Key takeaways
- Four regimes govern security testing in the UAE: CBUAE for banks, DESC for Dubai government entities and their suppliers, NESA and the UAE IAS federally, and ADHICS for Abu Dhabi healthcare.
- None of the four instruments names social engineering as a standalone discipline, but each addresses human-layer security through broader security testing, awareness and physical access controls.
- The authorisation letter, test scope, scenario results and a remediation record form the evidence package that satisfies a regulatory audit.
- An organisation in a regulated sector that has never tested its staff against phishing, vishing or physical intrusion carries an evidential gap a regulator can flag.
- Social engineering testing sits on a continuum from a staff awareness exercise to a full red team engagement; the applicable regulation determines which level is proportionate.
Social engineering testing and the UAE security framework
Social engineering testing covers three broad vectors: phishing and spear-phishing by email, pretexting by voice (vishing), and physical access attempts against facilities. A social engineering assessment tests whether your human layer holds under conditions an attacker would create, not just the technical infrastructure.
UAE regulations do not name social engineering as a discrete discipline in the way OWASP names injection or the Unified Kill Chain names reconnaissance. The requirement sits inside broader security testing mandates, physical security controls and staff awareness provisions. Practitioners find the obligation by reading the instruments together, not by searching each one for the exact phrase.
Phishing
Email-based deception targeting credentials or malware delivery
Vishing
Telephone pretext targeting staff or facility access controls
Physical
On-site attempts against badge readers and staff courtesy
The four UAE regimes and what they each cover
Four instruments govern cybersecurity in the UAE, each binding a distinct sector. A financial institution reports to the Central Bank (CBUAE). A Dubai government entity or its supplier answers to the Dubai Electronic Security Center (DESC). A federal government body falls under the National Electronic Security Authority (NESA), now part of TDRA, and the UAE Information Assurance Regulation (IAS) it published. A healthcare entity in Abu Dhabi is subject to the Abu Dhabi Healthcare Information and Cyber Security Standard (ADHICS). Identifying which regime applies is the first step in any regulatory compliance programme.
A penetration testing engagement commissioned by an organisation in a regulated sector will be scoped with reference to the applicable instrument. A bank running a phishing simulation must be able to present the result against the CBUAE TRM framework. A Dubai government supplier running the same test must present it against DESC's supplier requirements. An Abu Dhabi hospital must reference ADHICS. The table below maps each regime to its sector and what it says about human-layer testing.
| Regulator | Sector bound | Key instrument | Human-layer testing scope |
|---|---|---|---|
| CBUAE | Licensed financial institutions | Technology Risk Management guidelines | Human-layer testing within security assessments at a level proportionate to the institution's risk profile |
| NESA / TDRA | Federal government entities and critical infrastructure | UAE Information Assurance Regulation | Security assessment controls covering staff awareness and access management |
| DESC | Dubai government entities and their suppliers | Dubai cybersecurity standards | Awareness controls and access testing for entities handling government data or systems |
| ADHICS | Abu Dhabi healthcare entities | Abu Dhabi Healthcare Information and Cyber Security Standard | Physical security and human-layer controls as part of clinical and administrative operations |
CBUAE and the financial sector
The Central Bank of the UAE published Technology Risk Management (TRM) guidelines that apply to all CBUAE-licensed institutions, including banks, exchange houses and payment service providers. The TRM guidelines address information security, cyber resilience and the testing regimes that licensed institutions are expected to maintain. Security testing under the TRM framework covers technical controls and human-layer exposures. Staff who handle credentials, authorise payments or have physical access to secure areas are within scope because an attacker who obtains their cooperation by deception bypasses technical controls entirely.
CBUAE does not publish prescriptive test scripts. The obligation is to demonstrate that security controls are tested at a level of assurance appropriate to the institution's risk profile. A retail bank carrying high volumes of consumer deposits is expected to test at greater depth than a narrow-scope payment operator. The test result and the remediation plan that follows form part of the evidence package that a CBUAE examination may request. The Central Bank's published guidance is available at centralbank.ae.
NESA, the UAE IAS and federal entities
At the federal level, the UAE Information Assurance Regulation (IAR), published by the Telecommunications and Digital Government Regulatory Authority (TDRA) following the consolidation of NESA, sets the baseline for government entities. The IAR is structured around control categories that address access management, physical security and organisational security. Staff awareness and the testing of whether awareness controls hold in practice fall within scope. Phishing and physical intrusion testing, carried out under proper authorisation, are consistent with the IAR's requirements for demonstrating control effectiveness.
