Convoys · Compliance and Assurance · UAE IA and CBUAE
UAE Information Assurance, with the Central Bank of the UAE. Coming soon
Expected Q1 2027. United Arab Emirates. Regulator: UAE Cyber Security Council; Central Bank of the UAE (CBUAE).
Two regimes for the United Arab Emirates. The UAE Information Assurance Standard carries the technical controls a cluster can evidence; for banks, a regime for the Central Bank of the UAE's requirements reports the same evidence in the Central Bank's own numbering. For banks they are sold together; government and other critical-sector organisations take the Information Assurance Standard alone.
These regimes are in preparation. The structure below is taken from the published standard; how each control will be evidenced is planned, and is confirmed when the regimes are released.
Who they apply to
Federal government, critical infrastructure, and banks.
The UAE Information Assurance Standard, version 2.1 of November 2025, is issued by the Cyber Security Council of the United Arab Emirates. It applies to federal ministries and authorities, to critical information infrastructure entities outside government, and to Emirate government entities where no Emirate programme exists. Banks are critical information infrastructure.
The Central Bank of the UAE sets its requirements for the institutions it licenses, banks among them, in its Operational Risk Management Regulation, in force since September 2026. Its article on ICT and cybersecurity asks for a board-approved framework, regular testing of controls, a plan to retire unsupported systems, the master system of record kept in the UAE, and compliance with the cybersecurity regulations of the other UAE authorities, which brings the Information Assurance Standard in.
Structure
Fifteen families, 134 controls.
The Information Assurance Standard has six management families and nine technical ones. Each control is either always applicable, so that omitting it is a non-conformity, or applicable on the strength of a risk assessment, and each carries a priority from 1 to 4. The convoy maps each control and reports the always-applicable ones first. The Central Bank regime is smaller: the requirements of its ICT and cybersecurity article, in its own numbering.
- M1 Strategy and planning 11
- M2 Risk management 10
- M3 Awareness and training 8
- M4 Human resources 6
- M5 Compliance 6
- M6 Performance evaluation and improvement 6
- T1 Information assets 12
- T2 Physical and environmental security 13
- T3 Operations management 18
- T4 Network security 5
- T5 Identity and access management 12
- T6 Third parties 6
- T7 Acquisition, development and maintenance 9
- T8 Incident management 9
- T9 Continuity 3
Evidence, as planned
What the cluster will show, and what remains yours.
- Enforced, checked and platform (planned). The technical controls a cluster can evidence sit mainly in the families for information assets, operations management (configuration baselines, change, separation of environments, capacity, malware, backup, logging, monitoring and time), network security, identity and access management, and secure development.
- Your evidence (planned). The six management families, physical security, third parties, incident management and continuity are your organisation's to evidence, and the report will list each as such.
- For banks, the Central Bank's numbering. The Central Bank regime draws on the same evidence and reports it against the Central Bank's article, for the board and the risk function.
The mapping
Mamluk's mapping, keyed to NIST.
Each requirement is mapped to the NIST SP 800-53 Rev. 5 controls it corresponds to, and each NIST control to the checks that evidence it in the cluster. The checks and their NIST mapping are shared by every regime, so a cluster is scanned once and each regime selected is reported from the same evidence, in its regulator's own numbering.
The UAE Information Assurance Standard is the one regime whose regulator maps every control to NIST SP 800-53 itself, and the convoy takes that mapping as published. Where it differs from what a cluster check evidences, the difference is recorded, not corrected silently. The Central Bank's requirements are mapped to NIST by Mamluk.
The mapping is Mamluk's, and the report says so. It records the technical evidence the cluster provides; it does not make an organisation compliant, and compliance is determined by your assessor.
Regimes
One convoy, every regime.
Every regime runs in the same installation of the convoy. An organisation that answers to two regulators selects both, and each is licensed separately. The convoy is experimental; the regimes not yet available are coming soon.
- NCA Essential Cybersecurity Controls, ECC-2:2024 (Saudi Arabia). Available.
- Qatar Central Bank, Technology Risks (Qatar). Expected Q1 2027.
- SAMA Cyber Security Framework (Saudi Arabia). Expected Q1 2027.
- UAE Information Assurance Standard v2.1, with the Central Bank of the UAE's requirements for banks (United Arab Emirates). Expected Q1 2027.
- SAMA Cyber Resilience Fundamental Requirements, for new and sandbox financial entities (Saudi Arabia). Expected Q3 2027.
- Central Bank of Bahrain Rulebook, module OM-5.5, for conventional and Islamic banks (Bahrain). Expected Q3 2027.
- National Information Assurance Standard (Qatar). Expected Q4 2027.
- Central Bank of Kuwait Cyber and Operational Resilience Framework (Kuwait). Expected Q4 2027.
Price and availability
Each regime is licensed at USD 24,000 per organisation, per year, with the Tersane core licence; there is no base fee. The convoy needs Kubernetes 1.36 or later, which BKE provides from 2.2.0. See the Compliance and Assurance Convoy for how it works, and its documentation for installation.
Discuss UAE IA and CBUAE
To discuss the regimes your organisation must meet, or the convoy's licensing, contact Mamluk.
Contact Mamluk