Good cyber security for Dubai businesses starts with ten controls, done in order: an asset list, multi-factor authentication, a properly managed firewall, patching, no everyday admin rights and tested backups, followed by separate networks for guests and devices, phishing awareness, controls on supplier access and a one-page incident response plan.
This guide is for owners, office managers and the one stretched IT person at a Dubai SME or mid-size business with no dedicated security team. Perhaps you have had a phishing scare, a client security questionnaire or a question from an insurer. Each control below has a “done when” test, so you know when to move on.
Key takeaways
- Most attacks on smaller firms exploit stolen passwords, unpatched systems and over-privileged accounts. The first six controls deal with those.
- Each control has a clear finish line. “Done when” beats “in progress”.
- The UAE Information Assurance Standard is mandatory for government and critical infrastructure, but clients and contracts increasingly ask other firms for the same basics.
- The list lines up with the CIS Controls Implementation Group 1, the international “essential cyber hygiene” baseline.
- Spread the work over three months and give every control an owner.
Do Dubai businesses have to follow a national cyber standard?
The UAE Information Assurance (IA) Standard, issued by the UAE Cyber Security Council (version 2.1, November 2025), sets security controls for government entities and organisations that run critical information infrastructure. It replaced the UAE IA Regulation v1.1 published by TDRA in 2020, which grew out of the earlier NESA standards and is still often called “NESA”. In Dubai, the Dubai Electronic Security Center (DESC) also publishes its own Information Security Regulation and standards for Dubai government entities, which often reach suppliers through contracts.
Other businesses may be asked to meet parts of these by clients, contracts or their sector regulator, so check which applies to you. The Council states that the IA Standard aligns with ISO/IEC 27001, NIST SP 800-53 and the CIS Controls. That’s useful: the basics below are good practice under all of them, whether or not you are formally bound.
What are the first 10 controls to put in place?
1. Know what you have
You can’t protect what you don’t know about. List every laptop, phone, server, network device and cloud service, the accounts that use them and the important data each holds. Include the forgotten things: the old NAS in the comms cupboard, the shared admin login, the former employee’s mailbox that still forwards to a personal address.
Done when: you have one current list, with an owner for each item and a person responsible for keeping it up to date.
2. Multi-factor authentication on email and admin accounts
Many break-ins start with a stolen or guessed password. Multi-factor authentication (MFA) asks for a second proof, such as an app prompt or a hardware key, so a password alone isn’t enough. Start with email, then every admin account, remote access, the firewall’s management login and finance systems. Avoid SMS codes where an app or key is available.
Done when: MFA is enforced, not optional, for all email and admin accounts, and there’s a documented process for lost devices.
3. A properly managed firewall at the office edge
A firewall controls what traffic gets in and out. The router your internet provider supplied isn’t the same thing. A business firewall that is kept up to date, configured with documented rules and actually monitored is one of the most valuable controls you can have. The brand matters less than the care it gets; our guide to choosing between Cisco, Aruba and Fortinet explains how to decide.
Done when: a supported business firewall is in place, its firmware is current, management access is restricted and uses MFA, its rules are documented and someone is responsible for reviewing alerts.
4. Patching and supported software only
Attackers routinely target known weaknesses in out-of-date software and network equipment. Turn on automatic updates where you can, set a monthly routine for the rest, and replace anything that is out of vendor support, including old switches, Wi-Fi access points and VPN appliances.
Done when: every item on your asset list is supported and has a patch schedule, and urgent fixes for internet-facing systems are applied within days, not months.
5. Least privilege: no everyday admin rights
If staff browse and read email with admin rights, any malware they open gets admin rights too. Give people only the access they need, and keep separate admin accounts for admin tasks.
Done when: nobody uses an admin account for day-to-day work, and access is reviewed whenever people join, move or leave.
6. Backups you have tested restoring
A backup you have never restored is a hope, not a plan. Follow a simple rule: several copies, on different media, with at least one copy offline or immutable so ransomware can’t reach it. Remember cloud services: Microsoft 365 and similar platforms don’t replace your own backup of business-critical data.
Done when: you have restored a real file and a real system from backup and written down how long it took.
7. Separate guest, staff and device networks
Guests, staff laptops, printers, CCTV and meeting-room kit don’t need to see each other. Splitting them onto separate virtual networks (VLANs), with firewall rules between them, limits how far an attacker or a compromised device can reach. This is easiest to build in during a move; see our guide to office Wi-Fi and cabling for a Dubai fit-out.
Done when: guest Wi-Fi can’t reach internal systems, and cameras, printers and AV kit sit on their own segments.
8. Staff phishing awareness
People are a strong line of defence when they know what to look for and feel safe reporting mistakes. Short, regular training on spotting phishing and invoice fraud, plus a one-click way to report suspicious emails, goes a long way. Add a rule that any change to supplier bank details is confirmed by phone on a known number.
Done when: every member of staff has had training this year, and everyone knows how to report a suspicious email without fear of blame.
9. Supplier and third-party access control
IT providers, software vendors and contractors often have remote access to your systems. Know who they are, give them only what they need, require MFA and remove access when the work ends. International cyber agencies, led by CISA, published joint guidance in 2022 on exactly this risk with managed service providers.
