39 Mandatory P1 Controls: UAE IAS v2.1 Roadmap for IT Managers
Back to Blog

39 Mandatory P1 Controls: UAE IAS v2.1 Roadmap for IT Managers

September 28, 202621 min read

39 Mandatory P1 Controls: UAE IAS v2.1 Roadmap for IT Managers

IT manager reviewing compliance evidence
IT manager reviewing compliance evidence

UAE IAS compliance means implementing the UAE Information Assurance Standard (IAS v2.1) controls under National Information Assurance Framework and Telecommunications and Digital Government Regulatory Authority oversight. P1 controls are mandatory and should be the starting point for any organization still building a program. The first move is simple: begin a P1-focused gap assessment and start gathering the operational evidence auditors will ask for.

TL;DR:

  • Organizations must prioritize their P1 controls, focusing on evidence collection for access management, asset inventories, logging, incident response, and patch management, as they carry the highest regulatory weight.
  • The revised IAS v2.1 emphasizes measurable control effectiveness, continuous monitoring, and executive board sign-off for risk acceptance, making leadership involvement essential for compliance success.
  • Building a current, verifiable evidence trail—such as logs, configuration snapshots, and documented procedures—is more effective than relying solely on policies or informal practices to pass audits.
  • Compliance efforts should follow a structured process: define scope, assess risks, close P1 gaps, and move toward ongoing evidence collection instead of viewing assessments as one-off events.
  • Managed IT services can support continuous monitoring and remediation, enabling organizations to maintain audit-ready controls without overburdening internal teams.

Table of Contents

What the UAE Information Assurance Standard is and who must comply

The UAE Information Assurance Standard, known as IAS, is the national security control framework issued by the Telecommunications and Digital Government Regulatory Authority, commonly called TRA. It sits inside the broader National Information Assurance Framework, which organizes information assurance across UAE sectors through a lifecycle approach rather than a single checklist. NIAF supplies the governance model and sector context; IAS supplies the actual controls organizations must implement and evidence.

Historically, this space was associated with the National Electronic Security Authority, often referred to as NESA, whose mandate was absorbed into the UAE Signals Intelligence Agency. Many practitioners still say "NESA compliance" when they mean IAS compliance, and both terms point to the same underlying control set today. TRA now administers the standard and monitors conformity through the mechanisms NIAF establishes.

Compliance is mandatory for UAE government entities and organizations classified as Critical Information Infrastructure, covering sectors like utilities, finance, transport, and telecommunications. Private companies outside these categories are not legally compelled to adopt IAS, but the standard is widely recommended as a baseline for any organization handling sensitive data or operating systems that a breach would seriously disrupt.

The UAE Information Assurance Regulation defines compliance as the implementation of specified security controls and sub-controls, with certain controls marked "Always Applicable," meaning omitting them is treated as non-conformity regardless of an organization's risk appetite. That single design choice explains why so much of IAS work is really about evidence, not intent.

Who needs to pay attention:

  • Government entities: federal and local government bodies fall squarely inside mandatory scope.
  • Critical Information Infrastructure operators: utilities, financial institutions, telecom providers, and transport authorities.
  • Regulated private sector firms: entities in sectors where regulators have adopted IAS as a supervisory expectation.
  • Voluntary adopters: private companies using IAS as a credible security baseline even without a legal mandate.

IAS does not operate in isolation from other UAE data protection rules. Organizations already building a breach response plan under the country's data protection law will recognize much of the evidence discipline IAS demands, and it is worth reading the two together rather than treating them as separate projects, as outlined in this UAE PDPL compliance plan.

What changed in IAS v2.1 and why it matters operationally

IAS v2.1, released in November 2025, is not a cosmetic update. According to KPMG's analysis, the revision shifts the standard toward measurable control effectiveness, explicit executive ownership of cyber risk, and materially stricter evidence and monitoring expectations compared with the earlier v1.1 baseline.

For an IT manager who lived through a v1.1 audit, the practical differences show up in a few places:

  • Outcome over intent: assessors increasingly want proof a control works, not just a policy stating it exists.
  • Expanded third-party and cloud scope: supplier and cloud provider risk now carries more weight, reflecting how much UAE infrastructure runs on outsourced platforms.
  • Executive accountability: risk acceptance decisions need board or senior leadership sign-off, not just an IT department signature.
  • Continuous assurance language: point-in-time audits are being supplemented by ongoing monitoring expectations rather than an annual snapshot.

