The UAE Information Assurance Regulation is the national security standard behind what many call the NESA or UAE IA standards. It sets 188 controls in 15 families, six management (M) and nine technical (T), each ranked P1 to P4 by how urgently an entity should implement it.
Free account needed to download. You come straight back to the file.
Who it is for. Government entities and the other entities the regulator designates as critical under the UAE critical information infrastructure policy, which must implement it. Other UAE organisations are encouraged to use it voluntarily.
What this list covers. UAE Information Assurance Regulation Version 1.1, March 2020, read from the UNIDIR Cyber Policy Portal's copy of the TRA PDF (the TRA text that succeeded the 2014 UAE IA Standards v1.0, often still called the NESA standards). Third parties report a newer version issued in 2025 that we could not read, so check the issuing authority for the current text: 188 controls. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it requires |
|---|---|---|
| M1.1.1 | Understand the entity and its context | Work out the outside and inside factors that shape how well security can succeed: who has an interest in it and what they need, your sector and national setting, your capabilities and your structure. Priority P1, always applicable. |
| M1.1.2 | Leadership and management commitment | Top management visibly leads on security: it sets policy and objectives that fit strategy, builds security into processes, funds it, communicates its value, backs people, drives improvement and joins reviews. Priority P1, always applicable. |
| M1.1.3 | Roles and responsibilities | Assign and communicate security roles and authority, including who ensures conformity and who reports performance. Appoint an Information Security Manager and set up an Information Security Committee. Priority P1, always applicable. |
| M1.2.1 | Information security policy | Top management issues a documented security policy that suits the entity, frames objectives, commits to meeting requirements and to improvement, and is reviewed at planned intervals or after major change. Priority P1, always applicable. |
| M1.2.2 | Supporting policies | Publish supporting policies for every area of the Regulation your risk assessment calls for, including sector rules, with a clear audience, management backing and regular review. Do not claim what you do not do. Priority P2, always applicable. |
| M1.3.1 | Authorisation of new information systems | Run a management approval process before any new information system goes live, and set rules for the use of personal systems to process business information. Priority P2. |
| M1.3.2 | Confidentiality agreements | Keep a standard NDA template, tie it to your information classification so you know what it covers, record every signed NDA and review the register periodically. Priority P2. |
| M1.3.3 | Contact with authorities | Know which national and sector authorities matter, name a point of contact and tell them where allowed, and have a policy on when and how to engage them. Priority P4. |
| M1.3.4 | Contact with special interest groups | Identify relevant security forums and professional groups, resource your participation, set what staff may share and allow what is learned to circulate inside the entity. Priority P4. |
| M1.3.5 | Risks from external parties | Before giving any outside party access, assess the risks and apply controls. Set an external-party access policy, limit their physical and logical access and monitor what they do. Priority P1. |
| M1.3.6 | Security when dealing with customers | Meet the identified security requirements before customers get access to your information or assets, make sure they comply with your policy, and monitor and verify their access. Priority P2. |
| M1.3.7 | Security in third-party agreements | Make sure every third-party contract covers your security policy for access, processing, communication and management of information, includes compliance checks, and audit third-party services. Priority P2. |
| M1.4.1 | Resources | Provide enough people and money for security, and make sure the people are competent: define the skills needed, check education, training or experience, close gaps and keep evidence. Priority P1, always applicable. |
| M1.4.2 | Internal and external communication | Decide what to communicate, when, to whom, by whom and how, keep working communication with designated UAE government entities, and document the plan. Priority P2, always applicable. |
| M1.4.3 | Documentation | Control security documents: approve before issue, review, version, distribute and dispose by classification and block obsolete copies. Record compliance with the mandatory controls so each one can be traced to the Regulation. Priority P2, always applicable. |
| Ref | Control | What it requires |
|---|---|---|
| M2.1.1 | Risk management policy | Adopt a documented, approved risk management policy covering critical services, asset criticality, team roles, risk acceptance, impact and evaluation criteria, treatment and review strategies, and repeatable assessments. Priority P1, always applicable. |
| M2.2.1 | Risk identification | Identify security risks to confidentiality, integrity and availability: set scope, find critical functions and systems, vulnerabilities, threats and existing controls. Name risk owners and document the results. Priority P1, always applicable. |
| M2.2.2 | Risk analysis | Work out the consequences of identified risks and how likely they are given existing controls, vulnerabilities and threats, set the risk levels and document the analysis. Priority P1, always applicable. |