Federal entities operating critical infrastructure carry a higher assurance standard than general administrative bodies. The IAR text, available at tdra.gov.ae, should be read alongside the sector-specific guidance that TDRA issues for particular infrastructure categories. An infrastructure penetration test covering physical access scenarios is consistent with the IAS requirements, even where the instrument does not define social engineering as a term.
Authorisation letter
Signed by an authorised controller, naming scope, dates and testers
Test scenarios
The pretext and vector for each attempt, recorded before results
Results record
Outcome per scenario: failed, detected, escalated or no response
Remediation plan
Findings addressed, owner assigned, target date set
Retest record
Verification that remediation holds under the same test conditions
DESC and the Dubai government supply chain
The Dubai Electronic Security Center sets cybersecurity requirements for Dubai government entities and their direct suppliers. A supplier holding a government contract in Dubai is expected to meet the cybersecurity standard that DESC specifies for its service category. This extends to staff security, physical access controls and the testing that demonstrates both are sound. A supplier whose staff handle government data, process payments or have physical access to government facilities is within scope for human-layer testing whether or not the supplier is itself a Dubai government entity. DESC's framework is described at desc.gov.ae.
Social engineering is a live threat in the government supply chain. A staff member at a managed-service provider with privileged access to a government network presents the same exposure as a staff member inside the government entity itself. The red team engagement that tests whether an attacker can reach government data through that supplier is a realistic exercise for any organisation holding a DESC-regulated contract. DESC's supplier requirements should be reviewed at contract renewal to confirm whether updated security testing obligations apply.
ADHICS in Abu Dhabi healthcare
The Abu Dhabi Healthcare Information and Cyber Security Standard (ADHICS) applies to healthcare entities operating under the Department of Health Abu Dhabi. ADHICS addresses digital and physical security together because a healthcare environment mixes clinical staff who need fast access to patient data with physical assets including medical devices, dispensaries and records areas. Social engineering targeting a nurse, an administrative clerk or a facilities manager can bridge the physical and digital gap in a single interaction. The Department of Health's guidance is available at doh.gov.ae.
ADHICS controls cover human-layer security through staff awareness provisions, access procedures and the testing of both. An ADHICS-bound entity that can demonstrate it ran a phishing simulation, measured detection and escalation rates, and addressed the gaps the exercise revealed is in a stronger evidential position than one that relies on a policy document alone. Physical access testing for a healthcare facility is within scope where the entity holds areas that carry significant access risk, such as a pharmaceutical store, a server room or a ward with access to prescription systems.
Evidence regulators read after a social engineering assessment
Each of the four regimes accepts a common evidence structure after a security assessment. The minimum is an authorisation letter, the test scope, the results per scenario and a remediation plan with an owner and a target date. NIST SP 800-115, the Technical Guide to Information Security Testing and Assessment, provides a methodology for human-layer testing that aligns with what UAE regulators expect to see in a test report: defined scope, clear objectives, observations tied to specific control failures and remediation actions linked to findings. An assumed-breach test that includes a social engineering component follows the same documentation standard.
A regulator examining security testing evidence is not looking for a perfect result. An organisation that ran a phishing simulation, measured its results and can show the awareness training, the policy update and the follow-up test that closed the gap demonstrates exactly what the frameworks require: tested controls, identified weaknesses and evidence of improvement. An organisation that has never run the test has no remediation record to present. A purple teaming exercise that pairs an offensive social engineering run with a defensive detection review gives the clearest picture of whether controls work and whether the detection is reliable.
Social engineering testing in the UAE market
The UAE operates two principal financial centres in Abu Dhabi and Dubai, each hosting institutions that sit under different layers of regulation. CBUAE-licensed institutions operate across both emirates and carry consistent TRM obligations regardless of which emirate their registered office is in. A firm headquartered in Abu Dhabi's financial free zone and one registered in Dubai both carry CBUAE obligations if they hold a CBUAE licence, but free-zone status means they operate under federal rather than mainland company law. That layering makes it important to identify the applicable regime at the start of a compliance programme, not assume the most prominent instrument covers every obligation.
