Which standards require penetration testing in the UAE
Frameworks treat penetration testing in three ways: as a requirement, as evidence an auditor expects to see, or as part of a wider control set where the framework leaves the test type to you. The matrix places each framework that UAE buyers meet most often in one of these groups.
| Framework | Applies to | Requirement type | What it says about testing |
|---|---|---|---|
| PCI DSS v4.0.1 | Organisations that store, process or transmit payment card data, and their service providers | Required | Requirement 11.4: internal and external penetration testing at least every 12 months and after significant change, plus testing of segmentation controls where segmentation is used |
| DESC Cyber Force | Dubai government, semi-government and critical information infrastructure entities as buyers; penetration testing and incident response providers as sellers | Required | Buyers must use certified providers for penetration testing |
| ADHICS | Healthcare entities in Abu Dhabi | Required | Control OM 7.1 in the published standard: yearly schedules for penetration testing and vulnerability assessment of systems, networks, applications and security infrastructure |
| ISO/IEC 27001:2022 | Organisations certifying an information security management system | Expected as evidence | Penetration testing is not named as mandatory; Annex A controls 8.8 and 8.29 are commonly evidenced with test results |
| UAE Information Assurance Regulation | Critical entities designated by TDRA | Control framework | The official overview describes minimum protection requirements for information assets and lists no testing duty |
| UAE PDPL | Organisations that process personal data | Control framework | Sets a security and confidentiality duty in general terms; testing is one way to evidence it |
| CBUAE rules | Licensed financial institutions | Control framework | Operational and ICT risk rules apply; read the current text in the CBUAE Rulebook for the testing wording that fits your licence |
| SOC 2 | Service organisations that undergo a SOC 2 examination | Expected as evidence | The auditor tests the controls you define; a penetration test report can serve as evidence for vulnerability management controls |
The rest of this guide explains each row in the order most buyers need it. Frameworks update, so check the current version before you rely on a requirement. The methodology page explains how this guide is reviewed.
Is penetration testing required for ISO 27001?
Penetration testing enters ISO/IEC 27001 through the Annex A controls. Control 8.8, management of technical vulnerabilities, asks you to identify and act on weaknesses in your systems. Control 8.29, security testing in development and acceptance, asks you to test applications and systems before release. A penetration test is a common way to produce evidence for both.
Certification auditors usually ask four questions about testing:
- What was in scope, and does it match the scope of your management system?
- Who carried out the test, and how do they show competence?
- How were findings rated, assigned and closed?
- Was a retest done to confirm the fixes?
If your Statement of Applicability marks 8.8 or 8.29 as applicable, plan at least one test a year and keep the report, the remediation log and the retest result. The text of the standard is available from ISO.
PCI DSS penetration testing requirements
PCI DSS is the standard that most clearly requires penetration testing. Requirement 11.4 of version 4.0.1 asks organisations that handle card data to run internal and external penetration tests at least once every 12 months and after any significant change to the environment. The PCI Security Standards Council publishes the standard and its supporting documents.
The requirement covers more than one test, so scope it carefully.
| Element | What PCI DSS asks for |
|---|---|
| Internal and external testing | Both are tested, at least every 12 months and after significant change |
| Application and network layers | Tests cover applications and the network, not the network alone |
| Segmentation | If segmentation isolates the cardholder data environment, the segmentation controls are tested too |
| Fixing and retesting | Exploitable weaknesses are corrected and the testing is repeated to confirm |
| Evidence | A report that the assessor or acquirer can read |
Who validates depends on the organisation. Large merchants and service providers are assessed by a Qualified Security Assessor, while smaller merchants complete a self-assessment questionnaire. In both cases the penetration test report is evidence, so ask your acquirer which documents it needs. Scope follows the cardholder data environment and the systems connected to it, so testers need a current data-flow diagram and a list of connected systems. A vulnerability scan is a separate requirement and does not replace the test.
DESC Cyber Force: who must use certified providers
The Dubai Electronic Security Center (DESC) runs the Cyber Force certification with CREST. The certification applies to companies and individuals that offer penetration testing and incident response services to Dubai government entities. Since 2024, Dubai government, semi-government and critical information infrastructure entities must buy these services from certified providers.
