for in-scope entities, certification is granted by audit rather than claimed, and non-compliance is a governance issue with the regulator rather than a missed best practice.
Who must comply with DESC ISR?
Scope catches more organisations than many realise. In-scope entities generally include:
- Dubai government departments and authorities.
- Semi-government entities and Dubai government-owned companies.
- Organisations operating critical infrastructure within the Emirate.
- Private-sector service providers that host, process or access Dubai government data — including cloud providers, managed service providers and software vendors.
That last category is the one that surprises people. A private company with no obvious government role can fall in scope purely because it holds a contract that involves government data. If your contracts reference DESC or ISR compliance as a deliverable, you are in scope, and the obligation usually sits with you rather than your client.
What does the certification process involve?
- Scope definition. Establish which entities, systems, locations and data are covered. Scope errors are the most expensive mistake at this stage, because they are discovered during audit.
- Gap assessment. Measure current controls against ISR requirements and produce a prioritised remediation plan with owners and dates.
- Remediation. Implement the missing controls — policy, technical and procedural — and run them long enough to generate evidence.
- Internal audit. Test the controls yourself before the assessor does, and close findings while they are still cheap to fix.
- Certification audit. An independent DESC-authorised assessor reviews documentation, tests controls and interviews staff.
- Surveillance. Maintain the programme and re-certify on the required cycle.
The timeline for an organisation starting from a low maturity base is typically six to twelve months. Organisations with an established ISMS often complete it in three to six.
How does ISR compare with ISO 27001 and NESA?
If you already hold ISO 27001 certification, much of the work transfers. Both are management-system standards built on risk assessment, documented controls and evidence of operation. The ISMS, risk register, policy set and internal audit programme carry across.
What does not transfer is the Dubai-specific layer. ISR mandates particular controls where ISO allows you to justify exclusions through a statement of applicability, and it sets expectations around data handling and incident reporting that reflect Dubai government requirements.
NESA / UAE IA Standards operate at federal level for critical national infrastructure. An entity can be subject to both — a Dubai semi-government body in a critical sector, for example. The control overlap is substantial, so a combined compliance programme is almost always more efficient than running two separate projects.
Common reasons organisations fail the audit
- Policies without practice. A complete policy library with no evidence that anyone follows it. Assessors test operation, not intent.
- Incomplete asset inventory. Controls cannot be evidenced on assets nobody has recorded, and shadow IT is routinely discovered during audit.
- Access reviews not performed. Certification campaigns either never run or approved in bulk without review.
- Untested continuity plans. A business continuity document that has never been exercised is a finding in every framework.
- Supplier controls unmanaged. No evidence that third parties handling in-scope data meet the required standard.
Most of these are evidence problems rather than capability problems. The control exists; nobody captured proof that it operated. Capturing evidence continuously through the year is far cheaper than reconstructing it in the weeks before an audit.
Frequently Asked Questions
Is DESC ISR certification mandatory?
Yes, for in-scope entities. Dubai government departments, semi-government organisations and private companies that handle Dubai government data are required to comply and to hold certification confirmed by an authorised assessor. It is a regulatory obligation rather than a voluntary standard.
How long does DESC ISR certification take?
Typically six to twelve months for an organisation starting without an established information security management system, and three to six months for one that already holds ISO 27001. The variable is remediation, not audit — controls need to be operating long enough to produce evidence.
Does ISO 27001 cover DESC ISR requirements?
Partially. The management system, risk assessment, policy framework and internal audit programme transfer directly. ISR adds mandatory Dubai-specific controls and data handling requirements that ISO 27001 does not include, so a gap assessment against ISR is still needed.
Who can perform a DESC ISR audit?
Only assessors authorised by the Dubai Electronic Security Center. Self-assessment can support your internal readiness work, but certification requires an independent audit by an approved body.
What happens if we fail the certification audit?
You receive findings to remediate and a timeframe to address them, followed by re-assessment of the affected controls. The practical cost is delay and re-audit fees, so a thorough internal audit before the formal assessment is worth the effort.
Do we need to re-certify every year?
Certification is maintained through periodic surveillance and re-certification on the cycle DESC sets for your entity type. Treat it as a continuing programme with ongoing evidence capture rather than a project that finishes at certification.
Talk to a UAE Cybersecurity Team
Cybersecurity MEA supports Dubai entities through DESC ISR scoping, gap assessment, remediation and audit readiness. Our cyber consulting and advisory practice covers ISO 27001, NESA and ISR as a combined programme, and our Client Delivery Office can manage the remediation work to a regulatory deadline. Talk to our UAE compliance team about where your organisation currently stands.