| M2.2.3 | Risk evaluation | Compare analysed risks to the criteria in your risk policy, rank them for treatment and document the outcome, sharing it with national and sector authorities as required. Priority P1, always applicable. |
| M2.3.1 | Risk treatment options | Pick treatment for each risk from reducing, retaining, avoiding or transferring it, then check the choice works: decide whether residual risk is tolerable and re-treat if not. Priority P1, always applicable. |
| M2.3.2 | Identification of controls | Choose the controls your treatment decisions need, starting from this Regulation and adding entity-specific ones, weighing risk acceptance criteria and legal duties. Use the Statement of Applicability to avoid gaps. Priority P1, always applicable. |
| M2.3.3 | Risk treatment plan | Write a documented plan showing the management actions, resources, responsibilities, priorities and target dates for putting the chosen controls in place. Priority P1, always applicable. |
| M2.3.4 | Statement of Applicability | Compare your chosen controls with the Regulation's risk-based ones and record the controls you need, why, their implementation status, and a justification for any you exclude. Priority P1, always applicable. |
| M2.3.5 | Information security objectives | Set security objectives for relevant functions and levels that are consistent with policy, measurable where practical, informed by requirements and risk results, communicated, updated and documented. Priority P2, always applicable. |
| M2.4.1 | Risk review and update | Plan and document how risk assessment and treatment are reviewed and updated, on schedule and after significant change, watching incidents that could prompt reassessment and giving review clear owners. Priority P1, always applicable. |
| M2.4.2 | Risk communication and consultation | Set up a risk communication plan so decision-makers and other key stakeholders hear about risk at every stage, and follow the regulator's issuances on risk management. Priority P1, always applicable. |
| Ref | Control | What it requires |
|---|---|---|
| M3.1.1 | Awareness and training policy | Keep an awareness and training policy that fits the entity, frames objectives, supports the related controls and sets roles for those who provide and receive training. Priority P2. |
| M3.2.1 | Awareness and training programme | Run a programme that tells people how they affect security and the cost of not conforming, sets needed competencies, delivers training or other action, evaluates results and keeps records. Priority P2, always applicable. |
| M3.3.1 | Training needs | List the security skills the entity needs, assess the skills it has and identify the gaps. Priority P1, always applicable. |
| M3.3.2 | Training implementation plan | Plan how each training need is met, with solutions, a delivery timeline and the resources allocated. Priority P3, always applicable. |
| M3.3.3 | Training execution | Deliver training to the plan, find alternatives when the plan hits problems and update the plan so every identified need is still covered. Priority P2, always applicable. |
| M3.3.4 | Training results | Measure security knowledge before and after training, confirm the training meets its aims and fix or replace training that falls short. Priority P2. |
| M3.3.5 | Training records | Keep a training record for each person covering education, training, skills, experience and qualifications, and review the records periodically for completion. Priority P2. |
| M3.4.1 | Awareness campaign | Plan and run awareness campaigns scoped to the risks of users' work, with a timeline, tracking against it, alternatives if it slips and updates to keep objectives met. Priority P2. |
| Ref | Control | What it requires |
|---|---|---|
| M4.1.1 | Human resources security policy | Maintain an HR security policy setting stakeholder roles and procedures, and put the matching controls in place. Priority P2, always applicable. |
| M4.2.1 | Screening | Define a background-check process that follows the law and ethics and fits the business need, information classification and risk, then check all candidates, contractors and third-party staff. Priority P2, always applicable. |
| M4.2.2 | Terms and conditions of employment | Set standard security terms for staff, contractors and third parties, include them in every contract, make sure people understand and sign them and revisit existing contracts. Priority P2, always applicable. |
| M4.3.1 | Management responsibilities | Managers make sure staff, contractors and third parties follow security policy: build it into HR policy, tell everyone what applies and have users read and accept the policies on first access. Priority P2, always applicable. |
| M4.3.2 | Disciplinary process | Define and enforce a formal disciplinary process for security breaches, make staff aware of it and keep records of breaches. Priority P2, always applicable. |
| M4.4.1 | Termination responsibilities | Define a termination policy that communicates ongoing duties such as confidentiality and property rights, and assign who carries out termination or change of role. Priority P1, always applicable. |
| M4.4.2 | Return of assets | Require employees, contractors and third parties to hand back all entity assets when employment, contract or agreement ends. Priority P1, always applicable. |
| M4.4.3 | Removal of access rights | Remove access to information and systems when employment or contracts end and adjust it on change, checking that the process was followed and credentials were revoked. Priority P1, always applicable. |
