DESC_GOV
SECURED
Dubai Electronic Security Center - Government Authority

DESC Certification &
Compliance

DESC security certification and compliance services for Dubai government entities and their providers. CSP, Data Center, SOC, IoT, and ICS security standards aligned with Dubai Cyber Security Strategy.

Consult Cyber Experts
What is DESC?

Dubai Electronic Security Center — operator of the Information Security Regulation (ISR v3).

DESC is the Government of Dubai's cybersecurity regulator. Its flagship instrument — the Information Security Regulation (ISR) — applies to all Dubai Government Entities, including their employees, consultants, contractors and visitors. Under Law No. 15 of 2024 (Art. 14), Government Entities and Critical Non-government Entities classified by DESC must comply with DESC regulations and standards. DESC launched ISR version 3.0 in April 2024.

Scope

Dubai government + critical entities

Mandatory for Dubai Government Entities and DESC-classified critical entities; government entities may only engage DESC-certified electronic-security companies (Law No. 15 of 2024, Art. 14).

Frameworks

ISR v3 + DESC CSP certification

Cloud Service Providers serving Dubai government need DESC CSP certification.

Penalties

Penalties and administrative measures

Set by resolution of the Chairman of the Executive Council under Law No. 15 of 2024 (Art. 19); check the current resolution for specifics.

Regulator

Dubai Electronic Security Center

Established by Dubai Government to lead cybersecurity policy and assurance.

What the ISR covers: thirteen domains grouped into governance, operation and assurance controls, applying to government information in any form. DESC CSP certification is mandatory for all cloud service providers offering cloud services to Dubai government and semi-government entities, with annual surveillance audits and recertification every three years.

↓ How ITSEC helps — ISR v3 compliance, DESC CSP certification, SOC standards, IoT security, audit support

Proven Track Record in DESC Compliance

50+
Dubai Gov Entities
8
DESC Schemes Covered
100+
Certified Providers
ISO
27001 Aligned
DESC Accredited Auditor
Dubai Gov Partner
ISO 27001/17/18 Expert
Dubai PKI Certified

What is DESC?

Dubai Electronic Security Center - Government Authority

Dubai Electronic Security Center (DESC) is the government authority responsible for cybersecurity in Dubai, established to make Dubai the safest city electronically in the world. DESC sets cybersecurity standards and certifications and oversees compliance. Compliance is mandatory for Dubai Government Entities and for entities DESC classifies as critical; cloud (CSP) and SOC providers serving Dubai government and semi-government entities must meet the relevant DESC standard, and government entities may only engage DESC-certified electronic-security companies.

Dubai PKI Framework

Secure smart services, blockchain, IoT, and digital identity infrastructure

Dubai Cyber Strategy

Innovation and compliance framework for Dubai's cyberspace security

Incident Response

Dubai Police eCrime portal for efficient cybercrime reporting

DESC Security Standards & Certifications

DESC standards and certification schemes relevant to Dubai government entities and their providers

CSP Security Standard
Cloud Service Provider certification - ISO 27001/27017/27002 aligned
Data Center Standard
Requirements and guidance for data centres and organisations using data centre services
SOC Security Standard
Requirements for in-house and outsourced Security Operations Centre services for Dubai government and semi-government entities
ICS Security Standard
Industrial Control Systems and SCADA security requirements
EBMD Security Standard
Electronic Biomedical Device security for healthcare systems
ISR Compliance
Information Security Regulation audit and compliance framework
IoT Security Standard
Smart city sensors, connected devices, and IoT infrastructure
DESC PKI
Public Key Infrastructure for authentication and digital signatures

Our DESC Compliance Services

CSP Certification

Cloud Service Provider (CSP) Security Standard

Mandatory certification for all cloud providers serving Dubai government entities

Data Center

Data Center (DC) Security Standard

Requirements and guidance for data centres and organisations using data centre services

