The National Policy for the Internet of Things Security

The National Policy for the Internet of Things Security outlines the main directives for the cybersecurity system, assigning essential tasks and responsibilities to improve its operational capabilities, ensuring an optimal response to cyber incidents. The objectives of the policy are to reduce the number of critical or serious incidents and establish a unified approach for responding to cybersecurity incidents. 
The National Policy for the Internet of Things Security
U.Ask

The National Policy for the Internet of Things Security

The National Policy for the Internet of Things Security was adopted to enhance the UAE’s global standing in the field of IoT security and to support the protection of the UAE's cyberspace. This policy outlines the main directives for the cybersecurity system, assigning essential tasks and responsibilities to improve its operational capabilities, ensuring an optimal response to cyber incidents.

 

This policy supports the adoption of emerging technologies, cloud computing, and the IoT. It also ensures that IoT service providers meet security requirements and guarantees a level of protection for all IoT users, when purchasing or using services. This aims to mitigate the potential negative impacts that can accompany reliance on modern technologies.

 

Objectives of the policy

The objectives of the policy are to:

  1. reduce the number of critical or serious incidents
  2. establish a unified approach for responding to cybersecurity incidents
  3. strengthen the cybersecurity ecosystem across all targeted vital sectors nationwide
  4. define the primary directives for the cybersecurity ecosystem and assign critical functions with the aim of safeguarding the UAE cyberspace through emerging technologies, while fostering the adoption of cloud computing and the Internet of Things
  5. improve the operational capacity of the cybersecurity ecosystem to achieve optimal incident response and boost situational awareness
  6. establish a successful accreditation system based on rigorous standards to instill confidence in the cybersecurity service providers’ systems within the UAE.

 

Priorities and key components

The priorities and key components of the policy revolve around 5 principles which were developed to help the IoT consumers and IoT service providers in their purchasing and operating decision-making process. The principles are:

  1. security and privacy by design - use certified devices, tailor-made operating systems, services managed by recognised service providers, and skilled resources to support the development, optimal utilisation, and operation of secure IoT applications
  2. identify security priorities based on impact - consider potential implications of service outages, breaches, or malicious activities faced by consumers when developing and establishing security measures, and assigning responsibilities to mitigate the resulting serious implications
  3. strong defence - develop a comprehensive approach to security, based on activating a multi-layered defence mechanism against cybersecurity threats in the design of IoT applications and their ecosystem
  4. guidance on best practices - leverage global best practices to provide security and enhance compliance efficiencies
  5. a collaborative and transparent ecosystem - share information about security vulnerabilities with manufacturers, service providers, industrial consumers, and regulators to increase awareness.

 

Expected outcome

The policy is expected to achieve the following outcome:

  1. ensure the secure exchange of information in line with globally recognised best practices
  2. secure systems integral to vital sector operations and ensure the resilience of their protective measures
  3. mitigate the impact of cyber-attacks through adherence to standardized criteria aimed at reducing known risks and vulnerabilities
  4. establish unified cyber foundations at the national level to support security requirements for IoT technology
  5. foster increased collaboration and cooperation between the public and private sectors through standardisation efforts
  6. safeguard IoT systems used by all entities and organisations while ensuring the durability of their protection systems. 
  7. decrease the number of technical incidents associated with IoT technology and reduce susceptibility to cybercrime
  8. bolster public confidence in IoT technology.
Updated on:

29 Jun 2026