| Ref | Control | What it requires |
|---|---|---|
| M5.1.1 | Compliance policy | Keep a policy setting the roles and approach for identifying and meeting compliance requirements at entity, sector and national level. Priority P2. |
| M5.2.1 | Identification of applicable legislation | Keep a process to identify statutory, regulatory and contractual security requirements, derive system requirements and controls, review them periodically and document ownership. Priority P2. |
| M5.2.2 | Intellectual property rights | Keep an IPR compliance policy and a process to identify the requirements, covering use of licensed software and protected material, with specific controls and periodic review. Priority P4. |
| M5.2.3 | Protection of organisational records | Identify records with legal or business protection needs and apply controls against their loss, destruction and falsification, reviewing the requirements periodically. Priority P2. |
| M5.2.4 | Data protection and privacy | Identify data with privacy or data protection requirements under law and contract, derive system requirements and controls, and review them periodically. Priority P3. |
| M5.2.5 | Prevention of misuse of systems | Tell everyone what counts as authorised use, be able to monitor for unauthorised use and act to stop it when found. Priority P3. |
| M5.2.6 | Regulation of cryptographic controls | Identify the legal and contractual requirements on cryptography, set system requirements and controls to meet them, and review periodically. Priority P2. |
| M5.2.7 | Liability in information sharing communities | Identify liability and remediation issues for accidental or deliberate disclosure in each community you share with, define remediation steps and raise any gaps with the community. Priority P4. |
| M5.3.1 | Compliance with security policies and standards | Managers identify the security procedures in their area, monitor that they are carried out and correct problems. Priority P4. |
| M5.4.1 | Technical compliance checking | Check systems routinely against security standards and this Regulation, using qualified people to run and review the checks and reporting problems to the right authority. Priority P2. |
| M5.5.1 | Information systems audit controls | Assign audit responsibility for system controls, define audit requirements, plan the audits and take steps so audits do not disrupt business processes. Priority P4. |
| M5.5.2 | Protection of audit tools | List the audit tools, identify what information they hold and classify it, and set minimum security for the tools to match. Priority P4. |
| M5.5.3 | Audit of community functions | Identify the audit rights of each information sharing community you belong to, and build provision for their audits and your own into your audit plan and tools. Priority P4. |
| Ref | Control | What it requires |
|---|---|---|
| M6.1.1 | Performance evaluation policy | Set a policy that frames performance evaluation: reporting methods, how control measures roll up to objectives and risk, and how incident reports feed in. Priority P3. |
| M6.2.1 | Monitoring, measurement and evaluation | Decide what to measure, how, when and who measures and evaluates, then monitor security performance and effectiveness and document methods and results. Priority P2, always applicable. |
| M6.2.2 | Internal audits | Plan and run internal audits with criteria, scope, objective auditors and a schedule, report to management and document, checking conformity to your own, the Regulation's and sector requirements. Priority P2, always applicable. |
| M6.3.1 | Corrective action | Respond to nonconformities by correcting them and their effects, finding causes and similar cases, applying fixes, reviewing effectiveness and documenting actions. Priority P2, always applicable. |
| M6.3.2 | Continual improvement | Keep improving the suitability, adequacy and effectiveness of security controls, using performance results and incidents to decide what to change. Priority P2, always applicable. |
| Ref | Control | What it requires |
|---|---|---|
| T1.1.1 | Asset management policy | Adopt a documented asset management policy scaled to the entity: purpose and scope, roles, ownership, how assets and BYOD are managed. Users acknowledge it, and it is reviewed at planned intervals or after change. Priority P2. |
| T1.2.1 | Inventory of assets | Maintain a current inventory of all information assets that is accurate and consistent with your other inventories. Priority P2. |
| T1.2.2 | Ownership of assets | Give every inventoried asset a named owner with management responsibility, and review ownership periodically. Priority P2. |
| T1.2.3 | Acceptable use of assets | Write down acceptable-use rules tailored to each role, make sure staff, contractors and third parties receive and accept them, and check compliance. Priority P2. |
| T1.2.4 | Acceptable BYOD arrangements | Set rules for personal devices used in your environment, tailored to role, accepted by those who use them, and measure compliance. Priority P2. |
| T1.3.1 | Classification of information | Define a classification scheme from value, legal needs, sensitivity and criticality, with the protection each level needs, mapped to owners, kept current and readable by automated systems. Priority P3. |
| T1.3.2 | Labelling of information | Set a labelling procedure for physical and electronic information and assets and apply labels that reflect the classification. Priority P3. |
| T1.3.3 | Handling of information assets | Write handling procedures for processing, storing and sending information according to classification and label, and follow them. Priority P3. |
