VARA
v2.0
SECURE
ITSEC
SEC_PROTOCOL
ACTIVE
VARA Technology & Information Rulebook Compliance

VARA Cybersecurity
Compliance & Testing
Services

Independent testing and advisory mapped to the VARA Technology & Information Rulebook 2.0 — for VASPs licensed by, or applying to, VARA.

Consult Cyber Experts
Rulebook-Aligned
NDA Protected
Certified Experts
24/7 Support
What is VARA?

Virtual Assets Regulatory Authority — Dubai's dedicated regulator for Virtual Asset Service Providers (VASPs).

VARA licenses and supervises every VASP operating in or from the Emirate of Dubai (excluding DIFC). Its Rulebooks set firm-wide and activity-specific obligations covering custody, exchange, broker-dealer, lending, advisory, transfer, and management services — with cybersecurity controls embedded across each rulebook.

Scope

All Dubai VASPs ex-DIFC

Exchanges, custodians, brokers, advisors, transfer/settlement, lending platforms.

Frameworks

Rulebook 2.0 + activity-specific rules

Four Compulsory Rulebooks (Company; Compliance and Risk Management; Technology and Information; Market Conduct) plus a rulebook for each licensed activity.

Key Control

Annual VAPT + TLPT

Independent penetration testing at least annually for all VASPs; VARA may additionally require intelligence-led TLPT where it considers this necessary and proportionate.

Regulator

Virtual Assets Regulatory Authority

Established by Dubai Law No. 4 of 2022 — described by VARA as the world's first independent regulator for virtual assets.

Cybersecurity essentials: documented infosec policy and framework, cryptographic key and VA wallet management (Rule I.D), smart-contract audits where relevant, within annual and pre-launch testing (Rule I.E.1), transaction monitoring + Travel Rule integration, incident notification to VARA (Rule I.K), and a BCDR Plan (Rule I.H). TLPT is the advanced tier above the mandatory annual VAPT — VARA may require it where it considers this necessary and proportionate, carried out by an external tester using a scenario-based, intelligence-led approach (in ITSEC's view, comparable to TIBER-EU).

↓ How ITSEC helps — TLPT, smart contract audits, custody security, incident response, Rulebook 2.0 readiness

What is VARA Compliance?

Technology & Information Rulebook — current version, effective 19 June 2025

Under VARA's Technology & Information Rulebook (current version, effective 19 June 2025), all VARA-licensed Virtual Asset Service Providers must implement a comprehensive VASP cybersecurity programme to maintain their licence. This page covers exactly what the Rulebook requires and how ITSEC prepares UAE VASPs for audit.

These are mandatory requirements, not optional guidelines. VASPs must submit their Cybersecurity Policy to VARA as part of licensing (Rule I.B.1), and under Article 20 of Dubai Law No. 4 of 2022 VARA may impose fines and may suspend a permit for up to six months or revoke it. Whether you're already operating in Dubai or planning to establish your VASP, these requirements apply from licensing onward.

Related service
Threat-Led Penetration Testing (TLPT)
Independent Testing

Independent vulnerability assessment and penetration testing at least annually (Rule I.E.1), plus Threat-Led Penetration Testing (TLPT) where VARA requires it (Rule I.E.5)

Cryptographic Key Governance

Secure key lifecycle management, custody controls, and Hardware Security Module (HSM) integration

72-Hour Incident Response

Mandatory incident notification to VARA within 72 hours, including BCDR plans and response procedures

How ITSEC supports your Rulebook obligations

ITSEC's VARA work is independent third-party testing for firms that already hold, or are applying for, a VARA licence. For the licensing side, our group company KOLL Group handles VARA licence applications in Dubai, from activity mapping through to submission. KOLL Group is a wholly owned subsidiary of ITSEC L.L.C FZ.

Industry Certifications & Accreditations

ISO/IEC 27001:2022 Certified

Information Security Management

ISO 22301:2019 Certified

Business Continuity Management

CREST Certified

Penetration Testing

UAE Licensed

Meydan Free Zone, Dubai

Trusted by VARA-Licensed Entities

EX

UAE Exchange

BR

Broker Platform

TI

Token Issuance Provider

SN

Settlement Network

DC

Digital Asset Custodian

CT

Crypto Trading Desk

Client names confidential per NDA agreements

Track Record

2011

Serving UAE Regulated Firms Since

vCISO

In the CISO role for multiple VARA-licensed VASPs

24/7

Expert Support

VARA Technology & Information Rulebook: 6 Core Cybersecurity Requirements

The Technology & Information Rulebook establishes mandatory cybersecurity requirements for all Virtual Asset Service Providers in Dubai. Non-compliance puts your VARA licence at risk. Cybersecurity for VASPs in the UAE is no longer optional — it is a licence condition.

* Threat-Led Penetration Testing (TLPT) is set out in Rules I.E.5–I.E.10 of VARA’s Technology and Information Rulebook. In ITSEC’s view it is comparable to what the industry calls red teaming.

