#Information Assurance Statement: United Arab Emirates

This document answers one question, asked in almost every UAE security review: which United Arab Emirates information security standards must our software vendor comply with, and is certification against any of them a condition of doing business?

---

#Applicability

Applies to DM-1, DM-2, DM-3 and DM-4. Where a standard's applicability turns on who operates the infrastructure, that is noted in the row.

---

#Purpose

To state, standard by standard, whether it binds Edsol Edtech Pvt. Ltd. as the software supplier to a private healthcare facility in the United Arab Emirates, whether certification is a gate, and, where it is not, what Pensieve Labs offers instead.

---

#1. The answer, first

No mandatory information security certification stands between Edsol Edtech Pvt. Ltd. and a private hospital in Dubai.

Not ISO/IEC 27001. Not SOC 2. Not the United Arab Emirates Information Assurance Standards. Not the Dubai Electronic Security Center's Information Security Regulation. The Abu Dhabi healthcare standard is a real requirement, but it is Abu Dhabi's and it does not reach a Dubai deal.

The two hard gates in this market are the health data localisation law and the health information exchange. They are DIS-AE-008 and DIS-AE-029. Neither is a security certification.

This is materially lighter than the security posture required in Pensieve Labs's European and Australian markets, and it is one of the reasons this market is reachable. Pensieve Labs states it plainly rather than allowing a buyer to assume a certification requirement that does not exist and then disqualify a vendor that does not hold one.

---

#2. Standard by standard

---

#3. Where the answer changes: Dubai Government health entities

The Dubai Electronic Security Center's regulation binds Dubai Government entities. The Emirate's own public healthcare provider organisation is a Dubai Government entity, and it operates the Emirate's public hospitals.

If Pensieve Labs ever targets those hospitals, the Information Security Regulation becomes a hard gate, the demonstration of implementation to the Center becomes a real programme measured in months rather than weeks, and the cost and time profile of the deal changes completely.

Pensieve Labs's position is that the Dubai Government health segment is out of scope. This is a commercial decision recorded here so that it is not made accidentally in a sales meeting. Any approach from that segment goes through the qualification gate at CHK-AE-001 Section 1 with the Information Security Regulation scored as a blocking dependency, not as a questionnaire.

One deal-specific question remains open in the private segment. [UNVERIFIED] It was not established whether any named private hospital in the Emirate carries a critical information infrastructure designation. A facility that does would pull the national Information Assurance Standards, and possibly the Emirate's Information Security Regulation, into scope for that deal. Ask the Customer's chief information security officer directly at qualification. It is one question and it removes an expensive surprise.

---

#4. Abu Dhabi: the one that is worth building even though it is not required in Dubai

The Abu Dhabi healthcare information and cyber security standard, version 2.0, replaced the earlier edition and is a capability-based model with a three-tier control structure: Basic, Transitional and Advanced. Record system vendors are expected to demonstrate conformance before integration with the Emirate's health information exchange, and the named expectations include multi-factor authentication, encryption of patient data, a zero-trust access architecture and United Arab Emirates data residency, the last of which Pensieve Labs must satisfy in Dubai anyway.

Three facts make this the highest-value security artefact available in this market:

1. It is self-assessed and regulator-audited, not third-party certified. A vendor with no certifications is not excluded from producing it. This is the same structural advantage that makes the questionnaire route work elsewhere.
2. It is shaped like ISO/IEC 27001. Producing the control mapping produces a large part of a Statement of Applicability at the same time, which is reusable in every other market.
3. Abu Dhabi is stricter than Dubai. Clearing Abu Dhabi clears Dubai.

Status: Pensieve Labs has not produced an Abu Dhabi control mapping. It is on the market-entry list at CHK-AE-001 Section 2 as gate U13, scoped as an Abu Dhabi prerequisite and a Dubai optional credential. It is not represented as held, in progress or dated.

---

#5. What Pensieve Labs offers instead of a certificate

Edsol Edtech Pvt. Ltd. holds no information security certification of any kind. WPR-GL-005 is the assurance position and states it in the same terms. This document does not repeat it; it lists what a UAE reviewer can actually be handed.

How to use these in a UAE security review. Send the mapping that matches the reviewer's own vocabulary, not all of them. A reviewer working from an ISO/IEC 27001 checklist gets CHK-GL-028; a reviewer working from a group cyber policy gets CHK-GL-030 or CHK-GL-031; a reviewer who sends a bespoke spreadsheet gets QRE-GL-008 mapped onto it. Sending nine documents to answer one question reads as evasion.

---

#6. The honest statement about mappings

A control mapping is not an audit. Pensieve Labs says this in the mapping documents themselves and repeats it here because it is the point at which a vendor is most tempted to blur:

A mapping states which control Pensieve Labs has implemented against each requirement of a framework. It is Pensieve Labs's own assertion. No third party has verified it. It is not a certification, it does not confer one, and Edsol Edtech Pvt. Ltd. does not describe itself as "ISO 27001 aligned", "SOC 2 ready" or "compliant" with any framework it has not been assessed against.

The compensating evidence is the independent penetration test, the Customer's own right of audit under DPA-AE-001 Section 8 and DPA-GL-001 clause 15, and the configuration verification right at DPA-AE-001 Section 2.6, which, in this market, is a stronger assurance than a certificate, because it can be exercised at any time and it tests the thing that actually matters.

---

#7. Limitations

7.1 Applicability determinations are drawn from secondary analysis. The applicability rows in Section 2 rest on published commentary on the standards rather than on a determination by the issuing authority in respect of Edsol Edtech Pvt. Ltd.. They are stated as Pensieve Labs's reasoned position and a Customer is entitled to test them.

7.2 Critical information infrastructure designation is unresolved. Section 3. It is a deal-specific question and is asked at qualification rather than assumed either way.

7.3 No Abu Dhabi control mapping exists. Section 4.

7.4 Standards move. The version numbers in Section 2 are current as at 01 August 2026 and are re-tested at each review. A superseded version number in a security review costs credibility out of proportion to the error.

7.5 Nothing in this document is a statement about the Customer's own obligations. A Customer that is itself a government entity, a designated critical infrastructure operator or an Abu Dhabi-licensed facility has obligations this document does not describe.

---

#8. Related documents

---

#9. Change history

---