IAS v2.1's emphasis on executive accountability means compliance teams should secure explicit board sign-off and risk acceptance records before an audit begins, according to KPMG. That single procedural change catches many organizations off guard, since prior cycles rarely required that paper trail.

The third-party dimension deserves particular attention. MAST Consulting's review of the update notes that v2.1 strengthens requirements around third-party security, continuous monitoring, and supply chain risk, effectively making supplier governance a standalone compliance item rather than an afterthought bundled into a general risk register. Organizations running workloads across multiple cloud providers should treat this as a signal to formalize vendor oversight, a topic covered in more depth in this multi-cloud strategy guide.

Common failure patterns under the new version tend to cluster around three areas: policies that exist on paper but have no corresponding log or configuration evidence, cloud and vendor contracts that predate the standard and were never re-reviewed against it, and risk acceptances that were never formally escalated to leadership. None of these are technically complex to fix, but all three require someone to own the paperwork trail, which is exactly the gap v2.1 is designed to close.

How the IAS controls are organized

The IAS control set consists of 188 security controls, split between 60 management controls and 128 technical controls, according to Secuara's compliance guide. Management controls cover governance items like policy, risk management, and human resources security. Technical controls cover the operational layer: access management, network security, cryptography, logging, and system hardening.

IAS controls divided into management and technical categories
IAS controls divided into management and technical categories

Within that set, 39 controls are designated P1, meaning they are mandatory and non-negotiable for every in-scope entity regardless of size or sector, per the same Secuara analysis. The priority tiers below that, P2 through P4, allow more flexibility based on an organization's risk profile, but P1 controls are the ones auditors check first and the ones that carry the most regulatory weight if missing.

Typical P1 subject areas include:

  • Access control and identity management: who can reach systems and how that access is reviewed.
  • Asset inventory: a current, accurate record of hardware, software, and data assets in scope.
  • Logging and monitoring: evidence that security-relevant events are captured and reviewed.
  • Incident response: a documented, tested process for detecting and handling security events.
  • Patch and vulnerability management: proof that known weaknesses are tracked and closed on a schedule.

Below each control sit sub-controls, which break a broad requirement into specific, checkable actions, and performance indicators, which define what evidence demonstrates the control is actually working. The TRA regulation frames compliance measurement explicitly around this structure: controls, sub-controls, and performance indicators, with some controls marked "Always Applicable" and therefore mandatory regardless of context.

This structure matters for planning because it turns an abstract standard into a checklist an IT team can actually work through. Rather than asking "are we IAS compliant," a manager can ask "which of the 39 P1 controls have documented, current evidence" and get a concrete answer.

Compliance process: assessment, classification, and continuous evidence

A defensible IAS program follows a sequence, not a single audit event. The steps below reflect how Secuara and the TRA regulation describe the assessment lifecycle in practice.

  1. Define scope. Identify which systems, business units, and data flows fall under IAS, including any Critical Information Infrastructure designation.
  2. Assess risk. Map threats and vulnerabilities against the assets in scope to understand where controls matter most.
  3. Determine applicability. Confirm which controls apply given the organization's sector, size, and technology footprint, noting that P1 controls apply universally.
  4. Run the gap assessment. Evaluate each applicable control and classify it as Met, Partial, or Not Implemented based on documented evidence.
  5. Build the remediation roadmap. Prioritize fixes starting with P1 gaps, then move through P2 to P4 based on risk.
  6. Establish continuous monitoring. Move from a one-time audit mindset to ongoing evidence collection that supports future reassessment.

Each control's classification rests on more than a policy document. A proper assessment combines documentation review, stakeholder interviews, and technical verification, according to Secuara. Documentation review checks whether policies and procedures exist and are current. Stakeholder interviews confirm the people responsible for a control actually understand and follow it. Technical verification, the step many organizations underestimate, means pulling actual system configurations, log samples, or scan results rather than accepting a written assurance at face value.

