The Compliance and Assurance Convoy adds the UAE Information Assurance Standard

DUBAI, UNITED ARAB EMIRATES — 11 November 2026 — Mamluk today made the UAE Information Assurance Standard, version 2.1, available in the Compliance and Assurance Convoy for Bahriya Tersane. It is the convoy’s first regime for the United Arab Emirates.

The convoy is installed in the organisation’s own Kubernetes cluster. It maps a regulator’s technical controls onto that cluster, enforces the controls the cluster can enforce, checks the ones it can only observe, and writes dated evidence for each regime every day. The evidence stays in the cluster unless the organisation chooses to send it to its own email server or storage.

Who it applies to

The standard is issued by the UAE Cyber Security Council. It applies to federal ministries and authorities, to critical information infrastructure entities outside government, and to Emirate government entities where no Emirate programme exists. Banks are critical information infrastructure.

How it covers the standard

The regime holds all 134 controls of the standard under its own numbers. Four are enforced by an admission policy, 9 are checked in the cluster, and 10 are provided by the platform and reported. The remaining 111 are organisational, and the report lists them for the organisation to evidence.

The standard marks each control as always applicable or applicable by risk assessment, and gives it a priority from P1 to P4. The report shows both beside each control, and lists first the objects that fail an always applicable control.

The standard maps its controls to NIST SP 800-53 in its own Annex D, and the report uses that mapping unchanged. Where a control’s NIST controls reach checks that do not evidence the control itself, the report says which checks were counted, and the OSCAL assessment results mark the mapping as evidenced in part.

The convoy records technical evidence and does not certify compliance. The organisational controls remain the organisation’s to evidence, and compliance is determined by the organisation and its assessor.

One installation, one regime at a time

Each regime is licensed separately, and is added to a running installation by adding it to the licence and to the chart’s values; the steps are in Activating a regime. A regime for the Central Bank of the UAE’s Operational Risk Management Regulation, for banks, is in preparation as a regime of its own.

The regimes that follow

Regime	Availability
Saudi Arabia: NCA Essential Cybersecurity Controls	Available
Qatar: Qatar Central Bank, Technology Risks	Available
United Arab Emirates: UAE Information Assurance Standard	Available today
Saudi Arabia: SAMA Cyber Security Framework	Q1 2027
United Arab Emirates: Central Bank of the UAE, Operational Risk Management Regulation	Q1 2027
Saudi Arabia: SAMA Cyber Resilience Fundamental Requirements; Bahrain: Central Bank of Bahrain Rulebook	Q3 2027
Qatar: National Information Assurance Standard; Kuwait: Central Bank of Kuwait framework	Q4 2027

Availability and price

The UAE Information Assurance Standard regime is available today. Like every regime of the convoy, it is licensed at USD 24,000 per organisation, per year, with the Bahriya Tersane core licence and no base fee. The regime has its own page at tersane.bahriya.cloud, and organisations can enquire through mamluk.net.

About Mamluk

Mamluk LLC-FZ is an engineering firm in the Meydan Free Zone, Dubai, specialising in enterprise architecture, Kubernetes and cloud infrastructure. It develops the Bahriya Kubernetes Engine, the only enterprise Kubernetes distribution developed and supported from within the GCC, Bahriya Tersane and Kipchak, and operates the public cloud bahriya.cloud.

For media enquiries, contact uae@mamluk.net.