# UAE Cybersecurity Baselines (government / CNI / emirate)

## Federal
- **UAE Cyber Security Council (CSC)** — federal cyber policy lead; **National Cybersecurity Strategy 2025–2031** (approved Feb 2025, five pillars; programmes incl. a National Information Assurance Programme and post-quantum migration planning)
- **UAE Information Assurance (IA) Regulation** — the operative federal control baseline (successor to the NESA IA Standards; NESA's functions folded into the Signals Intelligence Agency, SIA). Binds **federal government entities and critical national infrastructure**. Vendor claims of a "2025 v2 update" are unverified — cite the IA Regulation generically and direct users to confirm the current version with their sector regulator/CSC
- **Cybercrime**: Federal Decree-Law 34/2021 (in force Jan 2022) — offenses incl. unauthorized access, data interception, online fraud; relevant to incident-response legal analysis
- **Child Digital Safety law** (reported Federal Decree-Law 26/2025, effective early 2026) — platform duties; flag for consumer-facing digital services

## Emirate level
- **Dubai** — DESC administers the **Information Security Regulation (ISR, v3)** for Dubai government and semi-government entities
- **Abu Dhabi** — ADDA (formerly ADSIC) Information Security Standard for Abu Dhabi government entities; **ADHICS** for DoH-regulated healthcare (see health-data.md)

## Routing
Government/CNI → IA Regulation (+ emirate standard for emirate entities). Private mainland → no mandatory federal cyber baseline (cybercrime law + sector rules apply); ISO 27001/NIST CSF as best practice. Regulated financial → CBUAE / DFSA / FSRA technology-risk rules per license.