| T1.4.1 | Removable media | Manage removable media through its life, set protection by classification, block it on systems that do not need it and control who uses it. Priority P1. |
| T1.4.2 | Disposal of media | Dispose of media securely according to the sensitivity of its contents, destroy paper and digital media when finished with and record disposal of confidential media. Priority P2. |
| Ref | Control | What it requires |
|---|---|---|
| T2.1.1 | Physical and environmental security policy | Maintain a documented policy for physical protection of assets: management commitment, roles, information classification and location, formal user acknowledgement and regular review. Priority P4. |
| T2.2.1 | Physical security perimeter | Protect areas holding information and systems with barriers such as walls, controlled gates or staffed reception, classifying areas and matching each perimeter and countermeasure to its level. Priority P2. |
| T2.2.2 | Physical entry controls | Allow only authorised people into secure areas: authenticate and log entries, require visible ID and escort contractors and third parties unless their area is cleared. Priority P2. |
| T2.2.3 | Securing offices, rooms and facilities | Keep the public away from key facilities and avoid outward signs of what is held or done inside secure areas. Priority P2. |
| T2.2.4 | External and environmental threats | Protect against disasters, attacks and accidents: control storage of hazardous materials, shield fallback equipment and backup media, and align protections with your risk assessment. Priority P4. |
| T2.2.5 | Working in secure areas | Set guidelines for working in secure areas, make sure people know and accept them, supervise activity and control which devices go in. Priority P3. |
| T2.2.6 | Public access, delivery and loading areas | Restrict loading and delivery areas to authorised people, separate loading from other activity and inspect and register material in and out. Priority P3. |
| T2.3.1 | Equipment siting and protection | Place and protect equipment against unauthorised access, and monitor environmental conditions with alerts for potential threats. Priority P2. |
| T2.3.2 | Supporting utilities | Test supporting utilities, provide uninterrupted power for information systems and emergency lighting, and keep utility maintenance logs current. Priority P4. |
| T2.3.3 | Cabling security | Protect power and telecom cabling from tampering, keep power and data cables apart and scan the network regularly for unauthorised devices. Priority P4. |
| T2.3.4 | Equipment maintenance | Document supplier maintenance recommendations for technicians, set commissioning and decommissioning procedures that protect sensitive data and keep maintenance logs. Priority P3. |
| T2.3.5 | Off-premises equipment | Set policy to protect equipment that is used or kept off-site, in line with the physical and environmental policy. Priority P3. |
| T2.3.6 | Secure disposal or reuse of equipment | Make sure sensitive data and licensed software are removed or overwritten before equipment is disposed of or reused, with procedures by sensitivity and a disposal record. Priority P3. |
| T2.3.7 | Removal of property | Require authorisation before information assets leave the premises and keep a list of what is off-site and with whom. Priority P3. |
| T2.3.8 | Unattended user equipment | Define what users must do when leaving equipment, and set systems to protect themselves automatically, for example by locking. Priority P2. |
| T2.3.9 | Clear desk and clear screen | Adopt a clear desk policy for paper and removable media and a clear screen policy, state user duties and make it available to all users and at every desk covered. Priority P3. |
| Ref | Control | What it requires |
|---|---|---|
| T3.1.1 | Operations management policy | Set a policy that frames how systems, processes and security controls are operated, appropriate to the entity. Priority P4. |
| T3.2.1 | Common configuration guidelines | List the common IT products in use and define minimum secure configuration settings for each. Priority P2. |
| T3.2.2 | Documented operating procedures | Document operating procedures in a form that is easy to share, review them periodically and make sure relevant people know them and can reach them. Priority P3. |
| T3.2.3 | Change management | Document a change process with controls that make sure it is followed, define which systems it covers and assign management responsibility for changes. Priority P4. |
| T3.2.4 | Segregation of duties | Identify duties that must be kept apart, give them to different people, and use alternative controls where that is not possible. Priority P2. |
| T3.2.5 | Separate development, test and operations | Decide how far to separate development, test and live environments, set rules for moving software between them and build those rules into the development lifecycle. Priority P2. |
| T3.3.1 | Capacity management | Measure the capacity of current systems, estimate needs of planned ones, build capacity checks into demand and development processes and adjust to keep performance. Priority P4. |
| T3.3.2 | System acceptance and testing | Set test requirements and acceptable results before new or updated systems go live, run and document the tests and assign who confirms they are complete. Priority P3. |
| T3.4.1 | Protection against malware | Run up-to-date anti-malware on the network, servers and endpoints, scan files, email attachments and removable media, disable auto-run, log and alert on detections and make users aware of the risks. Priority P1. |
