Governance, risk and compliance services in Dubai, UAE
Policies people follow, a risk register the board recognises, and evidence collected as work happens instead of in the fortnight before an assessment.
The gap is rarely the policy. It is whether anyone follows it
Most organisations we meet have documents. A security policy, an acceptable use policy, something about access reviews written three years ago by a consultant and never opened since.
An assessor is not testing whether the document exists. They are asking for the record of the last four quarterly access reviews the document promises. When there is no record, the policy has made the position worse, because it is now evidence of a commitment you did not keep.
So the work is to write only what you will genuinely do, and to arrange for the doing of it to leave a trace.
What a GRC programme has to produce
Four things. The third is what separates a programme from a folder of documents.
Governance, risk and compliance services we deliver
Most engagements begin with a maturity assessment, because it establishes where you are before anyone argues about where to go.
Maturity assessment
Where you stand against the framework that applies to you, scored on evidence and not on intent.
IT risk management
Risks identified in business terms, assessed on likelihood and impact, and given an owner and a decision.
Business impact assessment
What each process is worth per hour of disruption, which is what sets recovery targets and priorities.
Gap analysis
The distance between the framework and reality, ordered by what an assessor will look at first.
IT policies and procedures
Written for the person doing the task, short enough to be read, and limited to what you will genuinely do.
Strategy alignment with GRC
The framework tied to what the business is trying to achieve, so controls are not an unexplained tax on delivery.
Control design
Controls chosen for the risk they address, with the evidence they produce decided at the same time.
Roles and accountability
Who decides, who operates and who reviews, named, because an unowned control is not a control.
Technical implementation
The controls a framework asks for, built and configured, not written down and left to somebody else.
Evidence automation
Records collected from systems where they can be, so evidence accumulates without a person assembling it.
Third-party risk
Suppliers assessed proportionately, which matters because their access is your exposure and your finding.
Awareness and training
The parts of the policy people touch day to day, delivered in the terms of their own work.
Ongoing compliance advisory
A standing relationship for the questions that arise between assessments, which is when most decisions are made.
Internal audit
The internal review a certification requires, run by people separate from those who built the controls.
Management reporting
Risk and compliance position reported to the board in language it uses, with movement since the last review.
Questionnaire support
Client security questionnaires answered from a maintained position, so each one takes an afternoon.
UAE frameworks a compliance programme has to answer
Which of these applies is decided by where you are registered, what you do and who your customers are. Most organisations answer to more than one.
UAE Information Assurance Standards
The federal baseline for government and critical national infrastructure, covering identity, monitoring, data classification and incident response.
DESC ISR
The Dubai standard for government and semi-government entities, examined on evidence that controls operate and not on documentation alone.
ADHICS
The Abu Dhabi healthcare information security standard, with explicit conditions on patient information and connected medical equipment.
ISO 27001 and PDPL
The certification clients most often ask you to hold, alongside the federal data protection law that applies whether or not you certify.
How a GRC programme runs
We settle which frameworks genuinely apply before any work starts, because organisations routinely prepare for the wrong one.
- Obligations traced to registration, sector and customer contracts
- Overlapping requirements mapped once, so controls are not built twice
- Anything you are not obliged to do identified as a choice, not a given
Where you stand is scored on evidence, which is usually a less comfortable answer than the internal view.
- Controls tested for operation, not read from a policy document
- Gaps ordered by what an assessor examines first
- A position statement the board can act on, in business language
Policy is written to what you will genuinely do, since a commitment you miss is worse than one you never made.
- Policies written for the person performing the task
- Each control given an owner, a frequency and a defined record
- Evidence collected from systems wherever a person is not required
The technical controls get built, because a framework whose controls exist only on paper fails its first assessment.
- Controls configured and tested against the requirement they answer
- Third-party access assessed, since a supplier finding is your finding
- Training given to the people whose work the controls change
The programme runs for long enough to produce a record, which is what certification examines.