Done when: you have a list of every third party with access, and each one is limited, protected with MFA and reviewed at least twice a year.
10. A one-page incident response plan
When something goes wrong, people need to know who decides, who to call and what to do first. One page that people can find in a hurry is better than a binder no one reads. Include your IT provider’s emergency contact, your insurer, and who talks to clients.
Done when: the plan names who to call internally and externally, what to isolate first and who handles communication, and you have walked through it once as a table-top exercise.
How do these map to the UAE IA Standard?
The table shows where each control broadly sits in the UAE IA Standard’s control families. It is a guide to help you talk to clients or auditors, not a formal compliance mapping.
| Control | Indicative UAE IA Standard family (names per v1.1) |
|---|---|
| 1. Asset list | T1 Asset Management |
| 2. MFA | T5 Access Control |
| 3. Managed firewall | T4 Communications (network security) |
| 4. Patching | T7 Information Systems Acquisition, Development and Maintenance (technical vulnerability management) |
| 5. Least privilege | T5 Access Control |
| 6. Tested backups | T3 Operations Management (backup) |
| 7. Network segmentation | T4 Communications (network security) |
| 8. Phishing awareness | M3 Awareness and Training |
| 9. Supplier access | T6 Third Party Security |
| 10. Incident response plan | T8 Information Security Incident Management |
Family names are taken from the UAE IA Regulation v1.1 published by TDRA; version 2.1 keeps the same 15-family structure of six management and nine technical families.
What should I do first if I have no security team?
Spread the work over three months so it actually happens, and give each month a named owner.
| Month | Controls | Typical owner |
|---|---|---|
| 1 | Asset list, MFA on email and admin accounts, remove everyday admin rights | Operations lead with IT provider |
| 2 | Firewall review, patch routine, separate guest and device networks, backup restore test | IT provider or network partner |
| 3 | Phishing training, supplier access review, incident plan and table-top walk-through | Management with IT |
Firewall configuration and network segmentation are where a specialist partner tends to save the most time, because getting them wrong can either leave gaps or break things people rely on. If you prefer someone else to watch alerts and keep things patched, compare managed network services with in-house IT.
What drives the cost?
We won’t quote prices without seeing your setup, but the main cost drivers are predictable: the number of users and devices, how many sites you have, whether your firewall and switches are still supported, how much of your estate is in the cloud, and whether you want monitoring out of hours. Fixing configuration usually costs far less than replacing hardware, so start with a review before buying anything.
Common mistakes
- Buying tools before knowing what you have. Without an asset list, new tools protect half the estate.
- Optional MFA. If it is optional, the accounts attackers want are the ones without it.
- Untested backups. Many businesses discover during an incident that backups were failing or too slow to restore.
- One flat network. A single compromised printer or camera can see everything.
- No owner. Controls without a named owner quietly decay.
If personal data is involved, these controls are also the practical core of UAE PDPL compliance.
How Softworx Services helps
Softworx Services is a systems integrator and network services provider with a technology-led, vendor-agnostic approach. Our Cyber & Compliance and Networks teams work with vendors including Palo Alto, Fortinet, Cisco and HP Aruba, and our Dubai office is at Saaha Offices, Downtown Dubai. We can help you put the technical controls on this list in place, from firewalls and MFA to network segmentation and backup design.
Frequently asked questions
Is cyber security a legal requirement for Dubai businesses?
It depends on your sector, clients and contracts. Government entities and critical infrastructure must follow the UAE IA Standard, and Dubai government suppliers may meet DESC requirements through their contracts. If you handle personal data, the PDPL requires appropriate security measures.
What is the minimum cyber security a small business in Dubai should have?
At least MFA on email and admin accounts, a supported and managed firewall, patching, no everyday admin rights and tested backups. Those five deal with the most common ways smaller firms are attacked.
What does MFA mean and do I need it?
Multi-factor authentication asks for a second proof of identity on top of a password, such as an app prompt. Yes: turn it on for email, remote access and every admin account.
How often should backups be tested?
Test restores on a regular schedule, and after any significant change to your systems. Record how long the restore took, because that is how long you will be down.
Is the UAE IA Standard the same as NESA?
Broadly, yes. The current UAE IA Standard is issued by the UAE Cyber Security Council and descends from the earlier NESA standards, so many people still call it NESA.
Talk to Softworx Services in Dubai
Want a second pair of eyes on where to start? Talk to the Softworx Services team about your current setup and the controls that matter most for your business.
Sources
- UAE Information Assurance Standard, UAE Cyber Security Council: https://csc.gov.ae/en/w/uae-information-assurance-standard
- UAE Information Assurance Regulation v1.1, TDRA (control families): https://tdra.gov.ae/-/media/About/regulations-and-ruling/EN/UAE-Information-Assurance-Regulation-v1-1-pdf.ashx
- Dubai Electronic Security Center, regulations and standards: https://www.desc.gov.ae/
- CIS Critical Security Controls, Implementation Group 1: https://www.cisecurity.org/controls/implementation-groups/ig1
- CISA and partners, “Protecting Against Cyber Threats to Managed Service Providers and their Customers” (AA22-131A): https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-131a
- Federal Decree-Law No. 45 of 2021 (PDPL), UAE Legislation portal: https://uaelegislation.gov.ae/en/legislations/1972