Related service
Threat-Led Penetration Testing (TLPT)
Independent Testing (VAPT & TLPT)
Annual independent VAPT under Rule I.E.1; TLPT where VARA requires it under Rule I.E.5
ITSEC Solution: Simulated adversarial attacks
Continuous Monitoring
Continuous monitoring, regular security testing and vulnerability audits (Rule I.E.2)
ITSEC Solution: Automated threat detection
Key Lifecycle Governance
Cryptographic key management & custody controls (Rule I.D)
ITSEC Solution: HSM integration & secure storage
CISO Appointment
Designated Chief Information Security Officer, separate from the Compliance Officer (Rule I.I.1)
ITSEC Solution: Executive security oversight
Incident Response
Incident notification to VARA within 72 hours of detection (Rule I.K.1); BCDR Plan (Rule I.H)
ITSEC Solution: BCDR & response planning
Access Controls & Authentication
Access controls, and procedures that consider multi-factor authentication or a better standard for higher-risk client transactions (Rule I.B.3)
ITSEC Solution: IAM policies & audit trails

Why VARA-Licensed Companies Choose ITSEC.

Operating since 2011, ITSEC is a Dubai-based cybersecurity firm focused on UAE regulated sectors. Our testing and advisory services map to the cybersecurity requirements of VARA’s Technology and Information Rulebook.

UAE-based, CREST-certified penetration testing team
Regulator-grade testing and reporting
Virtual CISO & PDPL Data Protection
Continuous vulnerability monitoring
Proven audit success track record
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Shield
Compliance-Ready Security Architecture
Rulebook-Aligned Testing
Evidence-Based Documentation
Continuous Compliance

ITSEC Services Mapped to VARA Requirements

VARA Mandate ITSEC Solution Compliance Outcome
E.1 – Annual Independent VAPT · E.5 – TLPT where VARA requires it Red Team Simulation (Threat-Led Penetration Testing – TLPT) & VAPT Satisfies external testing requirement
D – Key Lifecycle & Storage Cryptographic Key Governance & HSM Integration Prevents single point of failure
K – 72-Hour Incident Reporting · H – BCDR Plan Incident Response Plan & BCDR Design Achieves regulatory resilience
I – Appointed CISO Virtual CISO & Oversight Supports the CISO governance function
E.2 – Continuous Monitoring & Security Testing Quarterly Security Audits & Vulnerability Scanning Ensures ongoing compliance posture

Tailored Solutions for Every VARA Entity

Exchange
Broker Dealer
Custody
Lending & Borrowing
Management Investment
Issuance
Red Team / TLPT Testing

Simulated attacks on trading, hot wallets, & API endpoints.

Wallet Security Assessment

Hot/cold wallet architecture review and custody control validation.

SOC Integration

24/7 security operations center setup and threat monitoring.

SIEM Implementation

Security Information & Event Management w/ real-time alerting.

Audit Logging

Comprehensive transaction  access logging for regulatory reporting.

Threat Monitoring

Continuous monitoring of trading, order-routing and client API activity for threats.

Vault Security Assessment

Hardware security module (HSM) integration and cold storage validation.

Key Management Protocols

Multi-party computation and threshold signature scheme reviews.

Asset Transfer Controls

Review of withdrawal approvals, address whitelisting and transfer authorization controls.

Smart Contract Security

DeFi protocol audit and liquidity pool vulnerability assessment.

Oracle Security Review

Price feed validation and manipulation resistance testing.

Collateral Management

Security review of collateral, margin and liquidation logic.

Portfolio Platform Security

Investment management system penetration testing and API security.

Fund Administration Controls

NAV calculation integrity and reporting system security audits.

Client Asset Segregation

Multi-tenant architecture security and data isolation validation.

Smart Contract Audit

Line-by-line code review of token contracts and deployment security.

Key Custody Reviews

Multi-signature governance and key management protocol validation.

Issuance Platform Security

End-to-end security assessment of token issuance infrastructure.

5-Step VARA Compliance Process

Day 1
Initial Consultation
Deliverables:
Scope definition ●
gap analysis ●
Project timeline ●
Day 2 - 3
Documentation Review
Deliverables:
● Gap analysis report
● Priority recommendations
● Remediation roadmap
Week 1-2
Independent VAPT (and TLPT if VARA requires it)
Key Deliverables:
VAPT execution ●
Vulnerability assessment ●
Attack simulation report ●
Week 3
Remediation & Documentation
Key Deliverables:
● Security fixes
● VARA-compliant policies
● Regulator-ready reports
Quarterly
Ongoing Compliance
Key Deliverables:
Vulnerability scans ●
Compliance updates ●
Annual independent VAPT (Rule I.E.1) ●