Procurement in both Dubai and Abu Dhabi asks suppliers and outsourced service providers to demonstrate their own security posture, not only their technical controls. A firm bidding for a Dubai government contract under a DESC-governed tender is likely to face a security assessment requirement at pre-qualification. A healthcare technology supplier entering the Abu Dhabi market under a Department of Health registration must understand ADHICS before its system goes into operation. For a firm operating across both emirates, the practical approach is a single social engineering assessment scoped to cover the staff, facilities and access points relevant to each contract, with results documented against the applicable standard and presented as a single evidence record across regulators.
Frequently asked questions
What is social engineering testing and what does it cover?
Social engineering testing examines whether an organisation's staff can be manipulated into revealing credentials, granting access or taking a harmful action. It covers three main vectors: phishing by email, vishing by telephone and physical access attempts against facilities. The test is distinct from technical penetration testing because it targets human behaviour rather than software or hardware vulnerabilities.
Which UAE regulator applies to a bank running a social engineering test?
A bank or financial institution licensed by the Central Bank of the UAE (CBUAE) falls under the CBUAE Technology Risk Management guidelines. These guidelines address security testing at a level proportionate to the institution's risk profile and include human-layer exposures. The test result and the remediation plan form part of the evidence package a CBUAE examination may request.
Does the UAE Information Assurance Regulation require social engineering testing?
The UAE Information Assurance Regulation (IAR), published by TDRA after the consolidation of NESA, addresses access management, physical security and staff awareness controls for federal government entities. Social engineering testing is consistent with the IAR's requirements for demonstrating control effectiveness, even though the instrument does not use the phrase as a defined term. Federal entities operating critical infrastructure face a higher assurance standard.
What does DESC require for a Dubai government supplier's security testing?
The Dubai Electronic Security Center sets cybersecurity requirements for Dubai government entities and their direct suppliers. A supplier handling government data or systems is expected to meet the DESC standard for its service category, covering staff security, physical access controls and the testing that evidences both. The specific requirements should be reviewed against the contract and the DESC guidance current at the time of procurement.
How does ADHICS address social engineering for Abu Dhabi healthcare entities?
The Abu Dhabi Healthcare Information and Cyber Security Standard (ADHICS), managed by the Department of Health Abu Dhabi, covers physical security controls and human-layer security as part of clinical and administrative operations. A healthcare entity subject to ADHICS is expected to maintain staff awareness, enforce access procedures and test whether those controls hold under realistic conditions. Phishing simulations and physical access testing are within scope of that requirement.
How does a social engineering assessment differ from a phishing simulation?
A phishing simulation tests one vector: the email channel. A full social engineering assessment covers email, telephone and physical access, and may chain those vectors together to show how a realistic attack would proceed. A phishing simulation measures click rates and credential submission; a full assessment produces a scenario-by-scenario record of what each vector achieved and where the human controls held or failed. Regulators typically expect a broader scope than a phishing simulation alone.
What must an authorisation letter contain for a UAE social engineering test?
An authorisation letter for a social engineering test should name the organisation authorising the test, the scope including which sites and staff populations are in scope, the test dates, the names or roles of the testers, and a point of contact who can halt the test if needed. The letter protects both the organisation and the testers by establishing that the activity is authorised rather than a genuine attack. Without it, a physical intrusion attempt or a convincing phishing campaign is legally indistinguishable from the real thing.
What evidence does a CBUAE examination look for after a social engineering exercise?
A CBUAE examination is likely to look for evidence that the test was conducted under proper authorisation, that findings were recorded per scenario, and that a remediation plan with owners and dates was produced and acted on. The examination may also ask for evidence of a retest confirming that the remediation held. An institution that can show the test, the findings and the closed loop is in a stronger position than one that can only present a policy document stating that testing is conducted.
Does UAE law require physical access testing as part of a social engineering assessment?
No UAE instrument mandates physical access testing as a named standalone requirement. The obligation is to demonstrate that security controls proportionate to the organisation's risk profile have been tested. For an organisation that holds physical assets containing regulated data, high-value credentials or access to critical systems, a regulator may reasonably expect physical access controls to have been tested as part of a complete security assessment. The proportionality principle means a back-office function with no physical sensitive assets faces a lower standard than a data centre or a bank branch.