| T3.5.1 | Information backup | Decide what to back up and how often, document the procedures and capabilities, test backups for reliability and make sure the staff doing them are qualified. Priority P1. |
| T3.6.1 | Monitoring policy and procedures | Document what is monitored, how and how often, who is responsible, how findings feed incident response and any sector or national sharing duties. Priority P3. |
| T3.6.2 | Audit logging | Decide which activities to log on devices, operating systems and applications, what detail to capture, how often logs are reviewed, by trained staff, and how long they are kept. Priority P2. |
| T3.6.3 | Monitoring system use | Identify which system use to monitor, the minimum data to collect, review frequency and retention, with review done by trained personnel. Priority P1. |
| T3.6.4 | Protection of log information | Identify the logs across your systems and protect them from tampering and unauthorised access in proportion to how sensitive they are. Priority P2. |
| T3.6.5 | Administrator and operator logs | Log what administrators and operators do, set the detail, review frequency and retention, and have trained staff review the logs. Priority P2. |
| T3.6.6 | Fault logging | Record faults in information processing and communications with set detail, review frequency, trained analysis and retention. Priority P3. |
| T3.6.7 | Clock synchronisation | Synchronise system clocks with an agreed accurate time source, defining the time format, clock accuracy level by network element and regular checks. Priority P4. |
| Ref | Control | What it requires |
|---|---|---|
| T4.1.1 | Communications policy | Adopt a documented communications policy that protects information in transit from interception, copying, alteration, misrouting and destruction, acknowledged by users and reviewed regularly. Priority P3. |
| T4.2.1 | Information transfer procedures | Write procedures saying when transfers need protection, which controls apply and what to do when transfers go wrong, and keep them documented and reviewed. Priority P2. |
| T4.2.2 | Agreements on information transfer | Agree security requirements and responsibilities with each external party before exchanging information or software, monitor adherence and correct deviations. Priority P3. |
| T4.2.3 | Physical media in transit | Identify physical media carrying sensitive data, label and track it in line with sensitivity, define what happens on loss and log every movement. Priority P3. |
| T4.2.4 | Electronic messaging | Identify messaging channels, set rules on what may be sent and controls for each, monitor use and act when information is sent outside the rules. Priority P3. |
| T4.2.5 | Business information systems | Identify interconnections between business systems and the information crossing them, choose protections for each type and keep the policy documented and reviewed. Priority P4. |
| T4.3.1 | Electronic commerce | Find where e-commerce sends information over public networks, set protections against fraud, disputes and disclosure or alteration, put requirements in partner agreements and monitor compliance. Priority P2. |
| T4.3.2 | On-line transactions | Protect on-line transaction data from incomplete delivery, misrouting, alteration, disclosure, duplication and replay, put requirements in partner agreements and monitor compliance. Priority P3. |
| T4.3.3 | Publicly available information | Identify what goes on public systems, set security requirements, check it for unauthorised change and ensure it is cleaned and approved before publishing. Priority P4. |
| T4.4.1 | Connectivity to information sharing platforms | Identify the sharing platforms you will join, their security requirements and the controls needed, and build the capability for secure sector, national or international connections. Priority P4. |
| T4.4.2 | Information released to sharing communities | For each platform, identify what you will release, apply its format, classification and treatment rules, add protection your own risk assessment requires and build secure sharing capability. Priority P4. |
| T4.5.1 | Network controls | Know every network component and link, keep a current diagram, assess network risk, put in the controls needed and keep checking they work. Priority P1. |
| T4.5.2 | Security of network services | Decide which network services need specific security, set minimum requirements for each, include them in service agreements whether in-house or outsourced and make sure they are implemented. Priority P2. |
| T4.5.3 | Segregation in networks | Define how to group services, users and systems, set separation requirements for each group, build them into development and review how well separation works. Priority P1. |
| T4.5.4 | Security of wireless networks | Survey and document sites so signals do not leak far beyond your perimeter, group wireless users and services, choose controls per network by protection level and review segregation. Priority P2. |
| Ref | Control | What it requires |
|---|---|---|
| T5.1.1 | Access control policy | Adopt a documented access control policy from business and security needs: roles for granting and denying access, protection of mobile and user-owned devices, user acknowledgement and regular review. Priority P2. |
| T5.2.1 | User registration | Run a formal registration and de-registration procedure with one account per person and no shared accounts, immediate revocation on role change or exit, and periodic checks of temporary and inactive accounts. Priority P1. |
