Which frameworks may apply?
| Framework | Issuer | Where it is usually cited |
|---|---|---|
| Dubai ISR | Dubai Electronic Security Center | Entities in Dubai within its scope |
| UAE Information Assurance Regulation | TDRA | Entities in its scope; vendors also write UAE IA |
| CBUAE requirements | Central Bank of the UAE | Licensed financial institutions |
| ADHICS | Abu Dhabi Department of Health | Healthcare entities in Abu Dhabi |
| PDPL, Federal Decree-Law 45 of 2021 | UAE federal government | Processing of personal data |
| PCI DSS | PCI Security Standards Council | Entities that handle card payment data |
Each of these is a framework you may be assessed against. Scope is as commonly cited, not a legal reading. Verify against the current official text.
Does UAE regulation require purple teaming?
We could not confirm that any of these texts names purple teaming. Several providers list the regimes they support. For example, DTS Solution names UAE IA, Dubai ISR, ADHICS and others on its home page, and Wattlecorp lists ADHICS, UAE IA Regulation and PCI DSS services. These are vendor-reported alignments. A list of supported regimes is not the same as a requirement for purple teaming.
Which standards cover adversary emulation?
None confirmed here. The ECB’s TIBER-EU framework, in its 2025 version, is a model for threat-intelligence-based red teaming that other jurisdictions adapt. It applies to the EU, and we use it only as a model. A CBUAE equivalent could not be confirmed.
What about CBUAE testing requirements?
Sources conflict. Some describe third-party penetration testing for critical functions and others describe an accredited periodic test plus a red team exercise. Quote only from the CBUAE rulebook after checking it.
Verification note. We found no CBUAE publication for a framework named TIBER-AE. Do not assume one exists.
Which sectors face the strictest expectations?
Those with a sector regulator and a detailed text: finance and healthcare are the clearest examples in this list. A bank reads the CBUAE material, a hospital group reads ADHICS, and a merchant reads PCI DSS.
Practical next step
Ask any provider which clause of your regime its report maps to. If the answer is general, see the selection checklist. The ranking shows which providers name UAE regimes.