SOC Standard

Security Operations Centre (SOC) Security Standard

Requirements for in-house and outsourced SOC services for government entities

IoT & ICS

IoT & ICS Security Standards

Smart city IoT devices, Industrial Control Systems, and EBMD security

ISO/IEC 27001:2013 alignment and certification

ISO/IEC 27017:2015 cloud-specific requirements

CSA Cloud Controls Matrix 3.0.1 mapping

Third-party data center security assessment

Multi-tenancy isolation testing

ISO/IEC 27002:2013 security controls implementation

ISR 2017 v.02 compliance validation

Annual surveillance audits & recertification every three years

Cloud configuration security review

Data residency and sovereignty verification

ITSEC Standard

Physical security controls & access management

Power redundancy & UPS systems validation

Storage security & data protection controls

Business continuity & disaster recovery

Co-location security arrangements

Environmental controls (HVAC, fire suppression)

Network infrastructure security assessment

Monitoring & surveillance systems review

Data centre tier design review (e.g. Tier III/IV)

Third-party audit & certification support

ITSEC Standard

24/7 security monitoring capabilities assessment

Threat detection & incident response procedures

Playbook & runbook documentation review

Log management & retention compliance

SOC metrics & KPI tracking validation

SIEM platform configuration & tuning review

Security analyst skills & training validation

Integration with Dubai Police & aeCERT

Threat intelligence integration assessment

Continuous improvement program review

ITSEC Standard

IoT device security assessment (sensors, gateways)

ICS/SCADA security evaluation (OT environments)

Device authentication & authorization review

Network segmentation for OT/IoT zones

Physical tampering protection assessment

Smart city infrastructure penetration testing

EBMD (Electronic Biomedical Device) security testing

Firmware security & update mechanism validation

Encrypted communications verification

Lifecycle security management review

ITSEC Standard

Frequently Asked Questions

What is DESC and who must comply?
Dubai Electronic Security Center (DESC) is the government authority responsible for cybersecurity in Dubai. Dubai Government Entities must comply with the ISR and other DESC standards. Cloud service providers and SOC providers serving Dubai government and semi-government entities must comply with the DESC CSP and SOC Security Standards respectively, and government entities may engage only DESC-certified electronic-security companies.
What is the CSP Security Standard certification process?
The CSP Security Standard is based on ISO/IEC 27001:2013, ISO/IEC 27002:2013, ISO/IEC 27017:2015, ISR:2017 v.02 and the CSA Cloud Controls Matrix 3.0.1. The process includes initial certification, yearly surveillance audits, and recertification every three years. Existing certifications are acknowledged without further audits for those certificates.
How long does DESC certification take?
Initial DESC certification typically takes 3-6 months depending on your current security posture and existing ISO certifications. Organizations with ISO 27001 certification can leverage it to expedite the process. Certification is followed by annual surveillance audits, with recertification every three years.
What is Dubai PKI and how does it integrate with DESC?
Dubai PKI is DESC's Public Key Infrastructure for securing smart services, blockchain, IoT, and digital identity. It supports authentication and digital signatures; check with DESC whether PKI integration is required for your specific government service.
How often is security testing required under DESC?
Testing frequency depends on the applicable DESC standard (for example the ISR, CSP, SOC, IoT or ICS standard) and the criticality of your systems. Check the current version of the applicable standard for exact requirements.
What are the penalties for non-compliance with DESC?
Under Law No. 15 of 2024 Concerning DESC (Art. 19), violations are subject to penalties and administrative measures set by resolution of the Chairman of the Executive Council. In addition, government entities may not engage an electronic-security company that is not DESC-certified (Art. 14).

Related Dubai Government Regulators

DFSA Compliance

Dubai Financial Services Authority

ADGM Compliance

Abu Dhabi Global Market

VARA Licensing

Virtual Assets Regulatory Authority

ITSEC UAE cybersecurity coverage map

Ready to Secure Your Digital Assets?

Get a comprehensive security assessment from our expert team. Protecting businesses since 2011.

Consult Cyber Experts
NDA Protected
24hr Response
Global Coverage
×

ITSEC Security Agent

AI-Powered • 24/7 Active

👋 Welcome to ITSEC – UAE's first AI-augmented cybersecurity firm.

I'm your AI Security Agent. How can I assist you with your cybersecurity needs today?
ITSEC AI
Secured by ITSEC AI • ISO 27001 Certified