The UAE rules that apply to IoT security testing: CBUAE, NESA and DESC

Four frameworks, one estate of connected devices

The UAE has four regulatory regimes that name security testing requirements. The federal UAE Information Assurance Standard, published by TDRA through NESA, applies to government entities and critical infrastructure operators. Three sectoral frameworks add requirements on top of it: the CBUAE Cyber Security Framework for financial institutions, the DESC framework for Dubai government entities and their suppliers, and ADHICS for Abu Dhabi healthcare providers.

IoT devices do not sit outside these frameworks. A connected device on a network that processes financial data, patient records or government information falls inside the scope of whichever framework binds that organisation. An IoT pentest is the assessment that maps device-level findings to those regulatory requirements and produces the evidence a regulator can read.

What the UAE Information Assurance Standard requires

The UAE IAS, published under NESA and currently at version 1.1, applies federally to government entities and designated critical infrastructure operators. Its network security controls require organisations to test the security of connected systems periodically. Any device that is part of a regulated network, including embedded systems, building controllers and field sensors, falls within those controls.

The IAS does not use the term "IoT pentest," but its requirements for network segmentation, device authentication and vulnerability assessment extend to every endpoint connected to an in-scope network. An organisation bound by the UAE Information Assurance Regulation that deploys connected devices across its estate is expected to test those devices as part of its security testing program. A scoped penetration test that includes connected device coverage satisfies the IAS testing requirement when the scope is documented and findings are mapped to the relevant controls.

CBUAE and connected devices in financial services

The CBUAE Cyber Security Framework applies to all licensed financial institutions in the UAE, including banks, insurers, exchange houses and payment service providers. Its network security domain includes requirements for device inventory, network segmentation, endpoint protection and vulnerability testing that apply to any device connected to a regulated network.

Financial institutions operate connected devices beyond workstations and servers. ATMs, payment terminals, branch kiosks, building management systems and surveillance equipment all sit on networks that process or handle data subject to the framework. The CBUAE framework does not name a specific test methodology, but its vulnerability assessment and penetration testing requirements are met by a scoped test that covers connected device classes, provided the scope document names each device type and the report maps findings to the relevant framework controls.

DESC requirements for Dubai government entities and their suppliers

The Dubai Electronic Security Center framework applies to Dubai government entities and the technology suppliers that serve them. Organisations deploying connected systems in Dubai government facilities, smart city infrastructure or operational assets must satisfy DESC security testing requirements as part of their procurement and ongoing compliance obligations.

DESC requirements extend to OT and IoT systems operated by or on behalf of Dubai government entities. A supplier providing connected building management, access control or utility monitoring under a Dubai government contract is expected to demonstrate that those systems have been security tested. OT and ICS testing and IoT testing both apply depending on the technology in scope, and the test scope should be agreed in writing with the relevant DESC compliance contact before work begins.

ADHICS and connected medical devices in Abu Dhabi

ADHICS is the Abu Dhabi Healthcare Information and Cyber Security standard, published by the Department of Health. It applies to healthcare providers in Abu Dhabi and their IT and medical device suppliers. Connected medical devices touch both patient safety and information security. A compromised infusion pump, imaging system or patient monitoring device can affect clinical outcomes, not only data confidentiality.

ADHICS requirements cover device inventory, network segmentation of clinical networks and security testing of devices that handle patient data. An organisation deploying connected medical devices in Abu Dhabi healthcare facilities is expected to assess those devices as part of its ADHICS compliance program. An infrastructure pentest covers the network layer, while an IoT pentest addresses the device firmware, hardware interfaces and the cloud backend the device reports to.

What testing evidence the frameworks read

Each of the four frameworks asks for testing, but the specific evidence required differs in emphasis. The IAS and CBUAE both require a vulnerability assessment program and periodic penetration testing. DESC and ADHICS frame their requirements in terms of supplier assurance and device security more than a named test type, but both accept a penetration test report as evidence of control effectiveness when the scope is clear and findings are mapped to specific controls.

The article How an IoT pentest is run sets out the technical phases that generate this evidence: firmware analysis, radio protocol testing, hardware interface review and cloud backend assessment. What the regulatory report adds to that technical output is a mapping from each finding to the specific control requirement it affects. A finding that shows unauthenticated firmware update capability should be mapped to the network authentication controls in the IAS, the device security domain in the CBUAE framework or the connected device requirements in ADHICS, depending on which framework binds the organisation.

Where an organisation wants to test whether a compromise of a connected device can become a wider network compromise, the red team path applies. That is the question that matters most for critical infrastructure operators bound by the IAS, and it is the scenario where a device-level finding becomes a business-level risk.

IoT security testing under UAE frameworks: what Abu Dhabi and Dubai operators need to know

Abu Dhabi and Dubai are two of the most regulated cybersecurity environments in the region. The UAE's regulatory approach is layered: the federal UAE IAS sets a baseline that applies to government entities and critical infrastructure operators across both emirates, while sectoral frameworks add requirements specific to each industry.

In Dubai, government entities and their suppliers operate under DESC, which covers connected systems deployed in smart city infrastructure, transport, utilities and government facilities. The DESC framework has expanded its scope as Dubai's operational technology estate has grown, and suppliers with IoT deployments in Dubai government projects are expected to demonstrate security testing as part of procurement. In Abu Dhabi, ADHICS reaches healthcare providers and their device suppliers, covering connected medical devices across clinical settings. CBUAE applies to financial institutions across the UAE regardless of emirate, reaching any institution that connects devices to a network handling regulated financial data.

For an organisation with operations across both emirates, more than one framework may apply simultaneously. A bank with an Abu Dhabi branch and a Dubai head office is bound by CBUAE everywhere and may also face DESC obligations for any Dubai government contract work. Understanding which framework applies to each connected device is the foundation of a compliant IoT pentest scope. RedTeam Security is licensed in Dubai Silicon Oasis and tests IoT deployments against all four UAE frameworks.

Frequently asked questions