The Step-by-Step Cyber Security Roadmap for Enterprises Establishing in Dubai

Short answer. Six steps across roughly six months: regulatory scoping, asset and data inventory, identity and access hardening, technical baseline, incident response and governance evidence, then formal assessment. Close the Always Applicable controls and the P1 tier of the UAE Information Assurance Standards first, then layer sector and contractual requirements on top.

The sequence matters more than the calendar. Almost every expensive rebuild we are called in to fix comes from the same root cause: a control was implemented before the inventory that defines its scope existed.

The first question is not which framework to adopt. It is which regimes bind the entity by law, which bind it by contract, and which are simply expected by the market. The three answers are usually different, and the gap between them is where scope inflation lives.

A mainland Dubai entity answers to the federal regime, including the UAE Information Assurance Regulation where it applies and Federal Decree-Law No. 45 of 2021 on personal data. An entity inside DIFC or ADGM is carved out of the federal data protection law and applies its own, with its own supervisory authority. A supplier to a Dubai government entity is pulled into the DESC Information Security Regulation through the contract rather than through statute. Free zone authorities add their own technology and outsourcing expectations on top of all of that.

Deliverable: a one-page map of entities, jurisdictions and binding instruments, with the evidence each one will eventually demand. This document decides the budget for everything that follows, which is why it is worth two weeks of senior attention rather than a paragraph in a kickoff deck.

You cannot scope access control without knowing what can be accessed, and you cannot answer a data residency question without knowing where the data currently sits. The inventory covers systems, data flows, the jurisdiction each store lives in, and a named owner for each.

Two things reliably surface here. The first is shadow infrastructure: a marketing SaaS holding customer records nobody in IT knew about, or a regional office running its own file server. The second is a data flow that crosses a border everyone assumed it did not. Both are cheap to fix at week three and expensive to discover during an assessment.

Deliverable: an inventory that is queryable rather than a slide. If updating it is a manual task, it will be accurate for about a month.

Identity is where the largest risk reduction per dirham sits, and it is also the control family every assessor opens with. Three things need to be true: multi-factor authentication is enforced everywhere rather than available everywhere, privileged access runs through separate accounts that are not used for daily work, and the joiner-mover-leaver process is enforced by a system rather than described in a policy.

Use phishing-resistant factors where you can. In this region, business email compromise and executive impersonation are the dominant attack patterns, and a push-notification factor that a tired finance manager can approve at 11pm is a materially weaker control than a hardware key. We wrote about the full defence in the post on spear-phishing and executive impersonation in the UAE.

Deliverable: an access model, an enforced MFA rollout, and a leaver process that removes access on the day, provably.

Segmentation, logging and monitoring, and backup and recovery. The order inside this phase is less important than the standard applied to each: every one of them has to be verified rather than asserted.

Logging is the one most often declared complete while being unfit for purpose. The test is not whether a SIEM exists. It is whether you can answer, from retained logs, who accessed a given record on a given day four months ago. If the retention window is shorter than the time it typically takes to detect a compromise, the log has no investigative value.

Backup is the second. A backup you have never restored from is a hypothesis. The deliverable for this phase includes a documented restore test with a measured recovery time, not a screenshot of a successful backup job.

This is the phase that turns a set of controls into something inspectable. Playbooks with named escalation paths, at least one tabletop exercise that includes someone from outside the security team, documented policies with approval records, a risk register with named owners rather than departments, and supplier assessments proportionate to the risk each vendor carries.

The Always Applicable controls of the UAE Information Assurance Standards live almost entirely in this phase. They are management controls, they cannot be dropped on the basis of a risk assessment, and omitting any of them is non-conformity with the regulation. The full list, with control identifiers, is in our post on the Always Applicable controls and on the UAE IA (NESA) reference page.

Build the evidence pipeline in this phase rather than after it. If evidence is collected manually, it will be reconstructed under pressure, and reconstructed evidence is what audits are lost on.

A gap assessment against the framework that binds you, producing the evidence pack a regulator or a customer will ask to inspect. For most groups this is a UAE IA gap assessment, a DESC ISR readiness review, or an ISO 27001 internal audit ahead of a certification body visit. See information security audit in Dubai for what each of those covers.

Run it as though it were the real thing. An internal assessment that goes easy on the organisation produces a comfortable report and an unpleasant surprise three months later.

Buying tooling before the inventory. A monitoring platform scoped against an incomplete asset list monitors the wrong things at the wrong cost, and the licence is usually annual.

Writing policy before the control exists. A policy that describes a control nobody operates is worse than no policy: it converts a gap into a documented non-conformity.

Hiring before automating evidence. Governance headcount is driven almost entirely by manual evidence collection. Automate first, then discover how few people you actually need.

We run this roadmap as an engagement from our Dubai base at Meydan. Scoping and workshops happen on site, assessment and documentation work happens remotely against systems you control, and assessment data stays on infrastructure inside the UAE, including fully air-gapped environments. See cyber security consulting in Dubai, or IT security governance in the UAE if the governance layer is the part that is missing.