Learn
A UAE IA audit is an escalation, not a calendar event. Under the UAE Information Assurance Regulation, a designated entity reports on its own implementation, usually through its sector regulator. The authority reviews those self-assessment reports and, where it considers it appropriate, performs or commissions a compliance audit to validate them, or a compliance test to check that the measures work. What it audits against is the set of controls you are obliged to implement: the Always Applicable controls, plus every control your risk assessment did not exclude with a justification. The Regulation fixes no audit interval and describes no certificate. What it does fix is the evidence: a Statement of Applicability, documented compliance per control, internal audits, and corrective actions.
This guide reads Version 1.1 of the Regulation (March 2020). The document names the Telecommunications Regulatory Authority, TRA, now the TDRA; the quotes below keep its wording. The same caveat as in our guide to UAE IA requirements applies: confirm with the authority that designated you which edition binds you before you scope an audit against it.
| Who | Role in compliance checking | Where it says so |
|---|---|---|
| Your entity | Periodically update the relevant regulator, or TRA if there is no sector regulator, on implementation progress, and facilitate audit and testing whenever TRA requests it. | Section 3.5, Table 2 |
| Sector regulator | Consolidate critical entity compliance reports into a sector status update and submit it to TRA. | Section 3.5, Table 2 |
| TRA (now TDRA) | Review entity self-assessment reports and recommend escalation; perform or commission compliance audits and compliance tests where appropriate. | Section 3.5, Table 2 |
How is UAE IA compliance checked?
Chapter 4 of the Regulation says its purpose is to outline the measurement criteria and approach TRA will follow when evaluating compliance. Compliance means the comparison between the requirements of the Regulation and the actual state of implementation, measured control by control and for the entity overall. TRA will ensure that an effective compliance monitoring scheme is in place, built on four elements: controls, sub-controls, performance indicators, and the automation, threat and implementation guidance text.
The roles are set out in section 3.5. The entity periodically updates its regulator on implementation progress and facilitates audit and testing whenever TRA requests it; section 2.3 adds that entities submit implementation progress and key cyber security information to sector regulators. The sector regulator consolidates those reports into a sector status update for TRA. TRA reviews the self-assessment reports and recommends escalation for compliance audits or testing where appropriate, performs or commissions audits to validate the self-assessments, and performs or commissions tests to confirm that the measures are in place and effective.
Two consequences follow. Your self-assessment is the document most likely to be read, so it carries the weight a certification audit report carries elsewhere. And an audit, when it comes, sets out to validate what you reported. The gap it looks for is between your report and your records.
What is the audit measured against?
Chapter 4 is explicit. The Always Applicable controls, together with the controls your risk assessment makes applicable, are mandatory for the entity and will be the basis of the compliance monitoring scheme. Omitting an Always Applicable control, or any of its sub-controls, is not acceptable and constitutes non-conformity. A risk based control can be excluded, and a sub-control can be deviated from, only with a justification and evidence that the associated risks were accepted by accountable persons or authorizing entities. Section 3.3 adds that exclusions need adequate justification submitted to TRA, and that without an entity risk assessment every control is deemed applicable and therefore mandatory.
Sub-controls are where the detail lives: the Regulation says they specify mandatory implementation requirements. Implementation guidance is different. It is provided for information purposes only and can be implemented as the entity prefers, without further justification. Section 3.1 calls the Regulation the sole point of reference for compliance, measured by the criteria associated with each control. An auditor holding you to guidance text is auditing beyond the document.
What evidence will an auditor ask for?
The Regulation builds its own audit trail into the control set. Six controls produce most of it.
| Control | What it requires | Applicability |
|---|---|---|
| M2.3.4 Statement of Applicability | The controls identified as necessary, the reasons, their current implementation status, and the justification for excluding any risk based control. | Always applicable, P1 |
| M1.4.3 Documentation | Document compliance with the mandatory controls in a way that allows unique reference to the requirements of the Regulation. TRA may provide a sample compliance template. | Always applicable, P2 |
| M6.2.1 Monitoring, Measurement, Analysis and Evaluation | Monitor and evaluate information security performance and the effectiveness of the ISMS; document the methods and results. | Always applicable, P2 |
| M6.2.2 Internal Audits | Plan and conduct internal audits, define their frequency, methods, responsibilities, planning and reporting, and check conformity with the requirements of the Regulation. | Always applicable, P2 |
| M6.3.1 Corrective Action | Correct any nonconformity and document the corrective actions taken. | Always applicable, P2 |
| M5.4.1 Technical Compliance Checking | Regularly check information systems for compliance with the UAE IA Regulation. | Based on risk assessment, P2 |
Read together, they describe what a validation audit samples: pick a control from the Statement of Applicability, find its documented compliance, find the internal audit that tested it, and find the corrective action for whatever that audit raised. M5.5.1 adds that responsibility for internal audits of information system controls is assigned to an appropriate authority, and its guidance says the people doing the audit should be independent of the activities audited.
