UAE IA Standard v2 and NCAP: What "Accredited" Means and Who Has to Care

The utility's letter uses a word the integrator has not seen before

The general manager of a 35-person industrial-controls integrator in Mussafah has serviced the same water utility for eleven years. His engineers know the pumping stations by nickname. The relationship is good enough that the renewal usually arrives as a phone call.

This year it arrives as a letter. The utility's new head of cyber has rewritten the supplier terms. Two requirements stand out. The integrator must operate an "IA-aligned control set" for any system that touches the utility's operational network, and any security testing of those systems must be performed by an "NCAP-accredited testing partner."

The general manager has heard of NESA. He has never heard of NCAP. He calls the penetration testing company that has done the utility work for the last four years, a good firm, and asks if they are accredited. They say they have applied. He asks when they will hear. They do not know, because nobody has published a timeline.

He calls the utility's head of cyber, who is helpful and firm. The control set is non-negotiable; the utility is being assessed against the IA Standard and cannot carry a supplier who is not. On the testing partner, she says the programme is new and she will accept an accredited firm when one is available, but the integrator should show it has asked.

He has a control set of sorts: a firewall between the office and the engineering laptops, a shared VPN account for remote support, and a laptop that has not been patched since it was configured for a site visit in 2023. That laptop plugs into the pumping station's network twice a month.

What the heck does this mean

The UAE Information Assurance Standard is the national baseline for protecting information and systems. It began under NESA, the National Electronic Security Authority, and now sits with the UAE Cyber Security Council. Version 2 was updated in 2025.

Critical information infrastructure: the systems whose failure would hurt the country, such as water, power, transport, health and telecoms. The utility is one; the integrator's laptop is on its network.

Management controls: the policy, governance, risk and people requirements. Sixty of them.

Technical controls: the requirements on networks, access, patching, logging and testing. One hundred and twenty-eight.

NCAP: the National Cyber Accreditation Program, run by the Cyber Security Council, built on IA Standard v2. It accredits the providers who are allowed to deliver security services to critical infrastructure.

Accredited provider: a security firm the Council has checked and listed for a defined scope of work. As of September 2026 there is no public register and no published deadlines, so the letter from the utility is ahead of the paperwork.

Active defence: the phrase from the National Cybersecurity Strategy 2025-2031 for the shift from building capacity to going after threats. It is why utilities are tightening supplier terms now.

For a supplier, the meaning is simple. If your engineers touch a critical network, your controls are part of the operator's controls, and the operator will be assessed on them.

The numbers that matter

IA Standard v2, published by the UAE Cyber Security Council in 2025, has 15 control families, 134 controls and 449 sub-controls; some controls always apply and the rest are selected by risk. The management controls are where most small suppliers are weakest, because nobody has written anything down.

Consultancies report that the NCAP rollout during 2026 begins to restrict the use of unaccredited providers for critical information infrastructure; the UAE Cyber Security Council has not yet published deadlines, phases or a provider register. The programme is live in principle and still filling in its lists in practice, which is why the utility's letter and the testing firm's application are both in limbo.

The National Cybersecurity Strategy 2025-2031 shifts the country's posture from capacity building to active defence, according to the UAE Cyber Security Council's 2025 strategy. Supplier terms like the one in the letter are the strategy arriving in a small company's inbox.

What to do this week

1. Separate the networks. Engineering laptops that visit customer sites get their own segment, away from office email and the shared drive, and the site-visit laptop never joins the office Wi-Fi again. (CIS 12 Network Infrastructure Management)
2. Kill the shared VPN account. One named account per engineer, MFA on each, and a log of who connected to which customer site and when. The utility will ask for that log. (CIS 12 Network Infrastructure Management)
3. Patch the field laptops and the remote-access gateway this week, then put them on a schedule: critical fixes within days, everything else monthly, with a record of what was done. (CIS 7 Continuous Vulnerability Management)
4. Run a vulnerability scan across every device that touches a customer network and file the results with the fixes, dated, so the control set has evidence rather than intentions. (CIS 7 Continuous Vulnerability Management)
5. Write to the testing firm and to the Council asking about accreditation status and scope, and keep the correspondence; the utility said it wants to see that you asked. Book the next penetration test for after the answer. (CIS 18 Penetration Testing)
6. Map what you already do to the 134 controls on one spreadsheet, truthfully, with "none" where there is nothing. A truthful 40% is a plan; a fictional 100% is a problem waiting for an assessor. (CIS 7 Continuous Vulnerability Management)

Where AccuSights fits

Our assessment maps your controls against IA Standard v2 and the terms your critical-infrastructure customer has set, and ranks the gaps so the engineers fix what the operator will be assessed on first. The read-only compliance agent then keeps that map current: read-only insight into where the gaps are, so you prioritise and keep an eye on them. We have no access to your systems and we do not remediate; you or your IT partner fix, we show you where. A falcon sees the whole plain and strikes one point. That is what a control set should do for you.

Eleven years of trust got the integrator the phone call. A patched laptop and a named VPN account will get him the next eleven.