DESC Compliance in Dubai: A Practical Guide for Security Teams

For organizations working with Dubai government entities, cybersecurity compliance involves more than installing security tools. Teams need to understand which requirements apply to them, implement the relevant controls, and maintain evidence that demonstrates how information security is managed.

The Dubai Electronic Security Center (DESC) publishes the Information Security Regulation (ISR), a framework designed to help Dubai Government Entities protect information and maintain the confidentiality, integrity and availability of their systems and data. Financial institutions regulated by the Central Bank of the UAE (CBUAE) have a separate set of applicable cybersecurity and technology-risk requirements.

For security and compliance teams, the challenge is turning these requirements into everyday practices. This guide explains the DESC ISR, how it differs from CBUAE requirements, what evidence teams should maintain, and how employee awareness training can support a compliance programme.

What the DESC Information Security Regulation Requires

The DESC Information Security Regulation establishes minimum information security control requirements for Dubai Government Entities. It covers government information in different formats and across business functions. The regulation is organized into 13 domains covering governance, operations and assurance.

Dubai Government Entities must conduct an applicability review to determine which domains and controls are relevant to their circumstances. Implementation should reflect the entity’s risk assessment, systems, information assets and operational needs.

Security teams can consult the official DESC Standards and Policies page to review the published framework and related standards.

Who needs to comply with DESC requirements?

The ISR expressly applies to Dubai Government Entities, including relevant employees, consultants, contractors and visitors engaged with those entities. Other organizations may have obligations under applicable DESC standards, contracts or arrangements involving government information.

However, not every private company in Dubai should automatically be treated as subject to every ISR control. Suppliers, cloud service providers and contractors should establish which requirements apply to their specific relationship, services, data and contractual commitments.

How should security teams begin?

Start by confirming the organization’s scope and the applicable requirements. Then:

1. Identify the systems, information assets, services and business processes within scope.
2. Review the relevant ISR domains and controls.
3. Compare existing policies and technical safeguards against applicable requirements.
4. Record identified gaps, assign owners and establish remediation priorities.
5. Maintain evidence showing how relevant controls are implemented and reviewed.

This process helps teams distinguish between controls that are applicable, controls that need improvement and practices that are useful but not explicitly required in every situation.

How CBUAE Cybersecurity Requirements Compare for Financial Firms

DESC and CBUAE requirements serve different regulatory contexts. DESC’s ISR is designed for Dubai Government Entities, while CBUAE requirements apply to financial institutions and activities within the Central Bank’s regulatory scope.

The CBUAE Rulebook includes requirements for ICT and cybersecurity risk management. Article 8, effective from 14 September 2026, addresses risk identification, mitigation, monitoring, testing, governance and ongoing management for licensed financial institutions covered by that provision.

Financial institutions should consult the current CBUAE Rulebook on ICT and Cybersecurity Management rather than relying on summaries of older provisions.

An organization subject to more than one framework should map each applicable requirement to its corresponding control, owner and evidence. One framework may support another, but satisfying one does not automatically establish compliance with the other.

Security Awareness Training Compliance Evidence for DESC Audits

Employee awareness is an important part of an information security programme. Policies and technical controls can lose effectiveness when employees do not understand their responsibilities or how to report suspicious activity.

The DESC ISR includes requirements relating to communicating information security policies and making employees and relevant external parties aware of security threats and associated business risks. The exact controls and obligations should be checked against the applicable ISR provisions.

Security teams should maintain evidence that demonstrates how awareness activities are planned, delivered and reviewed. Useful records may include:

• Approved information security policies and communication records.
• Training plans linked to relevant security responsibilities.
• Training materials and completion records.
• Employee acknowledgements, where appropriate.
• Assessment results and records of follow-up for identified gaps.
• Records of programme reviews and improvements.

This is a practical checklist, not a claim that every auditor will request every item in every assessment. The evidence required depends on the applicable controls, the organization’s scope and the purpose of the review.

How can teams make training evidence more useful?

Completion records show that an activity took place, but they do not necessarily demonstrate that employees can apply the guidance. Teams can strengthen their programme by combining completion data with suitable assessments, follow-up activities and reviews of recurring risks.

For example, if employees repeatedly struggle to identify suspicious links, the security team can reinforce phishing awareness and evaluate whether subsequent assessments show improvement. Any testing should be proportionate to the organization’s risks and conducted under its approved procedures.