The kind of evidence that satisfies TRA expectations has shifted over recent cycles. A supporting TDRA document notes that the compliance monitoring scheme is built on controls, sub-controls, and performance indicators, and it allows organizations to justify deviations through formally accepted risk decisions rather than forcing a rigid one-size-fits-all outcome, per this TDRA reference document. That flexibility is useful, but it only works if the deviation and the risk acceptance are documented and signed off, not left as an informal understanding between an IT lead and a manager.

Continuous monitoring is becoming the default expectation rather than a nice-to-have. Structured evidence such as logs, configuration snapshots, and test records is now treated as more persuasive than policy documents alone, per the TRA regulation. Organizations that only produce evidence once a year, right before an audit, tend to struggle because the gap between "we have a policy" and "we can prove the policy was followed for the last six months" is exactly where most audit findings land.

Timelines vary depending on scope. A full 188-control gap assessment typically takes four to six weeks, according to Secuara, while a P1-focused review moves faster since it covers a fixed, smaller set of mandatory controls rather than the entire framework.

Pro Tip: Start technical verification before the documentation review finishes. Pulling log samples and configuration exports early often reveals gaps that change what the documentation review needs to check.

Practical implementation roadmap: P1 first, then evidence at scale

A workable roadmap treats P1 controls as regulatory triage. They are what auditors check first and where evidence should be collected before anything else, based on how Secuara frames prioritization inside the standard. The sequence below gives IT managers a realistic order of operations.

  1. Set up governance (weeks one to two). Assign an executive sponsor, name a compliance owner, and get risk acceptance procedures formally approved by leadership, not just IT.
  2. Close P1 gaps (weeks two to eight). Work through the 39 mandatory controls, focusing on access management, asset inventory, logging, incident response, and patching, since these carry the heaviest regulatory weight.
  3. Stand up logging and monitoring (weeks four to ten, running in parallel). Centralize logs and build a review cadence, since this single capability supports several other controls at once.
  4. Formalize incident response (weeks six to ten). Document and test a response plan rather than relying on informal escalation habits, drawing on the breach readiness steps in this PDPL compliance plan.
  5. Move to continuous operations (ongoing from week ten). Shift from a one-time evidence push to a recurring collection cycle that keeps controls audit-ready year-round.

Quick wins worth tackling early: building a current asset inventory, turning on centralized logging where it does not already exist, and documenting existing informal processes so they generate paper evidence instead of living only in someone's head. None of these require large budgets, but all three produce evidence an auditor can actually check.

Resourcing is where many organizations stumble. Some try to run the entire program with an internal IT team already stretched across day-to-day operations, which slows the timeline and risks incomplete evidence. Others bring in a managed services partner to run continuous monitoring and evidence collection while internal staff handle governance and remediation decisions, an approach covered in this managed IT services guide for UAE enterprises. Managed providers such as NEXTmsp offer ongoing monitoring and security operations support that can complement an internal compliance owner rather than replace one.

Pro Tip: Assign one named owner per P1 control area, not one owner for the entire program. A single compliance lead juggling all 39 mandatory controls alone is the most common reason remediation timelines slip.

Practical implementation roadmap: P1 first, then evidence at scale — overview diagram
Practical implementation roadmap: P1 first, then evidence at scale — overview diagram

Roles, governance, and enforcement across TRA, NIAF, and SIA

Three bodies shape how IAS compliance actually gets enforced. TRA administers the standard itself and issues the regulation defining what compliance means and how it is measured, as set out in the UAE Information Assurance Regulation. NIAF provides the governance framework and lifecycle structure that ties IAS to sector-specific standards and broader national information assurance goals, per the NIAF document. The UAE Signals Intelligence Agency, which absorbed the former National Electronic Security Authority's mandate, carries forward the national security oversight function historically associated with NESA.

In practice, these roles divide roughly as follows:

  • TRA: sets and updates the standard, defines compliance measurement criteria, and administers regulatory oversight.
  • NIAF: supplies the lifecycle and governance model that sector regulators use to apply IAS consistently.
  • SIA (formerly NESA): carries the national security oversight function tied to information assurance at a national level.

Compliance monitoring relies on the performance indicators built into each control. Organizations that can point to indicator-level evidence, a log export, a test result, a configuration snapshot, tend to move through review faster than those offering policy documents alone. This is the practical meaning of the shift toward continuous assurance discussed earlier: auditors are trained to look past the policy binder and ask what the system is actually doing.

