Maturity · UAE Information Assurance Regulation
Your UAE information assurance posture, measured control by control and turned into a costed action plan.
10 themes, a 5-level scale. And the action that moves each level to the next.
The framework’s 10 themes, already written from L1 to L5. One company, one business unit, or 300 at once.
Maturity · UAE Information Assurance Regulation
10 themes, 5-level scale.
Nordhavn Industries
53 / 100
They measure their maturity with Datamensio
An example
This could be your situation.
Take one company as an example: three sites, three spreadsheets, no shared answer.
Nobody can consolidate.
Nordhavn Industries, 2,400 people in Hamburg, Lyon and Porto. A client asks where the group stands. Each site answers in its own spreadsheet, with its own scales.
Three weeks, a single base.
One UAE Information Assurance Regulation (TDRA / Signature Trust Standard), version 1.1 assessment launched across all three sites at once, from the managers’ interview notes. The framework was already written, its 10 themes and levels L1 to L5 too.
Two costs avoided before being committed.
A score of 53 out of 100, with the gap concentrated on three themes. The AI companion spotted that two actions duplicated those of another audit. The committee report took one sentence to request.
What it saved them
- 3sites measured on the same base, instead of three questionnaires to reconcile
- 2duplicate actions caught before the spend
- 1committee report, with no manual rework
These figures are an example. They could be yours.
The standard imposes processes. Datamensio says where you stand.
01
The framework is already written
Themes, questions and levels L1 to L5, all written. You do not start from an empty spreadsheet.
02
The score lands the same day
Online, by self-assessment link or in interview. Theme by theme, comparable over time.
03
The gap becomes a costed plan
Every step up carries its action. The AI prioritises on expected effect, not on the order of the standard.
04
Progress can be demonstrated
Campaign after campaign, against your target and against your own past. That is what your board asks for.
The maturity scale
One level, the next, and the action that links the two.
It is this mechanism (a level, a higher level, and the action linking the two) that turns a finding into a trajectory.
Are information assets classified and handled according to a defined scheme?
- N1
No classification scheme in place. Documents and data circulate without any assigned level.
- N2
A scheme exists in a policy, but classification is only applied to a few document repositories and handling rules remain unknown to business teams.
- N3
Assets in scope are classified, and handling rules are distributed and generally applied. Gaps are occasional.
- N4
Classification is owned by asset owners, reviewed at each change, and supported by tooling in storage and messaging environments. Failures are tracked and addressed.
- N5
The scheme is periodically revised in line with regulatory change and observed incidents, with documented tracking of revisions and sample-based control checks.
Action to move from L2 to L3
Assign an owner to each asset in scope, have remaining assets classified during the quarterly risk review, and build handling rules into the onboarding awareness programme for new joiners.
« With Datamensio, we meet our objectives far more efficiently. The ERDF inspection services and our supervising ministry particularly appreciated an approach that gives them reliable data. »
Director, CCI 94CCI Île-de-France
« We believe this is the most suitable solution to scale our transformation project and measure impact according to our needs. »
Maja SucekChief Operating Officer, Interreg Danube
Rarely on its own
Frameworks combine. Put several together to cover your business, or have the AI write yours.
Take your first measurement
What this framework covers
The UAE Information Assurance Regulation is the national information security framework of the United Arab Emirates, issued by the telecommunications and digital regulatory authority. It organises a set of controls split between management controls and technical controls, each assigned a priority level. Entities in sectors identified as critical must apply it and demonstrate implementation, based on a risk-driven approach and a defined scope of systems and assets.
In practice, running the programme is trickier than reading the text. Controls are numerous and overlap with those already deployed under ISO 27001 or group policies. Three questions come up repeatedly: what is the exact scope of systems covered within the UAE entity, who is responsible for each control between the local subsidiary and the parent company, and what evidence underpins implementation claims when the regulator or sector authority requests a review. Without documented answers, progress remains a matter of assertion.
