Getting ISO 27001 in the UAE starts with a focused scope, a list of the information assets inside it and a risk assessment. From that you write a Statement of Applicability, which records which Annex A controls apply, then put those controls in place and test them with an internal audit and management review before an accredited certification body audits you.
This guide is for managing directors and operations leads at UAE SMEs and mid-size businesses who have just seen “ISO 27001 certificate required” in a tender or client questionnaire and want to know what is involved, which parts are IT work and how to pick a certification body.
Key takeaways
- ISO/IEC 27001:2022 is the current edition. Certificates against the 2013 edition had to expire or be withdrawn by 31 October 2025.
- We are not aware of any UAE law that makes ISO 27001 mandatory for private businesses in general. Clients, tenders and partners usually drive it.
- Start small: a tight scope is easier to certify and can be widened later.
- Roughly half the work is decisions and documents; the other half is technical controls such as access, logging, network security and backups.
- In the UAE, the Emirates International Accreditation Centre (EIAC) accredits certification bodies for ISO 27001.
What is ISO 27001?
ISO/IEC 27001 is the international standard for an information security management system, or ISMS: the policies, processes and controls a business uses to manage information security risk. The main clauses (4 to 10) describe how the management system must work: context and scope, leadership, planning and risk assessment, support, operation, performance evaluation and improvement.
Annex A is a reference list of controls. In ISO/IEC 27001:2022 it contains 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34). You don’t have to implement all 93; you decide which apply based on your risks and record that decision.
Do UAE companies need ISO 27001?
We are not aware of any UAE law that requires private businesses in general to hold ISO 27001 certification. More often it is asked for by clients, tenders and partners as evidence that you take security seriously, especially when you handle their data or connect to their systems.
Some sectors have their own mandatory security standards instead. The UAE Information Assurance Standard applies to government entities and critical information infrastructure, and ADHICS applies to Abu Dhabi healthcare. These are separate schemes from ISO 27001, although the UAE Cyber Security Council states that the IA Standard aligns with ISO/IEC 27001.
If you handle personal data, the work also supports UAE PDPL compliance, which asks for appropriate security measures but doesn’t require a certificate.
Where do I start?
1. Set a small, sensible scope
Your scope says which parts of the business the ISMS covers. For a first certification, a focused scope is easier: for example, the managed service a key client buys from you, or the systems that hold client data. Write it down clearly, including locations, teams, systems, and any outsourced or cloud services. If your Dubai office relies on systems run from another country, say so.
2. List your information assets
Inside the scope, list the information and the things that hold it: devices, servers, cloud services, applications, network equipment, paper records and the people who use them. Give each one an owner. If you’ve already worked through the first 10 cyber controls, your asset list is a head start.
3. Run a risk assessment
For each important asset, ask what could go wrong (a lost laptop, phishing, ransomware, a supplier failure), how likely it is and how bad it would be. Decide how to treat each risk: reduce it, accept it, avoid it or transfer it. Use a method you can repeat, because you will run it again as the business changes.
4. Write your Statement of Applicability
The Statement of Applicability (SoA) lists the Annex A controls, says which apply to you and why, and whether each is in place. It links your risk assessment to the work you actually do, and it is one of the first documents an auditor reads.
5. Implement, measure and review
Put the chosen controls in place, decide how you’ll measure them, run an internal audit, and hold a management review that looks at the results. Only then are you ready for certification.
Which parts are IT work and which are paperwork?
This is where many first projects stall. Some steps are management decisions and documents; others are hands-on technical work.
| Step | Mainly | Typical owner |
|---|---|---|
| Scope and objectives | Decisions | Management |
| Information security policy | Documents | Management |
| Asset inventory | Both | IT, with business owners |
| Risk assessment and treatment plan | Both | Management and IT |
| Statement of Applicability | Documents | Management, with IT input |
| Access control and MFA | IT work | IT or technical partner |
| Network security and firewalls | IT work | IT or technical partner |
| Logging and monitoring | IT work | IT or technical partner |
| Backups and recovery testing | IT work | IT or technical partner |
| Supplier security | Both | Procurement and IT |
| Staff awareness training | Both | Management and HR |
| Internal audit | Review | Independent internal or external auditor |
| Management review | Decisions | Management |
The technical rows are where a systems integrator can do the heavy lifting, so your own team can focus on the decisions and documents only you can write.
