Governance, risk and compliance services in Dubai, UAE
Governance, risk and compliance services for organisations in Dubai and the UAE: policies written to be followed, a risk register with named owners, and evidence collected as controls operate, so that assessments draw on an existing record.
Why compliance depends on policies being followed
Many organisations hold a set of security documents: a security policy, an acceptable use policy and a procedure for access reviews, sometimes written several years ago and not maintained since.
An assessor tests whether the document is followed. The assessor asks for the record of the quarterly access reviews the document requires, and where no record exists, this is recorded as a finding.
iConnect's GRC service therefore writes policy that matches what the organisation will carry out, and designs each control so that performing it produces a record.
What a GRC programme has to produce
A GRC programme is expected to produce four outputs: policy that is followed, a risk register with owners, evidence that accumulates and a routine that continues after certification.
Governance, risk and compliance services we deliver
Engagements begin with a maturity assessment, which establishes the current position before the programme of work is agreed.
Maturity assessment
Your current position against the framework that applies to you, scored on evidence of controls operating.
IT risk management
Risks identified in business terms, assessed on likelihood and impact, and given an owner and a decision.
Business impact assessment
The cost of disruption to each business process per hour, which sets recovery targets and priorities.
Gap analysis
The difference between the framework requirements and current practice, ordered by what an assessor examines first.
IT policies and procedures
Written for the person performing the task, short enough to be read, and limited to what the organisation will carry out.
Strategy alignment with GRC
The control framework linked to business objectives, so that each control has a stated purpose.
Control design
Controls selected for the risk they address, with the evidence each one produces defined at the same time.
Roles and accountability
The people who decide, operate and review each control named in the framework, so that every control has an owner.
Technical implementation
The controls a framework requires, built and configured by iConnect, with implementation recorded against each requirement.
Evidence automation
Records collected from systems where possible, so that evidence accumulates without manual assembly.
Third-party risk
Suppliers assessed in proportion to their access, because supplier access forms part of your assessed exposure.
Awareness and training
The parts of the policy that staff use day to day, delivered in terms relevant to their own work.
Ongoing compliance advisory
A standing advisory arrangement for the questions that arise between assessments, when most control decisions are made.
Internal audit
The internal review a certification requires, carried out by people separate from those who built the controls.
Management reporting
The risk and compliance position reported to the board in business terms, with movement since the last review.
Questionnaire support
Client security questionnaires answered from a maintained record of the current position.
UAE frameworks a compliance programme has to answer
Which frameworks apply is decided by where the organisation is registered, what it does and who its customers are. Many organisations answer to more than one.
UAE Information Assurance Standards
The federal baseline for government and critical national infrastructure, covering identity, monitoring, data classification and incident response.
DESC ISR
The Dubai standard for government and semi-government entities, assessed on evidence that controls operate.
ADHICS
The Abu Dhabi healthcare information security standard, with explicit conditions on patient information and connected medical equipment.
ISO 27001 and PDPL
The certification most often requested by customers, alongside the federal data protection law that applies whether or not the organisation certifies.
How a GRC programme runs
The frameworks that apply are confirmed before any work starts, so that the programme prepares for the correct requirements.
- Obligations traced to registration, sector and customer contracts
- Overlapping requirements mapped once, so controls are not built twice
- Requirements that are optional identified as choices for the organisation
The current position is scored on evidence of controls operating.
- Controls tested for operation as well as documentation
- Gaps ordered by what an assessor examines first
- A position statement for the board, written in business terms
Policy is written to match what the organisation will carry out, so that commitments can be met and evidenced.
- Policies written for the person performing the task
- Each control given an owner, a frequency and a defined record
- Evidence collected from systems wherever a person is not required
The technical controls are built and configured, so that the framework is operating before its first assessment.
- Controls configured and tested against the requirement they answer
- Third-party access assessed as part of the organisation's exposure
- Training given to the staff whose work the controls change
The programme runs for long enough to produce the record that certification examines.
- Reviews, audits and reassessment on a calendar with named owners
- Findings tracked to closure with dates
- Management reporting produced each cycle
Certification is a checkpoint, and the routine that follows is what surveillance visits examine.