Performance indicators are the element programmes most often skip. Chapter 4 says entities need to use them to measure the quality and effectiveness of the controls they implement, and may replace the suggested ones only by giving a reason and naming the substitutes. The M5 family indicator is the percentage of audit findings that are repeated; the M6 family indicator is the compliance level achieved against your own policy and objectives, with a dashboard given as the example.
How often will we be audited?
The Regulation does not say. It says entities update their regulator periodically and facilitate audit and testing whenever requested, and that TRA audits or tests where appropriate. No interval is set for either. The frequency the Regulation does make you set is your own: M6.2.2 requires you to define the frequency of your internal audits. Write that down and keep to it, because a schedule you missed is easier for an auditor to find than one you never had.
Priority matters here too. Section 3.4 requires entities to begin with the P1 controls, of which Annex B counts 39, and says a P1 control, where applicable, may be augmented but never reduced. An entity that is part way through implementation should expect its P1 position to be read first.
Which controls can an audit never accept as excluded?
The Always Applicable set. Annex A states that 34 management controls make up the list. Read the control pages as well as the annex: the annex table lists 35 identifiers, and two further controls, M1.3.1 Authorization Process for Information Systems and M1.3.2 Confidentiality Agreements, are marked Always applicable in the body of the document without appearing in the table. The safe reading for an audit is the wider one. Treat every control marked Always applicable on its own page as non excludable, and ask the authority if you want to rely on the narrower list.
What the other results get wrong
Page one for this query is almost entirely audit firms describing their own service. The pages we read talk about regular audits and penetration testing bought from a provider, which is useful for picking a firm but says nothing about what the authority does with the result, or how often. Three points are easy to miss as a result.
The first is frequency. The text sets no audit cycle. Audits and tests happen where TRA considers them appropriate, and the only frequency the Regulation requires is the one you define for internal audits.
The second is certification. The Regulation describes a monitoring scheme, self-assessment reports, audits and tests. It does not describe certification. An external firm can assess you, but its report is evidence for your self-assessment, not a status the authority grants.
The third is anchoring. Treat any list of what assessors expect with care unless each item is tied to a control. The Regulation is the sole point of reference, measured against each control's criteria. If an expectation cannot be traced to a control or sub-control, ask which one before you spend money on it.
Are you ready for a validation audit?
Fill this in. Every blank is something an auditor validating your last report would ask for.
| Question | Your answer | Why it matters |
|---|---|---|
| When did you last update your sector regulator, and what did you report? | That report is what an audit sets out to validate. | |
| Is your Statement of Applicability current, with a status and reason for every control? | M2.3.4 is Always applicable and P1. | |
| Does every exclusion have a justification submitted to TRA and a named risk acceptance? | Section 3.3 and Chapter 4 require both. | |
| Can each mandatory control be traced to its compliance record? | M1.4.3 requires unique reference to the Regulation. | |
| What internal audit frequency did you define, and did you meet it? | M6.2.2 makes you set it. | |
| Which nonconformities are open, and where are the corrective actions documented? | M6.3.1 requires both. | |
| Which performance indicators do you report, and where you replaced one, why? | Chapter 4 requires a reason for every deviation. |
Once you know the blanks, our guide to what UAE IA compliance costs prices the work mandate by mandate. The free compliance check gives you a baseline, and the UAE IA framework page shows how each control is held with its applicability, owner and evidence.
Frequently asked questions
Who carries out a UAE IA audit?
Under section 3.5, TRA, now the TDRA, performs or commissions compliance audits and compliance tests where appropriate. Sector regulators consolidate compliance reports; the Regulation does not give them an audit role.
Is there a UAE IA certificate?
The Regulation does not describe one. It describes a compliance monitoring scheme built on self-assessment reports, audits and tests.
Do we need an internal audit function?
You need internal audits. M6.2.2 is Always applicable and requires you to plan and conduct them. Its guidance says external resources can provide the service where the necessary independence or expertise cannot be found within the entity.
Can an auditor fail us on implementation guidance?
The Regulation says guidance is for information purposes only and can be implemented as you prefer. Sub-controls, by contrast, are mandatory implementation requirements.
What happens after a failed audit?
The Regulation says TRA may escalate further if needed, without setting out sanctions. Inside your own programme, M6.3.1 requires you to correct the nonconformity and document the corrective action.
Primary sources
Everything above comes from the UAE Information Assurance Regulation, Version 1.1, March 2020: sections 1.1, 2.3, 3.1, 3.3, 3.4 and 3.5, Chapter 4, controls M1.3.1, M1.3.2, M1.4.3, M2.3.4, M5.4.1, M5.5.1, M6.2.1, M6.2.2 and M6.3.1, Annex A and Annex B, Table 6. The link is a public mirror of the authority-published text. Confirm the current version and your designation directly with the authority before relying on any of it for a programme decision.