What a provider must hold to be certified, according to CREST's Dubai page:
- Trade licence. A current UAE trade licence that covers cybersecurity activities.
- CREST accreditation. Held, or obtained as part of the process.
- Qualified consultants. Team members with credentials such as CRT, OSCP, ECSA, LPT, GPEN or GWAPT, and team leaders with CCT INF, CCT APP, OSEP, OSWE or GXPN.
- Security clearance. A Dubai Police security clearance certificate for the people who deliver the work.
- Annual renewal. Certification is renewed every year.
The DESC certified-providers register lists providers by service, penetration testing or incident response, and shows an expiry date for each listing. A provider is certified only until that date, so the register is the source for current status.
How to check a provider before signing:
Open the register and find the provider under the service you are buying.
Read the expiry date and confirm it covers the whole project, including the retest.
Ask for the consultants' names and credentials for your project.
Confirm that the contracting company, not a parent or partner, holds the listing.
Register entries show the service for which a provider is certified. A listing for incident response does not cover penetration testing, so read the line that matches what you are buying.
Buyers outside Dubai government are not bound by the programme, but many use the register as a ready-made shortlist. Read the guide to choosing a penetration testing company in the UAE for the wider credential checklist.
Who regulates cybersecurity in the UAE
Cybersecurity rules in the UAE sit in layers: federal laws and authorities, emirate-level bodies, sector regulators and industry standards. A single organisation can fall under several layers at once, for example a Dubai hospital that also takes card payments.
| Layer | Body or source | What it covers for testing |
|---|---|---|
| Federal | Telecommunications and Digital Government Regulatory Authority (TDRA) | Developed the UAE Information Assurance Regulation and designates the critical entities that must implement it |
| Federal, finance | Central Bank of the UAE (CBUAE) | Rules for licensed financial institutions, including operational and ICT risk |
| Federal, law | UAE legislation portal | Federal Decree-Law No. 45 of 2021 (PDPL) and No. 34 of 2021 (cybercrime law) |
| Dubai | Dubai Electronic Security Center (DESC) | Cyber Force certification for providers serving Dubai government and critical entities |
| Abu Dhabi | Department of Health, Abu Dhabi | ADHICS standard for healthcare entities |
| Industry | PCI Security Standards Council, ISO | PCI DSS and ISO/IEC 27001, applied through contract or certification |
The UAE Information Assurance Regulation is described on the u.ae portal as minimum protection requirements for information assets. For financial institutions, the Central Bank of the UAE publishes the current regulations and rulebook. For ADHICS, the Department of Health publishes the standard.
Industry standards are not regulators. They bind an organisation through a contract with a card brand or acquirer, or through a certification the organisation chose to pursue.
Which penetration testing rules apply to your sector
Most UAE organisations meet more than one rule. Start with your sector, then add the standards your customers and contracts impose. The table shows the rules each sector meets most often and the tests to plan.
| Sector | Rules you are likely to meet | Tests to plan |
|---|---|---|
| Dubai government, semi-government and critical entities | DESC Cyber Force for testing providers; the UAE Information Assurance Regulation where TDRA designates the entity as critical | Penetration testing from a certified provider, with the scope set by the entity's own policy |
| Banks, insurers and other licensed financial institutions | CBUAE regulations on operational and ICT risk; PCI DSS where cards are processed | Network, application and API tests, plus segmentation testing for card environments |
| Healthcare in Abu Dhabi | ADHICS control OM 7.1 | Penetration testing and vulnerability assessment on a yearly schedule, covering systems, networks and applications |
| Payments, e-commerce and retail | PCI DSS Requirement 11.4 | Internal and external tests, application-layer tests and segmentation tests where segmentation is used |
| SaaS and technology companies | ISO/IEC 27001 or SOC 2 requested by customers; UAE PDPL for personal data | Web application, API and cloud configuration tests before releases and audits |
How often to test to stay compliant
The most explicit schedules are yearly. The table shows how the main frameworks treat timing, and the triggers matter as much as the dates.
