UAE Information Assurance Standard.

UAE Cyber Security Council (UAE CSC). The Cyber Security Council is the federal authority for cybersecurity in the United Arab Emirates, and issues the UAE Information Assurance Standard.

UAE Information Assurance Standard (UAE IA). The Information Assurance Standard is the UAE's federal standard of security controls, binding on federal government entities and on critical information infrastructure, banks among them. Version 2.1 holds 134 controls in fifteen families, and maps each control to NIST SP 800-53 itself.

The convoy classes each requirement by how its evidence is obtained: enforced by an admission policy, checked in the cluster, provided by the platform, or the organisation's own evidence. An admission policy is a rule Kubernetes applies to each object as it is created or changed, before the object is stored. It can warn about the object and record the result, or refuse the object. How a regulator's requirement becomes evidence follows one requirement from the regulator's text to the result in the report.

The standard has six management families and nine technical ones. Each control is either always applicable, so that omitting it is a non-conformity, or applicable on the strength of a risk assessment, and each carries a priority from 1 to 4. The report shows both beside each control, and lists first the objects that fail an always applicable control.

1. M1 Strategy and planning 11
2. M2 Risk management 10
3. M3 Awareness and training 8
4. M4 Human resources 6
5. M5 Compliance 6
6. M6 Performance evaluation and improvement 6
7. T1 Information assets 12
8. T2 Physical and environmental security 13
9. T3 Operations management 18
10. T4 Network security 5
11. T5 Identity and access management 12
12. T6 Third parties 6
13. T7 Acquisition, development and maintenance 9
14. T8 Incident management 9
15. T9 Continuity 3

Each requirement is mapped to the controls of NIST Special Publication 800-53, Revision 5 (SP 800-53), published by the National Institute of Standards and Technology (NIST), and each NIST control to the checks that evidence it in the cluster. NIST is the United States government's standards agency. Its security publications are free to use, and regulators and auditors outside the United States also use them as a common reference. SP 800-53 is a control catalogue: a numbered list of safeguards, each stating one thing an organisation should do, such as AC-6, least privilege, or AU-11, keeping audit records for a set period. Its controls are grouped in 20 families, and because the catalogue is detailed and open, it serves as a common language between regulations that are each written in their own terms.

The checks and their NIST mapping are shared by every regime, so a cluster is scanned once and each regime selected is reported from the same evidence, in its regulator's own numbering.

The UAE Information Assurance Standard is the one regime whose regulator maps every control to NIST SP 800-53 itself, and the convoy takes that mapping as published. Where it differs from what a cluster check evidences, the difference is recorded, not corrected silently.

The report states whose mapping it uses, in these words: “The mapping of each control to NIST SP 800-53 Rev. 5 is the standard's own, from its Annex D, used unchanged.” It records the technical evidence the cluster provides; it does not make an organisation compliant, and compliance is determined by your assessor.