UAE & Saudi Arabia
Attack Surface Management for the Gulf
Gulf regulators have some of the most prescriptive cybersecurity control sets in the world, and several of them begin with knowing your external estate.
What drives attack surface management here
NCA Essential Cybersecurity Controls, Saudi Arabia
The Essential Cybersecurity Controls issued by the National Cybersecurity Authority form the mandatory baseline for government entities, critical national infrastructure and their suppliers, spanning governance, defence, resilience, third-party and cloud security. The third-party and cloud domains in particular require visibility of externally reachable services and the providers behind them.
UAE Information Assurance Standards and Dubai DESC ISR
The UAE Information Assurance Standards define national controls for entities supporting critical information infrastructure. At emirate level, the Dubai Electronic Security Center issues the Information Security Regulation for Dubai government entities and their partners. Organisations frequently fall in scope for both, and asset identification sits early in each.
Data residency
Regulated Gulf organisations often cannot place security data outside their jurisdiction. This tends to decide procurement before features are discussed, so it is worth raising early rather than late.
How EASMLens supports these obligations
- Discovery supporting NCA-ECC third-party and cloud security control evidence
- Continuous monitoring for entities in scope for both federal and emirate-level regimes
- Supply chain exposure visibility across contracted providers
- Deployment options for organisations with in-country data residency requirements
EASMLens supports these obligations with discovery, monitoring and evidence. It does not certify an organisation against any framework, and no product can.
Frequently asked questions
- Do the NCA Essential Cybersecurity Controls apply to private companies?
- They bind government entities and critical national infrastructure directly. Private organisations most often come into scope through contract, where a government client requires ECC alignment as a condition of the engagement.
- Can data stay inside the Kingdom or the UAE?
- Residency options exist. Tell us the specific obligation you are working to and we will confirm what can be committed to contractually.