Non-compliance consequences vary by sector and severity, but the underlying pattern is consistent: gaps in mandatory P1 controls draw more regulatory attention than gaps in lower-priority controls, and unresolved gaps at Critical Information Infrastructure operators carry higher stakes given the potential impact of a disruption. Executive oversight matters here because risk acceptance decisions, under v2.1, need to be visible at the leadership level rather than buried in an IT ticketing system. A board that has never seen a risk acceptance record is a board that cannot answer a regulator's questions when something goes wrong, a governance gap explored further in this cybersecurity fundamentals guide for Dubai leaders.

Common gaps in IAS assessments and how to close them

The same handful of gaps show up across most IAS assessments, and none of them require exotic technology to fix.

  • Policies without supporting evidence: a written access control policy with no log showing access reviews actually happened.
  • Missing or outdated asset inventories: systems in production that never made it onto the register auditors check against.
  • No patching evidence: patches applied informally with no ticket, changelog, or scan report proving the work.
  • Thin logging coverage: logs collected on some systems but not centralized or reviewed on any regular cadence.
  • Unformalized risk acceptances: known gaps tolerated informally with no documented sign-off from leadership.

For each of these, the fix is less about new tools and more about discipline. An access control gap closes with a quarterly access review log, kept as a simple spreadsheet or exported from an identity management system, showing who was reviewed and what changed. An asset inventory gap closes with a single source of truth, updated on a fixed schedule, ideally pulled from an automated discovery tool rather than maintained by hand. A patching gap closes with a change ticket trail tied to a vulnerability scan report showing time-to-remediate. A logging gap closes by centralizing existing logs into one platform and setting a weekly review cadence, even a manual one, rather than waiting for a mature security operations center.

The common thread is evidence with a date on it. An auditor reviewing a P1 control wants to see that the control was active last month, not that it existed on paper at some point in the past.

Pro Tip: Keep a single evidence folder per control, named after the control number, updated every time a review happens. This alone turns a scattered compliance effort into something an auditor can actually navigate.

How YS Lootah Tech supports IAS compliance work

Certain technology firms assist UAE organizations on the technology side of compliance readiness through IT consulting, cloud services, cybersecurity, and enterprise application integration. For teams building toward IAS, that typically means help translating a control requirement into a working system, whether that is hardening an application's access controls, integrating logging across cloud and on-premises environments, or reviewing how a custom-built system handles data in line with technical control expectations.

Because some firms also build custom software and mobile applications, they can address IAS technical controls at the source when a gap traces back to how a system was originally designed rather than how it is configured after the fact. That matters for organizations whose gap assessment turns up findings in code-level access management or data handling rather than infrastructure alone.

Broader work in cloud computing and enterprise application integration gives some providers visibility into third-party and cloud governance questions that IAS v2.1 puts more weight on, since such engagements often involve mapping how data moves between systems and vendors.

Case studies and examples of successful IAS compliance journeys

Publicly documented, named case studies of UAE organizations completing IAS compliance are not widely published, since most entities in scope, particularly Critical Information Infrastructure operators, treat their security posture and audit outcomes as confidential for obvious operational reasons. What is publicly visible is the pattern consultancies describe from working across multiple engagements: organizations that succeed tend to start with governance and P1 controls before touching lower-priority items, and they treat evidence collection as a continuous operational task rather than a pre-audit scramble.

The organizations that struggle share a different pattern: they treat the gap assessment as the finish line rather than the starting point, produce a remediation plan, then let it stall once the initial audit pressure passes. Under IAS v2.1's stronger continuous assurance expectations, that approach is increasingly likely to surface as a finding at the next review cycle, since assessors are looking for evidence spread across time, not a single point-in-time snapshot gathered just before an audit.

The practical lesson for a UAE IT manager building a program is less about copying a specific company's playbook and more about adopting the sequence that consistently works: governance first, P1 controls second, continuous evidence collection as the permanent operating mode rather than a project with an end date.

