UAE NESA IA Standards

UAE National Electronic Security Authority Information Assurance standard - control families M1-T15.


Short name	NESA IA
Region	Middle East & Africa
Country or scope	United Arab Emirates
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers NESA IA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for NESA IA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for NESA IA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`AE-NESA-ASSET` Asset Inventory	Entities must identify and inventory their information assets, including the software composing critical systems; a populated component inventory is the direct SBOM expression (UAE IA Standards, asset-management control family)	Scan
`AE-NESA-ASSET-ID` Unique Asset Identification	Inventoried assets must be uniquely identified so ownership and protection responsibilities can be assigned; standard package identifiers on components satisfy this at SBOM level (UAE IA Standards, asset-management control family)	Scan
`AE-NESA-3P` Third-Party Security	Security requirements must be enforced across third-party and outsourcing relationships, which requires the supplier behind each software component to be recorded (UAE IA Standards, third-party security control family)	Scan
`AE-NESA-INT` System Acquisition and Integrity	Controls on acquisition, development and maintenance require assuring the integrity of system software; cryptographic hashes across deployed components evidence this (UAE IA Standards, systems acquisition/development/maintenance control family)	Scan
`AE-NESA-OPS` Operations Security and Patching	Operations security controls require managing technical vulnerabilities and applying updates, demonstrable only when component versions are recorded (UAE IA Standards, operations-management control family)	Scan
`AE-NESA-ISMS` Documented Security Management	The management control families require documented, maintained information security governance; an identified, timestamped SBOM document contributes to that documentation baseline (UAE IA Standards, management control families M1+)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`NESA-M1`	Information Security Governance (M1)
`NESA-M2`	Risk Management Framework (M2)
`NESA-M3`	Compliance and Legal Requirements (M3)
`NESA-T1`	Network Security Architecture (T1)
`NESA-T3`	Identity and Access Management (T3)
`NESA-T7`	Cryptographic Controls (T7)
`NESA-T10`	Vulnerability Management (T10)
`NESA-T13`	Incident Management (T13)

Policy templates

Written for NESA IA:

UAE NESA: Information Assurance Standards Security Policy
UAE NESA: Cyber Incident Notification Procedure

And 22 from the standard set, adapted to NESA IA.