| T5.2.2 | Privilege management | Record every privilege granted, give users no domain or local admin rights, use admin accounts only for administration, require two-factor authentication for all admin access and log and audit it. Priority P1. |
| T5.2.3 | User security credentials management | Set a credential policy for users and admins covering secure issue, revocation and re-issue. Change default credentials, store them hashed with salt or encrypted and use multi-factor authentication for critical resources. Priority P1. |
| T5.2.4 | Review of user access rights | Keep access records for all assets, flag special access, review rights periodically and whenever a user's status changes, and re-check special access for validity. Priority P1. |
| T5.3.1 | Use of security credentials | Write good-practice rules for using credentials and teach them to users through awareness and training. Priority P1. |
| T5.4.1 | Policy on use of network services | Set a network services policy and framework so users reach only the services they are authorised to use, protected against unauthorised access. Priority P2. |
| T5.4.2 | Authentication for external connections | Require remote logins by users and administrators to use secure channels with suitable authentication, and block administrator-level accounts from direct machine access. Priority P1. |
| T5.4.3 | Equipment identification in networks | Use device identification to authenticate legitimate connections automatically and detect unauthorised devices on the network. Priority P1. |
| T5.4.4 | Remote diagnostic and configuration protection | Find ports and services used for diagnostics and configuration, disable those not needed, protect the rest with strong authentication for authorised staff only, and log all remote activity. Priority P4. |
| T5.4.5 | Network connection control | Give access to shared networks by procedure in line with the access policy and business applications, and restrict user access by predefined rules such as time of day. Priority P1. |
| T5.4.6 | Network routing control | Stop routing breaching access policy: list routing equipment, secure its setup, check addresses against rules, guard against route tampering, separate public subnets, connect out only via boundary devices and monitor traffic. Priority P3. |
| T5.4.7 | Wireless access | Set usage restrictions, configuration requirements and guidance for wireless access, and authorise wireless connections before they are allowed. Priority P2. |
| T5.5.1 | Secure log-on procedures | Identify and classify systems that need authentication, set log-on and log-off procedures that limit unauthorised access, cap session time for sensitive systems and end inactive sessions. Priority P1. |
| T5.5.2 | User identification and authentication | Give each user a unique ID, use authentication suited to the entity and tie all restricted activity to the authenticated user in the logs. Priority P1. |
| T5.5.3 | User credentials management system | Use a credential system that automates changes while confirming identity, checks new credentials are strong enough and sets maximum lifetime and reuse rules. Priority P1. |
| T5.5.4 | Use of system utilities | Identify utility programs that can override controls, record who has them, limit them to authorised staff and monitor their use. Priority P4. |
| T5.6.1 | Information access restriction | Restrict access to information and application functions by role and responsibility under the access policy, assign suitable rights and adjust them to business need. Priority P1. |
| T5.6.2 | Sensitive system isolation | Identify sensitive applications and give them a dedicated environment with resources suited to protecting them. Priority P2. |
| T5.6.3 | Publicly accessible content | Formalise how public information is published so non-public information is not exposed, and periodically verify that nothing sensitive is publicly visible. Priority P3. |
| T5.7.1 | Access control for mobile devices | Set usage limits, configuration and connection requirements for entity-controlled mobile devices under the access policy, and authorise their connection to your systems. Priority P4. |
| T5.7.2 | Teleworking | Set security measures for teleworking under the access policy, and authorise teleworking in line with them. Priority P4. |
| Ref | Control | What it requires |
|---|---|---|
| T6.1.1 | Third party security policy | Adopt a documented policy suited to the third-party relationship covering commitment, roles, security objectives for engagements, communication to and acknowledgement by third parties, and regular review. Priority P4. |
| T6.2.1 | Service delivery | Put measurable security requirements into each third party's service agreement and require them to measure and report against them. Priority P2. |
| T6.2.2 | Monitoring and review of third party services | Monitor third-party services, make sure delivery reports arrive and are reviewed by qualified staff, manage incidents and problems they reveal and audit regularly. Priority P2. |
| T6.2.3 | Managing changes to third party services | Include in agreements a way to communicate changes, define what changes must be notified and assess them against business criticality and fresh risk assessment. Priority P2. |
| T6.3.1 | Requirements for cloud environments | Define security requirements for keeping, processing and storing data in the cloud: do due diligence, include cloud in risk assessment, set governance, get incident notice from the provider and reserve audit rights where possible. Priority P2. |
