What does the UAE Information Assurance Regulation require for security awareness training?

The UAE Information Assurance Regulation is the national catalog of management and technical security controls that designated UAE entities must implement to reach a minimum level of information assurance. The published text is Version 1.1, dated March 2020, and the UAE government portal describes it as developed by the Telecommunications and Digital Government Regulatory Authority (TDRA) to raise "the minimum level of protection of information assets and supporting systems across all entities in the UAE".

The regulation sits inside a wider national framework. It describes itself as a critical element of the National Information Assurance Framework (NIAF) and of the National Cyber Security Strategy. The NIAF and the CIIP Policy were originally issued under the Supreme Council for National Security by the former National Electronic Security Authority (NESA), which is why many practitioners still call these controls "the NESA standards".

The controls are split into six management families (M1 Strategy and Planning to M6 Performance Evaluation and Improvement) and nine technical families (T1 Asset Management to T9 Information Systems Continuity Management). Awareness and training is family M3, supported by M4 Human Resources Security. The drafters built the controls on ISO/IEC 27001 and 27002 (2005 editions), NIST SP 800-53 Revision 4, and the Abu Dhabi Information Security Standards, so an ISO/IEC 27001 awareness program covers much of the same ground.

Compliance is mandatory for UAE government entities and for entities designated as critical, and voluntary for everyone else. The NIAF states that compliance "will be mandatory for all UAE government entities and other entities identified as critical", and that other UAE entities are highly recommended to follow the guidelines voluntarily.

Critical entities are identified through the CIIP Policy, which covers infrastructure supporting critical national services in sectors including chemicals, emergency services, health, nuclear, government, electricity and water, financial services (banking, insurance, stock exchanges, investments), and ICT. The IA Regulation's own scope section says the regulator "will designate the critical entities, as per the UAE CIIP Policy, mandated to implement the UAE IA Regulation".

In practice, private companies meet these controls in two ways: through direct designation, or because a government or critical entity customer writes them into supplier contracts. The regulation itself notes that an awareness and training program "might not be carried out by the entity and can, for example, be ensured contractually".

The UAE has federal law that applies onshore across the seven emirates, emirate level rules, and financial free zones with their own civil and commercial law and regulators. The Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) have their own data protection laws and financial regulators, such as the Dubai Financial Services Authority (DFSA).

The IA Regulation's reach depends on designation rather than on where a company is licensed: it binds government entities and entities designated as critical. A free zone firm that is not designated is not directly bound, but may still meet the controls through contracts, and must meet its own regulator's technology risk and data protection rules. Emirate level frameworks also exist. The Dubai Electronic Security Center (DESC) publishes an Information Security Regulation that applies to all Dubai Government Entities and is organized into thirteen domains.

Security awareness also supports personal data duties. Onshore organizations should read this page with the UAE Personal Data Protection Law page, since both expect staff to handle information securely.

Family M3 requires an awareness and training policy, a program for all persons doing work for the entity, a needs based training plan, measured results, training records, and awareness campaigns. Its stated objective is "to ensure sufficient information security awareness and training is provided and to build a specialized workforce". Each control carries a priority (P1 highest to P4) and an applicability label.

Sub-control 2 of M3.2.1 requires the entity to "determine the necessary competencies for personnel performing work effecting information security", and sub-control 5 requires it to "maintain records of education, training, skills, experience and qualifications". M3.3.1 is the family's only P1 control, which means a training needs analysis is the first thing an implementing entity must put in place.

Always Applicable controls cannot be excluded, and risk based controls can only be excluded with documented justification. Chapter 4 of the regulation says omission of an Always Applicable control or any of its sub-controls "is not acceptable and constitutes non-conformity". Annex A lists 34 Always Applicable controls, all in the management families.

For controls marked "based on risk assessment", such as M3.3.4 Training Results and M3.3.5 Records Documentation, the entity may exclude a control or deviate from a sub-control only if it justifies the decision and provides evidence that accountable persons have accepted the risk. Where no entity risk assessment exists, the regulation treats every control as applicable and mandatory.

Priority governs sequence. Critical entities must begin with P1 controls and may promote or demote other priorities based on their risk assessment, but P1 controls "may be augmented but never reduced". Entities must also use performance indicators to measure the quality and effectiveness of implemented controls; for M3 the family indicator is the percentage of awareness and training objectives met.

The M4 Human Resources Security family makes awareness part of the employment lifecycle. Control M4.1.1 expects the human resources security policy to cover required awareness and training during employment in line with M3.1.1. Control M4.3.1 (Always Applicable) requires the entity to inform all employees, contractors and third parties of the security policies they must follow and to "present, on first access, relevant security policy/guidelines for users to read and accept".

The performance indicator for M4.3 is the "percentage of employees that participated in Security Awareness Training". Control M4.3.2 requires a formal disciplinary process and sufficient awareness of that process within the entity. Together these make policy attestation on first access, onboarding awareness, and communication of consequences auditable items, not just good practice.

Each training control should translate into a defined learning outcome and a piece of evidence an assessor can inspect. The table below is an original mapping for illustration, not text from the regulation.

A training matrix that links roles, required competencies and completions is the simplest way to meet M3.3.1 and M3.3.5 together. Because M3.2.1 requires evaluating effectiveness, completion counts alone are weak evidence; see completion tracking vs competency verification and how to prepare training records for an audit.

The implementation guidance is explicitly "for information purpose only", so it shapes good practice but does not create obligations. It lists methods such as mandatory annual awareness training, targeted role based training, internal awareness websites, seminars, awareness weeks, posters, and emails to all employees and contractors.

The guidance is still useful evidence of what an assessor will expect. It says trainings should take place as planned and not be "pushed off", and that if training continues not to take place in the planned timeframe "it is a non-conformity". It recommends assessing effectiveness, for example through an exam at the end of training or through interviews and feedback forms where an exam is not possible. It also advises updating training when technology, systems, services or threats change.

Critical entities are also told to take account of TRA's national awareness and capability building issuances. For government employees, TDRA offers an information security awareness session service covering twelve information security topics, which can complement but not replace an entity's own program.

A program that meets the M3 and M4 controls has a small set of documented, reviewable components. Use this checklist to test an existing program.

1. An approved awareness and training policy that assigns roles to providers and recipients (M3.1.1).
2. A role based list of security competencies and a current skills gap assessment (M3.3.1).
3. A training plan with solutions, timeline and allocated resources for each need (M3.3.2).
4. A delivery log compared against the plan, with alternatives recorded when sessions slip (M3.3.3).
5. Pre and post measures of knowledge or skill, and corrective action for training that underperforms (M3.3.4).
6. An individual training record for every person in scope, reviewed on a set cycle (M3.3.5).
7. Awareness campaigns scoped to user risks, with a timeline (M3.4.1).
8. Policy acceptance on first access and communication of the disciplinary process (M4.3.1, M4.3.2).
9. Performance indicators reported to management, and contract clauses for outsourced or supplier staff.

Knowledge Foundry models each IA Regulation control as a structured obligation linked to competencies, learning outcomes and assessment points before any content is written. That gives an entity a traceable path from M3.3.1 skills gaps to delivered training, measured results and individual records. It is used by government and defense organizations and critical infrastructure operators that need reviewable evidence.