- Reviews, audits and reassessment on a calendar with named owners
- Findings tracked to closure with dates, not carried forward silently
- Management reporting produced each cycle, not before the audit
Certification is the checkpoint, and the routine afterwards is what a surveillance visit is designed to test.
- Assessor questions answered from the record already collected
- The calendar continued after the certificate, which is where most programmes lapse
- Risk reassessed as the business changes, not annually by habit
Why organisations choose iConnect for governance and compliance
We write what you will do
A policy promising quarterly reviews you never run is a finding. We keep the commitment matched to the capacity.
We can implement, not only advise
The controls get built by the same organisation that designed them, so nothing is handed over as somebody else's problem.
Evidence is designed in
Each control is defined with the record it produces, so an assessment is retrieval instead of reconstruction.
We map overlapping obligations once
Most clients answer to more than one framework. Building the same control twice is a common and avoidable waste.
We keep independence where it matters
Where an internal audit has to stay separate from the work, we say so and keep the roles apart.
We work to UAE frameworks daily
IAS, DESC ISR, ADHICS and the PDPL are the regular work here, not a standard imported from another market.
Sectors we advise
The obligation differs by sector, and so does what an assessor arrives expecting to see.
Government
DESC ISR and federal obligations, examined on operating evidence.
Banking and Finance
Central Bank and free zone regulation, with outsourcing under scrutiny.
Healthcare
ADHICS conditions on patient information and clinical systems.
Manufacturing
Customer-driven requirements, often arriving as a security questionnaire.
Retail and E-commerce
PCI DSS scope and personal data held at consumer volume.
Education
Student data and environments that grew without a governance model.
What our clients say
“Whenever an issue arises, iConnect is there immediately: quick, efficient and proactive in keeping everything running without disruptions. iConnect has become a crucial part of our operations.”
Head of IT Infrastructure and Network SecurityDragon OilGovernance and compliance questions we get asked
Usually the one you are obliged to follow, and only then one you choose. Dubai government entities answer to DESC ISR, federal and critical infrastructure to the UAE Information Assurance Standards, Abu Dhabi healthcare to ADHICS, and banks to the Central Bank. ISO 27001 is the common voluntary choice, and it maps onto most of the others well enough to avoid duplicated work.
Governance is who decides and how. Risk is what could go wrong and what you have chosen to do about it. Compliance is showing an outside party that both work. Organisations that treat them as three projects end up with three sets of documents that contradict each other.
For ISO 27001 from a standing start, nine to fifteen months is realistic, and most of that is operating the controls long enough to have evidence. The documentation is quick; the record of the management reviews, internal audits and incidents is what an auditor actually asks for.
Because an assessor examines whether they operate, not whether they exist. A policy requiring quarterly access reviews with no record of a review having happened is a finding, and often a worse one than having no policy at all.
Both, and it is worth being clear which you want. We can write the framework and hand it over, or run the programme with you and do the implementation. Where independence matters, such as an internal audit that must stay separate from the work, we say so and keep the roles apart.
With a calendar and an owner. Reviews, internal audits and risk reassessment are scheduled, and each one has a named person. Programmes decay when the certificate arrives and the routine stops, which is exactly what a surveillance visit is designed to find.
Yes, and they are often what starts this work. A large client sends a questionnaire, the answers turn out to be uncomfortable, and the gap becomes visible. We build the underlying position so the answers are true, and maintain the material so the next one takes an afternoon.
More than most vendors admit. The evidence lives with the people doing the work, so their involvement cannot be outsourced. We keep it proportionate by collecting evidence from systems where we can and asking people only where we cannot.
Talk to our team about your requirement
We’re happy to answer any questions you may have and help you determine which of our services best fit your needs.
Our Value Proposition
- Tailored Solutions for Your Organization
- Unbiased Expertise
- Proven IT Competence
- Outcome-Driven Approach
- Proactive Problem-Solving
- Transparent Processes
What happens next?
We’ll arrange a call at your convenience.
We do a discovery and consulting meeting
We’ll prepare a detailed proposal tailored to your requirements.