| T6.3.2 | Agreements with cloud providers | Write security terms into cloud service agreements: awareness of where restricted data is held, migration plans at the end of service, and any other cloud security requirements you have identified. Priority P2. |
| Ref | Control | What it requires |
|---|---|---|
| T7.1.1 | Acquisition, development and maintenance policy | Adopt a documented policy for acquiring, developing and maintaining systems that suits the internal and external parties involved: commitment, roles, security objectives, user acknowledgement and regular review. Priority P4. |
| T7.2.1 | Security requirements analysis and specification | Define security requirements for new systems and enhancements, approved by the business, covering the controls from risk assessment, with how to verify them, in the requirements statement. Priority P3. |
| T7.2.2 | Developer-provided training | Require developers of systems, components and services to identify training needs for correct use of security functions, deliver it and cover it in the service agreement. Priority P4. |
| T7.3.1 | Input data validation | Define parameters and acceptable and unacceptable values for validating application input, and give guidance on how to validate each. Priority P2. |
| T7.3.2 | Control of internal processing | Give developers minimum requirements for validation checks that detect corruption from errors or deliberate acts, require evidence they meet them and periodically review existing applications. Priority P2. |
| T7.3.3 | Message integrity | Work out what authenticity and integrity you need for messages passing between systems and applications, and adopt controls that deliver it. Priority P2. |
| T7.3.4 | Output data validation | Define output validation procedures so that processing of stored information gives correct results for the circumstances. Priority P2. |
| T7.4.1 | Policy on cryptographic controls | Document and share a cryptography policy scaled to the criticality of the information, reflecting sector and national limits and the regulator's guidance, and review it at planned intervals. Priority P2. |
| T7.4.2 | Key management | Set a key management policy and process for key generation and storage standards, revoke or block keys and repair damaged ones, and protect keys from change, loss, misuse and disclosure. Priority P2. |
| T7.5.1 | Control of operational software | Let only authorised administrators install software on operational systems, bar users unless their role needs it, keep original copies including old versions, have a rollback plan and log installs. Priority P4. |
| T7.5.2 | Protection of system test data | Test with sample data, move real data from production to test only with authorisation, erase it right after testing and track every copy and erase. Priority P3. |
| T7.5.3 | Access to program source code | Set an access policy for source code, review permissions periodically and keep an audit log of all access. Priority P3. |
| T7.6.1 | Change control procedures | Control changes with a formal procedure, keep a record of all changes and every software version with integrity checks, update documentation and plan changes for the right time. Priority P3. |
| T7.6.2 | Review of applications after OS changes | Test business-critical applications in a test environment when operating systems change, watch logs for anomalies, define rollback and update asset records and contingency plans. Priority P3. |
| T7.6.3 | Restrictions on changes to software packages | Define who may approve changes to software, test every change before production and do a secure code review for major changes to critical software. Priority P2. |
| T7.6.4 | Information leakage | Reduce chances of leakage with data loss prevention, identity and access management limiting critical data to authorised staff, and an enforced classification policy. Priority P2. |
| T7.6.5 | Outsourced software development | Supervise outsourced development with a secure coding policy and QA process, contract clauses binding the supplier and allowing audit, stated security functions and source code review for vulnerabilities or malicious code. Priority P3. |
| T7.7.1 | Control of technical vulnerabilities | Find vulnerabilities in new systems and plan fixes before go-live, keep testing production systems through the lifecycle, preferably with automated tools, and weigh cost against benefit to choose remediation. Priority P1. |
| T7.8.1 | Supply chain protection strategy | Set a strategy against supply chain threats: an acquisition policy that limits disclosure of your architecture, security checks on what is delivered, contract terms, supplier transparency, audit rights and sector and national requirements. Priority P4. |
| T7.8.2 | Supplier reviews | Evaluate suppliers of systems, components and services before contracting, review those evaluations periodically and include sector and national requirements. Priority P4. |
| T7.8.3 | Limitation of harm | Limit what you share with suppliers and use a diverse set of suppliers for critical product and service areas, to reduce harm from supply chain attackers. Priority P4. |
| T7.8.4 | Supply chain operations security | Assess operational risk including supplier threats and vulnerabilities, align supplier controls with you in the contract and define how you will monitor them. Priority P4. |
| T7.8.5 | Reliable delivery | Make sure delivered systems and components are genuine and that delivered software has not been altered. Priority P4. |
| T7.8.6 | Addressing supply chain weaknesses | Map supply chain elements and their dependencies, address weaknesses found in assessments, set up a formal review or audit process and assess and audit regularly. Priority P3. |