Compliance Packages

Choose the package that fits your compliance needs

Essential Compliance
Contact Us

Perfect for VASPs preparing for their first VARA inspection

✔ TLPT where VARA requires it (Rule I.E.5)
✔ Vulnerability Assessment & Penetration Testing
✔ Basic Key Governance Framework
✔ 72-Hour Incident Response Plan
✔ VARA-Compliant Documentation
✔ Quarterly Vulnerability Scans
✔ Email Support
Get Custom Quote
Most Popular
Complete Assurance
Contact Us

Comprehensive coverage for active exchanges and broker-dealers

✔ Everything in Essential, plus:
✔ Virtual CISO Services (scoped per engagement)
✔ Advanced Key Lifecycle Management
✔ HSM Integration & Configuration
✔ SOC Setup & SIEM Integration
✔ Monthly Security Reviews
✔ 24/7 Incident Response Hotline
✔ Dedicated Compliance Manager
Get Custom Quote
Enterprise Shield
Contact Us

White-glove service for high-volume platforms

✔ Everything in Complete, plus:
✔ Embedded Virtual CISO (dedicated, scope agreed)
✔ Multi-Entity Compliance Coordination
✔ Smart Contract Security Audits
✔ Custom Security Architecture Design
✔ Weekly Status Meetings
✔ Priority VARA Inspection Prep
✔ Continuous Threat Monitoring
✔ SLA-Backed Response Times
Get Custom Quote
Need a Custom Solution?
Frequently Asked Questions

VARA Cybersecurity Requirements Explained

When does VARA's Technology & Information Rulebook take effect?
VARA published Version 2.0 of its activity-based Rulebooks on 19 May 2025, with full compliance required by 19 June 2025 after a 30-day transition; the current Technology & Information Rulebook is also effective from 19 June 2025. All VARA-licensed Virtual Asset Service Providers must comply with these mandatory cybersecurity requirements to maintain their licence. If you have received a VARA audit notification, these are the controls that will be assessed.
What is TLPT and how does it relate to Red Team Testing?
TLPT stands for Threat-Led Penetration Testing. It is the advanced testing set out in Rules I.E.5–I.E.10 of VARA’s Technology and Information Rulebook: VARA may require it where it considers this necessary and proportionate, it must be carried out by an external tester, and it may cover live production systems supporting a VASP’s Critical or Important Functions. In ITSEC’s view it is comparable to what the industry calls red team testing.
How is Red Team different from regular penetration testing?
Red Team engagements (TLPT) simulate real adversary tactics over weeks, testing people, processes, and technology holistically. Regular penetration testing typically focuses on technical vulnerabilities in a shorter timeframe. VARA requires annual independent penetration testing for all VASPs and may require the more comprehensive TLPT (red team) approach where it considers this necessary and proportionate.
Do we need a CISO for VARA compliance?
Yes. Rule I.I.1 of VARA’s Technology and Information Rulebook requires VASPs to appoint a Chief Information Security Officer (CISO), who must be a separate individual from the Compliance Officer; the CISO may also act as Data Protection Officer. The Rulebook does not say whether an outsourced or virtual CISO satisfies this, so confirm your arrangement with VARA. ITSEC vCISOs currently serve in the CISO role for multiple VARA-licensed VASPs.
How soon must incidents be reported to VARA?
Under Rule I.K.1, a material cybersecurity event, or an event triggering the BCDR Plan that materially impacts business operations, must be reported to VARA as soon as reasonably practicable and no later than 72 hours from detection.
How often must security testing be performed?
VARA requires vulnerability assessments and penetration testing by a qualified independent third party at least annually and before introducing any new systems, applications or products (Rule I.E.1), regular security testing and vulnerability audits (Rule I.E.2), and TLPT where VARA notifies the VASP (Rule I.E.5).
What are the consequences of non-compliance?
Under Article 20 of Dubai Law No. 4 of 2022, VARA can impose fines and may suspend a permit for up to six months or revoke it. Applicants must also submit their Cybersecurity Policy to VARA as part of licensing (Rule I.B.1 of the Technology and Information Rulebook).
How long does a VARA compliance assessment take?
Initial gap assessments typically take 1-2 weeks. Full compliance implementation ranges from 6-12 weeks depending on your current security posture. Red Team (TLPT) engagements are typically 1-2 weeks of active testing.
Can you help us prepare for a VARA inspection?
Yes. ITSEC provides comprehensive inspection preparation including documentation review, policy gap analysis, mock inspections, and regulator-grade reporting that meets VARA's expectations.

Related reading

ITSEC UAE cybersecurity coverage map

Ready to Secure Your Digital Assets?

Get a comprehensive security assessment from our expert team. Protecting businesses since 2011.

Consult Cyber Experts
NDA Protected
24hr Response
Global Coverage
×

ITSEC Security Agent

AI-Powered • 24/7 Active

👋 Welcome to ITSEC – UAE's first AI-augmented cybersecurity firm.

I'm your AI Security Agent. How can I assist you with your cybersecurity needs today?
ITSEC AI
Secured by ITSEC AI • ISO 27001 Certified