- Assessor questions answered from the record already collected
- The calendar continued after the certificate is issued
- Risk reassessed as the business changes, in addition to the annual review
Why choose iConnect for governance, risk and compliance
Policy matched to capacity
A policy that commits to reviews the organisation does not run leads to a finding, so each commitment is matched to the capacity to perform it.
Implementation as well as advice
The controls are built by the same organisation that designed them, so implementation is part of the service.
Evidence designed in
Each control is defined together with the record it produces, so an assessment is a retrieval exercise.
Overlapping obligations mapped once
Where an organisation answers to more than one framework, common requirements are mapped once so the same control is not built twice.
Independence kept where required
Where an internal audit has to be separate from the implementation work, the roles are kept apart and stated in the scope.
UAE frameworks as standard
IAS, DESC ISR, ADHICS and the PDPL are the frameworks iConnect works to in the UAE market.
Sectors we advise
The obligation differs by sector, and so does the evidence an assessor expects to see.
Government
DESC ISR and federal obligations, assessed on operating evidence.
Banking and Finance
Central Bank and free zone regulation, with outsourcing arrangements examined.
Healthcare
ADHICS conditions on patient information and clinical systems.
Manufacturing
Customer-driven requirements, often received as a security questionnaire.
Retail and E-commerce
PCI DSS scope and personal data held at consumer volume.
Education
Student data and IT environments that have grown over time.
What our clients say
“Whenever an issue arises, iConnect is there immediately: quick, efficient and proactive in keeping everything running without disruptions. iConnect has become a crucial part of our operations.”
Head of IT Infrastructure and Network SecurityDragon OilFrequently asked questions about governance, risk and compliance
The frameworks an organisation is obliged to follow come first, and voluntary standards second. Dubai government entities answer to DESC ISR, federal entities and critical infrastructure to the UAE Information Assurance Standards, Abu Dhabi healthcare providers to ADHICS, and banks to the Central Bank of the UAE. ISO 27001 is the common voluntary choice, and its controls map onto most of the others closely enough to avoid duplicated work.
Governance defines who makes decisions and how. Risk management identifies what could go wrong and records what the organisation has decided to do about it. Compliance demonstrates to an outside party that both operate. Treating the three as separate projects can produce separate sets of documents that contradict each other, so a GRC programme manages them together.
ISO 27001 certification from a standing start is typically planned over nine to fifteen months. Most of that period is spent operating the controls for long enough to produce evidence. The documentation is completed relatively quickly, and the record of management reviews, internal audits and incident handling is what the certification auditor examines.
An assessor examines whether policies operate as well as whether they exist. A policy that requires quarterly access reviews, with no record of a review having taken place, is recorded as a finding.
iConnect provides both. The service can produce the framework and hand it over for your team to implement, or run the programme with you and carry out the technical implementation. Where independence is required, for example an internal audit that must be separate from the implementation work, the roles are kept apart and this is stated in the engagement scope.
Ongoing compliance is maintained through a calendar and named owners. Reviews, internal audits and risk reassessment are scheduled, and each activity has a responsible person. Surveillance visits examine whether the routine has continued since certification, so the calendar is maintained after the certificate is issued.
Yes, questionnaire support is part of the service. Client security questionnaires are a common trigger for GRC work, because the answers show where the security position falls short of what customers expect. iConnect builds the underlying controls so that the answers are accurate, and maintains the supporting material so that later questionnaires can be answered from a current record.
A GRC programme requires time from your staff, because the evidence of controls operating is produced by the people doing the work. iConnect keeps this proportionate by collecting evidence directly from systems where possible and asking staff for input only where a system record does not exist.
Talk to our team about your requirement
We’re happy to answer any questions you may have and help you determine which of our services best fit your needs.
Our Value Proposition
- Tailored Solutions for Your Organization
- Unbiased Expertise
- Proven IT Competence
- Outcome-Driven Approach
- Proactive Problem-Solving
- Transparent Processes
What happens next?
We’ll arrange a call at your convenience.
We do a discovery and consulting meeting
We’ll prepare a detailed proposal tailored to your requirements.