| T7.8.7 | Supply of critical components | Keep a contingency plan for supplying critical system components, stock critical spares and use more than one supplier. Priority P4. |
| Ref | Control | What it requires |
|---|---|---|
| T8.1.1 | Incident management policy | Adopt a documented incident policy covering commitment, roles, the framework for managing incidents and sector and national reporting requirements, acknowledged by users, reviewed and exercised. Priority P2. |
| T8.2.1 | Incident response plan | Write a response plan covering before, during and after an incident, tested and maintained, with a communication plan, senior management approval, defined resources and a CSIRT. Priority P2. |
| T8.2.2 | Computer security incident response team | Establish a CSIRT: identify stakeholders, secure funding, decide services, reporting lines and authority, resources, interfaces, roles, workflow and procedures, and announce it when operational. Priority P2. |
| T8.2.3 | Incident classification | Set an incident classification scheme in line with the incident policy and the regulator's guidance, and decide which incidents must be reported to sector and national level. Priority P4. |
| T8.2.4 | Incident response training | Run a training programme for the CSIRT in line with your awareness and training policy, covering all response procedures and the users involved. Priority P4. |
| T8.2.5 | Incident response testing | Create test procedures and cases, set expected results, run the tests and compare outcomes to find gaps to fix. Priority P4. |
| T8.2.6 | Incident response assistance | Assign people to advise staff and outside parties on handling and reporting incidents, and publish how to reach them. Priority P4. |
| T8.2.7 | Incident documentation | Decide what data to capture before, during and after an incident, record it for every incident and protect those records. Priority P4. |
| T8.2.8 | Learning from incidents | Keep detailed incident records and use lessons learned to find extra controls that would prevent repeats. Priority P4. |
| T8.2.9 | Collection of evidence | Identify the requirements of applicable jurisdictions and set procedures to collect evidence that cover chain of custody, safety of evidence and staff, roles, competence, documentation and briefing. Priority P4. |
| T8.3.1 | Situational awareness | Build situational awareness by joining information sharing communities and gathering cyber information, identifying priority information for your entity, sector and the national context and sharing it. Priority P4. |
| T8.3.2 | Reporting information security events | Name an event point of contact such as the CSIRT, set a reporting procedure and approach to stakeholders including authorities, covering sector and national channels. Priority P4. |
| T8.3.3 | Reporting security weaknesses | Give staff and external users a way to report weaknesses as soon as they are noticed, make the CSIRT the point of contact and make sure nobody tries to exploit a weakness. Priority P4. |
| Ref | Control | What it requires |
|---|---|---|
| T9.1.1 | Continuity planning policy | Adopt a documented continuity policy: commitment, roles, framework for keeping information available in adverse events in line with business continuity and disaster recovery, user acknowledgement, review and testing. Priority P4. |
| T9.2.1 | Developing continuity plans | Identify information continuity needs in line with overall continuity planning, set escalation criteria and activation conditions, assign roles with contacts and define a safe mode for restricted operation. Priority P3. |
| T9.2.2 | Implementing continuity plans | Put in place the continuity capabilities your plans call for. Priority P3. |
| T9.3.1 | Testing and reassessing continuity plans | Test continuity plans periodically for effectiveness and readiness, record lessons and update the plans so they stay current. Priority P3. |
Alongside the list above, SecureXcel keeps a unified set of practical controls. For each control the workbook gives the risk it addresses, the objective, a description, whether it is preventive or detective, how often to run it, the design and operating test procedures, and the evidence to collect, with the references it covers in this framework. There is one workbook per framework, supplied as it is, with a Version History sheet for document control. Free account needed; you come straight back to the file.
M controls cover management (strategy, risk, people, compliance, performance) and T controls cover technology (assets, physical security, operations, networks, access, third parties, development, incidents, continuity). A number like T5.2.1 is family T5, sub-family 2, control 1.
They rank how much a control helps against common threats and builds foundations. The document puts 39 controls at P1, 69 at P2, 35 at P3 and 45 at P4, and says critical entities start with P1.
Always-applicable controls cannot be omitted. The rest depend on your risk assessment, and you can exclude one only with a justification the regulator accepts. We mark an always-applicable control only where the control table and Annex A agree.
No, but it draws on ISO 27001 and 27002 (2005 editions), NIST SP 800-53 Rev 4 and others. Annex C of the Regulation maps each control to those standards, so an ISO-aligned entity has a head start.
No. It is a plain-English summary in our own words, using the Regulation's control numbers. We left out the sub-controls, guidance and sector-level markings. Read the issued text before relying on it.