We are using multiple security standards and regulations to assess the security posture of an organization and answer the question of how secure it is right now. The assessment is based on CMM and RA which are proven, practical, proactive, comprehensive and cost effective methodologies. We also help organisations avoid devastating breaches by delivering high-quality cyber security training and innovative solutions that reduce risk across UAE.
The UAE Information Assurance Regulation v1.1 (March 2020, replacing the UAE Information Assurance Standards v1.0) provides requirements for raising the minimum level of information security across all relevant entities in the UAE. The UAE IAR controls are mapped with controls of the following standards:
Abu Dhabi Information Security Standards (ADISS) are issued in suport of the Abu Dhabi Information Security Policy, and aims at providing protection to the information assets owned and managed by the government of Abu Dhabi. ADISS v2.0 seeks to support the government’s vision of delivering services that are effective, efficient and which add tangible value.
The Dubai Information Security Regulation (Dubai ISR) encompasses 13 information security domains composed of specific controls and sub-controls, and is closely aligned with other International Information Security related Standards reflecting Dubai Government’s acknowledgement and recognition of the information security best practices stated therein. The Dubai ISR v2 has also includes distinctive items reflecting specific requirements within the context of The Dubai Government.
ISO/IEC 27001 sets out the requirements for an information security management system (ISMS). An ISMS includes people, processes and IT systems by applying a risk management process, and is a systematic approach to managing sensitive company information so that it remains secure.
ISO 22301 provides requirements for a best-practice business continuity management system (BCMS). A BCMS is a framework for organizations to update, control and deploy an effective BCM programme that helps them prepare for, respond to and recover from disruptive incidents. Implementing a BCMS includes the development of business continuity plans, taking into account organizational contingencies and capabilities, as well as the organisation’s individual business needs.
ISO/IEC 27005 is a guide for information security risk management which complies with the concepts, models, and general processes specified in ISO/IEC 27001.
A secure software development process covering the entire life cycle (S-SDLC) ensures that security assurance activities such as penetration testing, code review, and architecture analysis are an integral part of the development effort, and are performed regularly in production, and after major changes.
ISO/IEC 27032:2012 sets out the baseline security practices for stakeholders in the Cyberspace, and provides guidance for improving the state of Cybersecurity drawing out the unique aspects of that activity and its dependencies on other security domains, in particular: information security, network security, internet security, and critical information infrastructure protection (CIIP).
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards designed to ensure that all companies that accept, process, store or transmit credit card information maintain a secure environment.
Data security refers to protective digital privacy measures that are applied to prevent unauthorized access to computers, databases and websites. Data protection is the process of safeguarding important information from corruption, compromise or loss. Data privacy is the process concerned with the proper handling of data – consent, notice, and regulatory obligations.
ISO 9001 sets out the criteria for a quality management system that can be used by any organisation, large or small, regardless of its field of activity.