Standards & Policies

The purpose of the Information Security Regulation is to provide all Dubai Government Entities with the standards to ensure continuity of critical business processes, and minimize information security related risks and damages by preventing and/or minimizing information security incidents. It intends to ensure appropriate level of Confidentiality, Integrity and Availability for information handled within Dubai Government Entities.

The Information Security Regulation is a technology neutral framework and will not handle any technological implementation. Therefore, technology specific aspects for implementation will be tackled by Dubai Government Entities reflecting specificities in their internal systems.

The Information Security Regulation presents the minimum requirements for information security controls and is applicable to all Dubai Government Entities, including but not limited to employees, consultants, contractors and visitors who are not government employees but are engaged with it through various means. Furthermore, the regulation applies to any government information regardless of its type and medium (e.g. Printed, Electronic and Non-Electronic Verbal, Written, etc.) covering all business functions and divisions of the Government entity.

The information Security Regulation is broken down into thirteen domains. Each domain takes into consideration one or more major classes of information security: Governance, Operation, and Assurance. The Governance domains set high-level requirements for structuring and managing information security. The Operation domains are technical and/or non-technical controls an entity may use depending on the results of their risk assessment study. The Assurance domains act as the quality assurance for the entity, ensuring that the implemented solution is working as intended.

Dubai Government Entities must conduct an applicability review of the Information Security Regulation domains and controls to determine which of these domains and controls are applicable to them. Dubai Government entities must commit resources to achieve the “right-fit” implementation, while considering the risk assessment results, and keeping the controls implementation cost lower than the anticipated risk or value of information, which is being protected.

Dubai Government Information Security Regulation was formalized pursuant to Resolution No. 13 of 2012 based on leading information security regulations, frameworks, policies and practices. Further, based on Dubai Law No. 11 of 2014, DESC has the responsibility of maintaining and continuously improving the Information Security Regulation (ISR) in order to address the latest information security practices and related control requirements.