| Framework | Timing | Trigger or note |
|---|---|---|
| PCI DSS Requirement 11.4 | At least once every 12 months | Also after significant change to the environment |
| ADHICS control OM 7.1 | A yearly schedule | The entity establishes the schedule and conducts the tests |
| ISO/IEC 27001 | Set by your risk assessment | Changes to systems and new risks |
| DESC Cyber Force | Governs who may perform the test, not how often | The provider's listing must be valid on the test dates |
A practical rule is to test at least once a year, and again after any major change to systems that hold regulated data, such as a new payment flow, a platform migration or a redesigned network. Keep the latest report, the remediation log and the retest result ready for the next audit.
Is penetration testing legal in the UAE?
Four documents make a test lawful and safe:
- Authorisation letter. Signed by someone with authority over the systems, naming the provider, the assets and the dates.
- Rules of engagement. The scope, the allowed techniques, the test window, the escalation contacts and the limits on exploitation. See rules of engagement in the glossary.
- Third-party permission. Cloud, hosting and software-as-a-service providers have their own rules, and systems you do not own need the owner's consent.
- Data handling terms. An NDA and a plan for where test evidence is stored and when it is deleted.
The text of the law is on the UAE legislation portal. Unauthorised testing is not excused by good intent. If you find a weakness in a system you do not own, report it to the owner through the channel they publish and do not explore further.
Data protection while testing
Testers may see personal data in applications, databases and mail systems. The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) sets a general duty to secure personal data and keep it confidential, and it sets requirements for cross-border transfer and sharing. The UAE legislation portal publishes the text.
Agree these points in the contract before the test starts:
- NDA. Covers the testers, subcontractors and the provider's tools.
- Test data. Use test accounts and masked or synthetic data where possible.
- Evidence storage. State where screenshots, captured data and reports are stored and how they are encrypted.
- Location. Ask where the provider's staff and tooling are based, and whether data leaves the UAE.
- Retention. Set a date by which the provider deletes evidence and confirms it in writing.
- Report delivery. Use an encrypted channel and a named recipient list.
Compliance-driven versus risk-driven testing
A compliance-driven test exists to produce evidence for an auditor. A risk-driven test exists to find the weaknesses that would hurt the business most. The best programmes combine both, because the evidence an auditor reads is also the plan an engineer follows.
| Compliance-driven | Risk-driven | |
|---|---|---|
| Starting point | The clause or control to evidence | The assets and attack paths that matter most |
| Scope | Fixed by the standard or the assessor | Set from a threat model |
| Report | Mapped to the framework, with the scope and the dates an assessor needs | Ranked by business impact and attack chains |
| Typical output | Attestation letter, evidence pack | Prioritised fix plan, red team narrative |
| Risk | Passes the audit but misses important paths | Misses a clause the auditor expects to see |
A scanner export is rarely accepted where a framework asks for a penetration test, because it lists possible weaknesses without proving exploitation. See the cost guide for how the two products differ in price and content.
Which service meets which compliance need
Scans, penetration tests and red team exercises answer different questions, and compliance requirements usually name one of them. Choose the service that matches the requirement, and use the others as supplements.
| Service | Use it for | Do not rely on it for |
|---|---|---|
| Vulnerability scan | Routine technical vulnerability management between tests, such as evidence for ISO/IEC 27001 control 8.8 | Meeting a penetration testing requirement such as PCI DSS Requirement 11.4 |
| Penetration test | Penetration testing requirements, and evidence for ISO/IEC 27001 controls 8.8 and 8.29 | Measuring how well your team detects and responds to a live attack |
| Red team exercise | Measuring detection and response across people, process and technology | Replacing the scoped tests that a framework names |
What an audit-ready penetration test report contains
An assessor reads the report to confirm that the right systems were tested, by qualified people, with a method, and that findings were closed. A report that answers those questions saves a second round of evidence requests.
- Scope statement. The assets, environments and dates, matching the scope of the standard or the certificate.
- Method. The approach followed, such as the OWASP Web Security Testing Guide or NIST SP 800-115.
- Tester details. The provider, the lead tester and the credentials held.