Organizations looking to strengthen their broader cybersecurity awareness training programme should align training topics with relevant policies, employee roles and the risks identified in their security assessments.

Choosing the Best Security Awareness Training in 2026 for Regulated Sectors

The best security awareness training programme is not necessarily the one with the longest course library. For regulated organizations, the programme should address relevant risks, reach the intended employees and produce records that can be reviewed when needed.

Before selecting a training provider or platform, consider five factors.

Relevant content: Training should cover the risks employees encounter, including phishing, social engineering, information handling, access security and incident reporting where relevant.

Role-based learning: Different teams face different risks. Finance, IT, customer-facing staff and privileged users may need additional guidance related to their responsibilities.

Evidence and reporting: Check whether the programme can provide appropriate completion records, assessment results and reports that support internal review.

Follow-up capabilities: Teams should be able to identify incomplete training or knowledge gaps and assign suitable follow-up activities.

Ongoing improvement: Training should be reviewed when business processes, technology, threats or applicable requirements change.

No awareness platform can guarantee regulatory compliance on its own. Organizations still need appropriate policies, risk assessments, technical safeguards, accountable owners and processes for reviewing whether controls work as intended.

Keeping Evidence Audit-Ready All Year

Preparing for an audit becomes more difficult when records are scattered across spreadsheets, email threads and individual folders. Maintaining evidence as part of routine operations makes it easier to identify gaps and respond to requests.

Security teams can establish a simple evidence-management process:

1. Assign an owner to each applicable control. The owner should understand the requirement and the evidence needed to demonstrate implementation.
2. Define what evidence should be retained. Specify the relevant record, where it is stored and who is responsible for maintaining it.
3. Set review intervals. Review records at appropriate intervals and when significant organizational or technical changes occur.
4. Track gaps and corrective actions. Record the issue, responsible owner, target date and current status.
5. Keep evidence traceable. Use consistent naming, access permissions and version control so that records can be located and their context understood.
6. Review the programme with management. Report meaningful gaps, overdue actions and recurring issues rather than relying only on training completion figures.

Evidence should be accurate, appropriately protected and retained according to the organization’s policies and applicable obligations. Teams should not create retrospective records that suggest an activity occurred when it did not.

For organizations that also need to address requirements for government-linked entities, SecureSist’s guide to DESC compliance for government-linked entities in Dubai provides a related reference point.

Frequently Asked Questions

1. Who needs to comply with DESC regulations in Dubai?

The DESC ISR applies to Dubai Government Entities, including relevant people engaged with those entities. Other organizations may have obligations under specific DESC standards, contracts or arrangements involving government information. Each organization should verify its applicable scope.

2. What is the difference between DESC and CBUAE cybersecurity requirements?

DESC’s ISR establishes information security controls for Dubai Government Entities. CBUAE requirements apply to financial institutions and activities within the Central Bank’s regulatory scope. Organizations should identify and map the specific requirements that apply to them.

3. Does DESC require security awareness training for employees?

The ISR contains provisions relating to information security policy communication and awareness of security threats and business risks. Security teams should consult the applicable ISR controls to determine the precise obligations for their entity and maintain evidence of relevant activities.

4. What evidence do DESC auditors ask for?

Evidence depends on the applicable controls and assessment scope. Relevant records may include approved policies, risk assessments, control implementation records, training evidence, audit results and corrective-action tracking. Organizations should confirm the evidence requirements for their specific review rather than assume one checklist applies universally.

5. What should the best security awareness training in 2026 include for compliance?

A useful programme should provide relevant content, appropriate role-based learning, completion records, assessments and follow-up for identified gaps. Reporting should help security teams review participation and programme effectiveness. Training supports compliance but does not replace the wider security controls required by the applicable framework.

Conclusion

DESC compliance requires organizations to understand their applicable obligations, implement relevant information security controls and maintain evidence that supports ongoing review. CBUAE-regulated financial institutions must also assess the cybersecurity and technology-risk requirements that apply to their activities.

Security awareness training is one part of this work. When it is aligned with organizational risks, supported by appropriate records and reviewed regularly, it can help teams demonstrate how security responsibilities are communicated and reinforced.

The practical starting point is to confirm the applicable framework, assign control ownership, address gaps and maintain evidence throughout the year instead of waiting until an audit is approaching.