DESC · Digital Dubai

The Dubai-emirate layer — distinct from both the DIFC free zone and the UAE federal layer. DESC's Information Security Regulation (ISR) is a binding cyber-controls framework (13 domains — governance, asset/access, operations, incident & monitoring, continuity, cloud security) for Dubai Government entities, critical infrastructure, and private entities handling sensitive Dubai data; it maps to the MAESTRO infrastructure/observability/compliance layers. Digital Dubai's AI Ethics Principles & Guidelines (fairness, transparency, accountability, explainability) ride along as non-binding guidance. Note: this regime does not apply inside the DIFC free zone.