One common confusion deserves clearing up: the Information Assurance Regulation is not a local variant of ISO 27001, even though it shares its logic and part of its vocabulary. It adds requirements specific to the national context, notably on information classification, incident reporting to the authorities, and supply chain security. Several sector regulators and emirate-level authorities have also built their own frameworks on this baseline, so an entity may be subject to both the national regulation and a local framework, each with different evidence expectations.
A compliance audit concludes with a gap or a pass, control by control. The maturity assessment answers a different question: what level of mastery each practice sits at, and what precise action moves it up a level. This distinction is what allows a programme to be sequenced across several cycles, entities to be compared against one another, and remaining effort to be costed rather than simply flagged as a shortfall.
In Datamensio, the framework is ready to use and you keep full control of it. AI adjusts themes, questions and levels to the scope of your UAE entity, or builds a variant from your internal policies and your sector regulator’s requirements. Identified gaps feed a prioritised roadmap that can be consolidated with your other cyber assessments.
Reference standard: UAE Information Assurance Regulation (TDRA / Signature Trust Standard), version 1.1
The themes assessed
Information assurance governance
Formal policy approved by management, roles and responsibilities, steering committee, alignment between the subsidiary and group governance, resource allocation.
Scope and risk management
Definition of the systems in scope, risk assessment method, acceptance criteria, control prioritisation based on the agreed risk level.
Asset management and information classification
Inventory of information and technical assets, classification scheme, rules for marking, handling and retention, treatment of sensitive data.
Human resources security and awareness
Pre-employment checks, contractual clauses, awareness programme, obligations on mobility and departure, management of staff privileged access.
Physical and environmental security
Secure areas, access control to technical premises, equipment protection, power and cooling, secure disposal of media.
Technical controls and operations
Access and authentication management, configuration hardening, patch management, logging and monitoring, protection against malicious code, encryption.
Communications and cloud security
Network segmentation, filtering and gateways, exchanges with third parties, requirements applicable to hosted services and data location.
Acquisition, development and maintenance
Security requirements in projects, code reviews and testing, separation of environments, change and release management.
Third parties and supply chain
Supplier qualification, contractual requirements, monitoring of security service levels, control of remote access, reversibility.
Incidents, continuity and improvement
Incident detection and qualification, reporting to competent authorities, continuity and recovery plans, exercises, lessons learned and periodic review of controls.
A short version of the framework is available for the online self-assessment.
Frequently asked questions
Does this assessment deliver a certificate of compliance with the regulation?
No. Datamensio measures the maturity of your practices and prepares the compliance review. Compliance itself is assessed by the regulator or the audit body designated for your sector.
What is the difference between a maturity assessment and a compliance audit?
The audit concludes, control by control, with a gap or a pass. The assessment places each practice on a progressive scale and identifies the action that moves it up a level. The assessment prepares for the audit and allows the programme to be sequenced, the audit validates it.
We are already ISO 27001 certified. Is the assessment still worthwhile?
Yes. The regulation shares part of ISO 27001’s logic but adds specific requirements, notably on information classification, incident reporting to the authorities, and the supply chain. The assessment highlights this delta rather than repeating work already done.
How long does the assessment take?
The short version takes 20 to 30 minutes to complete. The full version, run collaboratively with several contributors, typically spans one to two weeks, with most of the time spent gathering input from technical and business teams.
Can the framework be adapted to our sector regulator?
Yes. Questions, levels and themes can all be modified, and you can add the requirements specific to your supervisory authority. AI can also build a variant from your internal policies. You retain full control of the framework.
How can several group entities be compared?
Assessments run on the same framework can be compared across business units and over time. A cross-entity roadmap consolidates gaps from several entities and groups redundant actions together, avoiding funding the same workstream twice.
Does answering require technical expertise?
Questions focus on management practices and the state of control implementation, not on configurations. Some require input from a technical contact or the local manager: collaborative mode allows these questions to be assigned to the right person.
Where is assessment data hosted?
In France, with OVH, backed up with Scaleway. No transfer outside the European Union. The AI models used can be selected, including European solutions.