Tools and technologies that support IAS compliance monitoring

IAS does not certify or mandate specific commercial products. Compliance is measured against controls and performance indicators, not against a vendor's brand name, so the standard itself stays technology-neutral. That said, certain categories of tooling consistently show up in organizations that maintain audit-ready evidence with less manual effort.

Centralized logging and security information and event management platforms address the logging and monitoring P1 controls directly, since they turn scattered system logs into a single reviewable stream. Identity and access management systems support access control evidence by generating a reliable trail of who accessed what and when. Vulnerability scanning and patch management tools generate the timestamped evidence that patching controls require. Configuration management tools help produce the configuration snapshots that increasingly satisfy assessors more than a written policy alone.

Organizations without in-house expertise across all of these categories often lean on a managed services provider such as NEXTmsp to operate monitoring and security tooling continuously, freeing internal compliance staff to focus on governance, risk acceptance, and remediation decisions rather than day-to-day tool operation.

Compliance as leadership, not a checklist exercise

The organizations that handle IAS well treat it as an operating discipline, not a once-a-year scramble. Executive accountability under v2.1 is not a formality: a leadership team that reviews risk acceptances and control evidence regularly builds resilience that outlasts any single audit cycle. Evidence-first remediation, tracked continuously rather than assembled before a deadline, is what actually separates organizations that pass review from those that stall on the same P1 gaps year after year. Compliance officers who pull IT, legal, and executive stakeholders into the same conversation early tend to close gaps faster than those working in isolation.

— YS

How YS Lootah Tech can help with IAS readiness

Getting from a policy binder to audit-ready evidence usually takes more hands than an internal IT team has to spare, especially while daily operations keep running. Some technology partners work with UAE organizations to help translate control requirements into working systems rather than leaving them as documentation exercises.

Yslootahtech
Yslootahtech

Relevant services for an IAS readiness effort include:

  • IT consulting for gap assessment support, control mapping, and remediation planning.
  • Application development for fixing access control, logging, or data handling gaps traced back to how a system was built.
    • AI and machine learning governance support for organizations whose IAS scope now includes AI systems under v2.1's expanded expectations.
  • Cloud and enterprise application integration work for organizations tightening third-party and cloud governance.

If a recent gap assessment left your team with a P1 punch list and a tight timeline, the practical next step is a conversation with IT Consulting about which gaps can be closed fastest and what evidence each fix should produce. Getting the right technical work started now is what turns a remediation plan into an actual audit result.

Sources

For definitive compliance criteria, go directly to the source rather than a summary. Start with the UAE Information Assurance Regulation and the National Information Assurance Framework for the authoritative control and governance language.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

FAQ

Is GDPR compliance mandatory in the UAE?

The EU's General Data Protection Regulation applies to organizations processing the personal data of individuals in the European Union, not to UAE domestic operations by default. UAE organizations instead operate under the country's own data protection law, and those handling EU residents' data may still need to consider GDPR separately based on that specific activity.

Which companies are DESC certified?

DESC certification relates to the Dubai Electronic Security Center's information security regulations for entities operating within Dubai's government and critical sectors, which is a separate scheme from the national IAS standard covered here. Specific certified companies are not publicly listed in a way this guide can verify, so organizations should confirm current certification status directly with the Dubai Electronic Security Center.

What are the new laws in the UAE for 2026?

This guide focuses specifically on IAS v2.1, released in November 2025, which introduced stricter evidence, monitoring, and executive accountability requirements for information assurance rather than a broader 2026 legal package. Organizations tracking wider UAE regulatory changes for 2026 should consult TRA and relevant sector regulators directly, since this article does not cover legislation outside the IAS scope.

Why is the UAE on high alert?

This article does not address broader national security alert levels, since that topic sits outside UAE IAS compliance and the sources behind this guide. For information assurance purposes, the relevant point is that IAS v2.1 reflects a deliberate national push toward stronger cyber resilience, evidence-based compliance, and executive accountability across government and critical infrastructure sectors.

How long does a full IAS gap assessment take?

A full assessment covering all 188 controls typically takes four to six weeks, including documentation review, stakeholder interviews, and technical verification. A P1-focused review covering only the 39 mandatory controls moves faster since it addresses a smaller, fixed set of requirements.

Recommended

Back to all articles

© 2026 All rights reserved

Footer Logo