UAE NIAF — National Information Assurance Framework

Why does it matter?

The NIAF is the reason a UAE government entity or a designated critical operator has to treat information assurance as a national obligation, not an internal choice. It asks each entity to report its implementation to its sector regulator, who reports to the national authority, and it gives that authority four escalating levels of monitoring, up to direct intervention. An entity that cannot show its risk assessment, its integrated security controls and an incident escalation path to the sector level has little to show when monitoring moves from reporting to auditing.

Key benefits include:

• A national baseline

Compliance is mandatory for all UAE government entities and entities identified as critical (section 1.5), which sets the minimum for the sectors in the CIIP Policy.

• Entity, sector and national views

Entity results roll up through sector regulators to the national level, so each entity's report feeds a national picture of risk.

• Five assurance principles

Confidentiality, integrity, availability, authentication and non-repudiation (section 1.2) define what information assurance must deliver.

• Risk-based control selection

The IA Regulation lets an entity exclude a control only with a justification submitted to the regulator, except for the Always Applicable controls.

• Defined consequences

Section 7.2 sets four monitoring levels: reporting, auditing, testing and national security intervention.

How does it work?

Chapter 3 sets the entity context, four capabilities every entity must build in a life cycle: risk assessment (asset inventory, business impact analysis, vulnerability assessment), integrated security (logical, physical and personnel controls selected from the risk assessment), incident management (situational awareness, entity incident response and escalation to the sector and national levels) and business continuity (continuity planning, disaster recovery and return to steady state).

Chapter 4 extends this beyond the entity: sector and national risk assessment, access to national cybersecurity capabilities, sector and national situational awareness, and continuity of critical national services. Chapter 5 adds information sharing between entities, sectors and the national level. NESA defines the detailed requirements in common, sector-specific and service and product-specific UAE standards (chapter 6), with certification where NESA requires it (section 6.4).

The IA Regulation turns the entity context into controls. An entity first performs a risk assessment, treats all controls as applicable, then excludes a control only with a justification sent to the regulator. Always Applicable controls cannot be excluded, and omitting one is a non-conformity (IA Regulation chapter 4). Controls carry priority levels P1 to P4, and critical entities start with P1.

Key Elements

• Principles of information assurance

Confidentiality, integrity, availability, authentication and non-repudiation (section 1.2).

• Entity context (chapter 3)

Risk assessment, integrated security, incident management and business continuity.

• Sector and national contexts (chapter 4)

Sector and national risk assessment, national capabilities, situational awareness and continuity of critical national services.

• Information sharing (chapter 5)

Exchange of threat information and best practices across the entity, sector and national levels.

• UAE standards (chapter 6)

Common, sector-specific and service and product-specific standards, certification and the Information Assurance Technical Forums.

• National IA governance (chapter 7)

Liaison Officers named by each entity and four escalating levels of compliance monitoring.

• IA Regulation controls

Management families M1 to M6 and technical families T1 to T9, with P1 to P4 priorities and an Always Applicable set.

What does it cover?

The NIAF applies to all UAE government entities and to other entities that NESA identifies as critical in the sectors the CIIP Policy lists. The CIIP Policy outlines the process for designating an entity as critical, and the IA Regulation states that the regulator designates the critical entities that must implement it, covering information and systems used for processing, storage and transmission, in physical or electronic form. Other UAE entities are encouraged to follow the framework on a voluntary basis. Each entity names a Liaison Officer for contact with the national authority (section 7.1).

What are its objectives?

The NIAF has two core objectives, set out in section 1.1.

Raise the minimum cybersecurity level across all UAE entities by building a common understanding of information assurance requirements at the entity level.

Raise the security of the information infrastructure that supports critical national services, by integrating individual entities into a sector and national context.

Framework in Context

The NIAF supports the UAE National Cyber Security Strategy, with supporting instruments listed in Annex 1: the National Risk Management Framework, the National Cyber Response Framework, the CIIP Policy, the National Cybersecurity Information-Sharing Policy, the UAE Information Assurance Standards, the National Framework for Compliance, Certification and Accreditation and the NIAF Governance Model. The IA Regulation v1.1 states that its development drew on ISO/IEC 27001, 27002, 27005, 27010 and 27032 (2005 and 2012 editions), NIST SP 800-53 Revision 4, the Abu Dhabi Information Security Standards and the SANS 20 Critical Security Controls, so evidence for those frameworks can be reused.

Common Framework Mappings

Organizations map the NIAF and IA Regulation controls to the frameworks below so that one set of evidence serves the regulator, auditors and other standards.

Mapped frameworks include:

CIS Controls v8.1

COBIT 2019

ISO 27001:2022

NIST CSF 2.0

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2