A worked example: a 40-person consultancy
A Dubai consultancy is asked for ISO 27001 by a bank client. Rather than certifying the whole company, it scopes the ISMS to “the delivery of advisory services to clients, including the Microsoft 365 tenant, the document management system and the Dubai office network”. Its risk assessment highlights phishing, lost laptops and a single administrator account shared with its IT provider. Its treatment plan: enforce MFA, encrypt laptops, give the IT provider named accounts with MFA, centralise logs and test backups quarterly. The SoA records those controls, plus why physical controls for a data centre don’t apply (it has none). That’s a scope an auditor can follow and a small team can maintain.
How does certification work?
An accredited certification body runs a Stage 1 audit of your documentation and readiness, then a Stage 2 audit of how the controls work in practice. Certificates are typically valid for three years, with surveillance audits in between and a recertification audit at the end of the cycle.
Many businesses choose a gap assessment before Stage 1, so they know what is missing before an auditor finds it. How long the whole process takes depends on your scope and starting point. Be wary of anyone who promises a fixed timeline, or a guaranteed certificate, before they have seen your business.
What drives the cost?
We won’t quote figures, but cost depends on the size and complexity of the scope, the number of sites, how many controls are already in place, how much outside help you use, and the certification body’s audit days, which are themselves based on scope and headcount.
How do I choose a certification body in the UAE?
In the UAE, EIAC accredits certification bodies for ISO/IEC 27001 (against ISO/IEC 27006-1, the standard for bodies that certify information security management systems). Ask whether your certification body is accredited by EIAC or by another IAF-member accreditation body, and check its accreditation scope covers ISO/IEC 27001. Make sure any certificate references the 2022 edition.
Also ask about experience with businesses of your size and sector, and how they schedule Stage 1, Stage 2 and surveillance audits. Keep roles separate: the body that certifies you shouldn’t be the one that built your ISMS.
Common mistakes
- Scoping the whole business on day one. It multiplies the work and delays the certificate.
- Buying a template pack and stopping there. Auditors test whether controls operate, not whether documents exist.
- Leaving IT out of the risk assessment. The people who run the systems know where the gaps are.
- Forgetting suppliers. Cloud and managed service providers are usually inside your risk picture.
- Treating certification as the finish line. Surveillance audits check the system is still working.
How Softworx Services helps
Softworx Services is a systems integrator and network services provider with a technology-led, vendor-agnostic approach. Through our Cyber & Compliance and Networks teams we help businesses put the technical controls in place: network security, firewalls, access control, logging and resilient backups. Our Dubai office is at Saaha Offices, Downtown Dubai.
We are not a certification body and we don’t issue ISO 27001 certificates. We work alongside your consultant or internal lead on the technical side.
Frequently asked questions
Is ISO 27001 mandatory in the UAE?
We are not aware of any UAE law that makes it mandatory for private businesses in general; it is usually driven by clients and tenders. Some sectors have their own schemes instead, such as the UAE IA Standard and ADHICS.
How long does ISO 27001 take for an SME?
It depends on your scope and starting point. A focused scope and good existing controls make it quicker; a gap assessment gives you a realistic plan.
What is a Statement of Applicability?
A document listing the Annex A controls, which apply to your business and why, and whether each is in place.
What changed in ISO 27001:2022?
Annex A was restructured into 93 controls in four themes. Certificates against the 2013 edition had to expire or be withdrawn by 31 October 2025.
Who accredits ISO 27001 certification bodies in the UAE?
The Emirates International Accreditation Centre (EIAC). Bodies accredited by other IAF-member accreditation bodies are also recognised internationally.
Talk to Softworx Services in Dubai
Asked for ISO 27001 and not sure where the technical gaps are? Talk to the Softworx Services team about the controls your ISMS needs.
Sources
- ISO/IEC 27001:2022, International Organization for Standardization: https://www.iso.org/standard/27001
- IAF MD 26, Transition requirements for ISO/IEC 27001:2022, International Accreditation Forum: https://iaf.nu/iaf_system/uploads/documents/IAF_MD26_Issue_2_15012023.pdf
- Emirates International Accreditation Centre, certification bodies accreditation: https://eiac.gov.ae/services/certification-bodies/
- UAE Information Assurance Standard, UAE Cyber Security Council: https://csc.gov.ae/en/w/uae-information-assurance-standard
- ISACA Journal, “Navigating the ISO/IEC 27001:2022 Transition” (Annex A themes and counts): https://www.isaca.org/resources/isaca-journal/issues/2024/volume-3/navigating-the-iso-iec-27001-2022-transition-a-90-day-challenge
- TÜV Rheinland UAE, ISO 27001 certification process and certificate cycle: https://www.tuv.com/united-arab-emirates/en/iso-27001-certification.html