Penetration Testing Requirements in the UAE: CBUAE, DESC, ADHICS and the IA Standard

The Central Bank's Operational Risk Management Regulation (C 1/2026, effective 14 September 2026) applies to licensed financial institutions (LFIs):

• Article 7.13. An LFI “must periodically conduct stress-tests related to Operational Risk, including through exercises that challenge the LFI's control environment, for example through penetration testing.”
• Article 7.14. “At least for Critical Functions, the periodic testing referred to in Article 7.13 above must include penetration testing by an independent third party. The results must be presented to the Board.”
• Article 8. The ICT and cybersecurity policy must address vulnerability testing, and ICT risk management must be regularly tested against the risk tolerance.

Other CBUAE instruments add detail:

• Cloud and APIs. The 2021 guidelines on enabling technologies say vulnerability assessments and penetration tests specific to the cloud arrangement, and to APIs, should run at least annually, by an independent function or external expert for APIs.
• Exchange houses. The Exchange Business Standards require internal and external vulnerability scanning and penetration tests at least annually (14.9.1).
• Payment providers. Retail payment service providers, stored value facilities and payment token service providers must regularly assess whether penetration and cyber-attack simulation testing is needed; for token services the annual external audit covers the results.

We found no CBUAE threat-led red-team framework comparable to CBEST or TIBER-EU in the rulebook.

The Dubai Electronic Security Center's Information Security Regulation (ISR) sets the minimum security controls for all Dubai government entities, which must review which of its domains and controls apply to them. The ISR text is available from DESC on request, not publicly.

What is public is the Cyber Force Program (guidelines v1.1, July 2024):

• “It is mandatory for the following entities to procure the cyber security services from Cyber Force Certified Service Providers: Dubai government entities; Semi–government entities; Critical organizations under Dubai CII.”
• Penetration testing has been a Cyber Force discipline since November 2023, and the CREST Defensible Penetration Test methodology must be followed.
• Testers need a valid Dubai Police security clearance and providers need a local presence.
• Classified data must remain within the UAE during and after the engagement (ISR V3 control 2.7.1, as cited by DESC).

DESC publishes the list of certified penetration-testing providers. Cloud providers serving Dubai government must also hold the DESC CSP Security Standard certificate.

The Department of Health's Abu Dhabi Healthcare Information and Cyber Security Standard (ADHICS) requires healthcare entities to:

• Establish yearly schedules for penetration testing of systems, networks, applications and security infrastructure, vulnerability assessment, and web security assessments of internet-facing applications, and share the findings with the Department of Health (control OM 7.1).
• Test new systems before they go into production.
• Make sure assessment data is erased from a third party's assets after the assessment (OM 7.2).
• Not use cloud services to store, process or share health information, and not transmit it outside the UAE (CM 4.2).

These references are from ADHICS version 0.9; the Department of Health has since issued a newer version, so check the current control numbers with your compliance team.

• UAE Information Assurance (IA) Standard. Issued by the former NESA and now overseen by TDRA and the UAE Cyber Security Council, it applies to federal government entities and critical sectors. Its technical vulnerability management control is T7.7.1, the control ADHICS maps its penetration-testing duty to. We could not read the official text, so we do not quote a frequency or priority for it here; ask your regulator or auditor for the version that applies to you.
• Cyber Security Council. In 2025-2026 the Council issued national policies, among them a CII protection policy (version 2.0) and a national cybersecurity accreditation programme. Firms in ADGM were told that adherence to the Council's 2025 policies is not mandatory for them.
• Personal Data Protection Law (Federal Decree-Law 45/2021). In force since 2 January 2022, it requires controllers and processors to apply measures that test and evaluate the effectiveness of their security measures (Article 20(1)(d)), without setting a frequency. It does not apply to government data, to health and banking data that have their own laws, or to DIFC and ADGM, which have their own data protection laws. Its executive regulations have not yet been issued.

Several UAE rules keep data in the country:

• Payment data. “Personal and Payment Data shall be stored and maintained in the State” (CBUAE Retail Payment Services and Card Schemes Regulation, Article 14).
• Health data. Federal Law 2/2019 on ICT in health fields does not allow health data to be stored or processed outside the State unless the health authority decides otherwise (Article 13); ADHICS adds a ban on cloud storage of health information in Abu Dhabi.
• Classified government data. Dubai's Cyber Force guidelines require it to stay within the UAE during and after a testing engagement.

A penetration test produces credentials, network maps and evidence of how to break in. A SaaS testing platform or an AI model hosted abroad that processes them deserves the same review as any other system holding that data. An appliance inside your own data centre, on its own models, keeps it in the UAE by design.

1. 1Map your regulators: CBUAE, DESC (Dubai government, semi-government or CII), the Department of Health, TDRA and the Cyber Security Council, or a free-zone regulator.
2. 2List your critical functions and plan independent third-party penetration testing of them, with results to the board (CBUAE).
3. 3Run yearly tests of cloud and API arrangements, and yearly internal and external tests for exchange houses.
4. 4In Dubai government scope, buy penetration testing from a DESC Cyber Force certified provider and require the CREST Defensible Penetration Test methodology.
5. 5In Abu Dhabi healthcare, publish the yearly testing schedule and share findings with the Department of Health.
6. 6Check where every security tool processes and stores test data, and whether payment, health or classified data is involved.
7. 7Retest fixes and keep the evidence for the board and the regulator.

The requirements by regulation hub compares these rules with other countries, including Saudi Arabia's NCA ECC.

Zero Hunt is an autonomous AI red team on an on-premise appliance: it runs black-box and gray-box penetration tests of networks and infrastructure from inside your data centre, on its own models, so findings and credentials do not leave the UAE. Operators choose one of five autonomy levels that decide which actions wait for approval, and every finding is backed by Ed25519-signed, hash-chained evidence for the board and the regulator. Use it to test critical functions continuously between independent tests and to retest fixes.

Two honest limits. Zero Hunt is not a DESC Cyber Force certified provider and holds no UAE accreditation: where Dubai rules require a certified provider or an independent third party, that engagement still has to happen, and the provider can work with Zero Hunt's evidence. Zero Hunt maps findings to the UAE Information Assurance Standard (formerly NESA) among its 34 frameworks; it does not ship CBUAE-, DESC- or ADHICS-specific report templates, so your team or partner maps the evidence to those rules.

Do UAE banks have to run penetration tests? Yes. Since 14 September 2026 the CBUAE Operational Risk Management Regulation requires periodic testing of the control environment and, for critical functions, penetration testing by an independent third party, with the results presented to the board.

How often must a UAE financial institution test? The regulation says periodically and sets no number. CBUAE guidelines say cloud and API arrangements should be tested at least annually, and exchange houses must test at least annually.

Who can run penetration tests for Dubai government entities? Only DESC Cyber Force certified providers, for Dubai government, semi-government and Dubai critical infrastructure entities, using the CREST Defensible Penetration Test methodology and testers with Dubai Police clearance.

Does the UAE PDPL require penetration testing? It requires measures to test and evaluate the effectiveness of security, without naming penetration testing or a frequency. Its executive regulations have not yet been issued.

Can we use a cloud pentest platform hosted outside the UAE? Check with compliance. Payment data, health data and Dubai classified data must stay in the UAE; a tool that processes them abroad should be reviewed against those rules.