- Findings. Each rated with CVSS, with evidence and the affected asset.
- Remediation. Specific fixes and a priority order.
- Retest results. The status of each finding and the date it closed.
- Attestation. A letter confirming the test dates, scope and outcome, when your assessor asks for one.
Ask your assessor for the exact evidence it needs before the test, and give the provider that list when you scope the work.
Common compliance mistakes with penetration testing
Most audit findings about testing come from a short list of avoidable mistakes.
- Wrong scope. A system that stores regulated data is left out of the test.
- Stale evidence. An old report is reused after a significant change.
- Scanner export. A vulnerability scan is submitted where a penetration test is required.
- No retest. Open findings remain on the day of the audit.
- Lapsed listing. A provider's DESC Cyber Force expiry date passes during the project.
- No authorisation record. Nobody can show who approved the test and when.
Before you commission a penetration test
Use this checklist to prepare the request for quotes and the contract.
Frequently asked questions about penetration testing compliance in the UAE
Is penetration testing required for ISO 27001?
No. ISO/IEC 27001:2022 does not name penetration testing as a mandatory activity. It requires risk-based controls, and testing is a common way to evidence them: Annex A control 8.8 covers technical vulnerabilities and control 8.29 covers security testing in development and acceptance. Match the test scope to your management system scope, keep the report and the remediation log, and ask your certification body what evidence it expects.
Does PCI DSS require penetration testing?
Yes. PCI DSS v4.0.1 Requirement 11.4 requires internal and external penetration testing at least once every 12 months and after significant changes to the environment. If segmentation isolates the cardholder data environment, the segmentation controls are tested as well. Exploitable weaknesses must be corrected and the testing repeated. Ask your acquirer or Qualified Security Assessor which evidence it needs.
Is penetration testing mandatory in the UAE?
Not as a general rule. It is mandatory where a framework or contract requires it: PCI DSS for card data, DESC Cyber Force for Dubai government work and the ADHICS standard for Abu Dhabi healthcare entities. Other frameworks, such as ISO/IEC 27001, expect testing as evidence without naming it as mandatory. Check which rules apply to your sector, then confirm the current text with the regulator.
Is pentesting illegal?
No, when the system owner authorises it in writing. A penetration test runs under a signed scope and rules of engagement. Testing without permission is unauthorised access, which is a criminal offence under UAE cybercrime law (Federal Decree-Law No. 34 of 2021). Get an authorisation letter, agree the test window and an emergency contact, and check whether cloud and hosting providers have their own testing rules.
Who must use a DESC Cyber Force certified provider?
Dubai government, semi-government and critical information infrastructure entities must buy penetration testing and incident response from providers certified under DESC Cyber Force, since 2024. Other buyers are not bound by the programme but can use the DESC register as a shortlist. Check the provider's expiry date on the register, and confirm that the consultants named on your project hold the accepted credentials.
Do data-protection rules affect how a pentest is run?
Yes. The UAE Personal Data Protection Law sets a general duty to secure personal data and rules for cross-border transfer and sharing, and testers may see personal data during a test. Agree an NDA, use test or masked data where possible, state where evidence is stored and encrypted, and set a deletion date. Ask where the provider's staff and tools are based.
Do auditors accept a scanner report instead of a pentest?
Usually not where a framework asks for a penetration test. A scanner report lists possible weaknesses, while a penetration test proves which ones an attacker can exploit. PCI DSS treats scanning and penetration testing as separate requirements, and ISO/IEC 27001 auditors look at scope, tester competence and closed findings. Confirm with your assessor, and read the cost guide for the differences.
Sources and updates
Requirements on this page come from the official sources below and were read in November 2026. Frameworks change, so confirm the current version before you rely on a clause.
- DESC certified providers register
- CREST: Dubai Cyber Force programme
- UAE Information Assurance Regulation on u.ae
- PCI Security Standards Council
- ISO/IEC 27001
- UAE legislation portal
- Central Bank of the UAE
- Department of Health Abu Dhabi: ADHICS standard
Related guides: how much a penetration test costs in the UAE and types of penetration testing.
Last updated