UAE National Electronic Security Authority (NESA) Cyber Security Training Requirements: A 2026 Reference

What is NESA?

NESA stands for the National Electronic Security Authority. It is the UAE's federal authority responsible for defining national cyber security and information assurance requirements — specifically for protecting the country's critical information infrastructure from cyber threats. NESA now operates as part of the Signals Intelligence Agency (SIA), which oversees national cyber resilience and the protection of critical digital infrastructure.

NESA was established in 2012 by UAE Presidential Decree No. 21 of 2012. Its core mandate was to develop the national cyber security framework, set technical security standards, and oversee their implementation across government and critical sectors.

NESA's most significant output is the UAE Information Assurance Standards (IAS) — a comprehensive set of cyber security controls that organisations within its scope are required to implement. Think of the IAS as the UAE's own cyber security rulebook, built on international best practices from ISO 27001, but tailored to the UAE's regulatory environment and the specific risks of its critical sectors.

Since 2020, NESA operates alongside the UAE Cybersecurity Council — the higher-level strategic body established to set national cyber security direction. The Cybersecurity Council handles strategy and coordination at the national level. NESA handles the technical standards and operational compliance framework. In practical terms, if the Cybersecurity Council sets the destination, NESA provides the map for how to get there.

What are the NESA Information Assurance Standards?

The UAE Information Assurance Standards (IAS) are a comprehensive framework of cyber security controls published by NESA. They are heavily informed by international standards — particularly ISO/IEC 27001 — but adapted for the UAE regulatory context and the specific risk profile of the critical sectors they apply to.

The IAS covers a wide range of control domains, from access control and cryptography to incident management and business continuity. One of those domains — and the focus of this blog — is human resources security and security awareness, which is where NESA's training requirements sit.

The IAS distinguishes between controls that apply to all organisations within scope, controls that apply based on the criticality tier of the organisation, and controls that apply to specific roles. Understanding which tier your organisation falls into is the starting point for understanding your training obligations.

Who Do NESA's Training Requirements Apply To?

NESA's IAS applies to organisations that operate, manage, or have access to Critical National Infrastructure (CNI) and Critical Information Infrastructure (CII) in the UAE. This broadly covers:

• Federal government entities and ministries
• Local government entities across the seven emirates
• Semi-government entities and government-owned enterprises
• Operators of critical national infrastructure in sectors including energy, water, transportation, healthcare, telecommunications, banking and financial services, and government services
• Third-party service providers and contractors who have significant access to CNI systems or data

If you are a private sector organisation that does not touch critical infrastructure, NESA's IAS does not apply to you directly — though many private sector organisations in the UAE adopt it as a best-practice framework voluntarily, particularly those supplying to government entities.

If you are uncertain whether your organisation falls within scope, that question needs to be answered at the senior management level — not assumed. Operating critical infrastructure without a compliant IAS implementation is a regulatory exposure.

What NESA Requires in Terms of Training

NESA's training requirements under the IAS operate on three levels: organisation-wide security awareness, role-based technical training, and leadership and governance-level awareness. Each has distinct requirements.

1. Organisation-Wide Security Awareness Training

Every employee in your organisation — regardless of their technical role, seniority, or department — must receive security awareness training. This is not optional and it is not limited to your IT or security team.

The rationale is straightforward: most successful cyberattacks involve a human element. Phishing, social engineering, credential theft, and inadvertent data disclosure all depend on employees making the wrong decision — clicking a link they should not have, sharing credentials, or mishandling sensitive information. Training that reaches every employee reduces this attack surface significantly.

Under NESA's requirements, organisation-wide security awareness training must cover:

Information security policies and employee responsibilities — every employee must understand the organisation's information security policies and what they are personally responsible for. This includes acceptable use of systems and data, password management requirements, and the rules around using personal devices and external storage media.

Recognising and responding to threats — employees must be trained to recognise common attack techniques, particularly phishing emails and social engineering attempts. They must know what to do when they encounter a suspicious email, an unexpected request for credentials, or unusual system behaviour — and they must know who to contact and how.

Data handling and classification — employees who handle organisational data must understand how it is classified, what the rules are for each classification level, and what the consequences of mishandling it are.

Incident reporting — every employee must know how to report a suspected security incident, a policy violation, or a security concern. The reporting process must be simple, accessible, and well communicated — if reporting is difficult, incidents go unreported.

Physical security awareness — employees must understand physical security requirements relevant to their work environment — clean desk policy, visitor management, secure disposal of physical documents, and the risks of leaving devices unattended.

This training must be delivered to new employees before or at the time they are granted access to organisational systems. It is not sufficient to provide training after access is already live. And it must be refreshed regularly — NESA's framework requires periodic refresher training, not a one-time onboarding exercise.

2. Role-Based Technical Training

Not everyone in your organisation needs the same depth of cyber security knowledge. NESA's IAS requires that employees with technical responsibilities — particularly those who manage, administer, or have privileged access to systems within your IAS scope — receive training appropriate to those responsibilities.

This role-based training requirement applies to:

IT and system administrators — individuals responsible for managing servers, networks, databases, and operating systems must be trained in the secure configuration and hardening of the systems they manage. They must understand vulnerability management, patch management procedures, and the security implications of the configuration decisions they make.

Privileged access users — any individual with privileged or administrative access to critical systems carries a disproportionate risk. If their credentials are compromised, the attacker gains the same level of access. Role-based training for privileged users must cover the specific risks associated with privileged access, the controls in place to manage it — including multi-factor authentication, privileged access management tools, and the principle of least privilege — and the responsibilities that come with that level of access.

Security operations staff — individuals working in your security operations centre (SOC), incident response team, or vulnerability management function require specialised training commensurate with their responsibilities. This includes training on the tools they use, the threat landscape relevant to your sector, incident analysis techniques, and escalation procedures.

Developers and software engineers — if your organisation builds or maintains software systems, your development team must receive training in secure coding practices. This is directly reflected in the IAS controls on system acquisition and development. Developers who are not trained in security write insecure code — and in critical infrastructure environments, insecure code is not just a technical problem.

Third-party contractors with system access — individuals from third-party organisations who are granted access to your critical systems must also receive appropriate security training before access is granted. This is an area where many organisations have gaps. Contractor access is a significant attack vector — the training requirement applies regardless of whether the individual is a direct employee.

3. Leadership and Governance-Level Awareness

NESA's framework recognises that cyber security is a governance issue, not just a technical one. Senior management and board-level leaders who make decisions about cyber security investment, risk appetite, and organisational priorities must have sufficient understanding of cyber security to make those decisions responsibly.

This does not mean your CEO needs to be able to configure a firewall. It means they need to understand:

• The cyber security risks your organisation faces and why they matter to the business
• What the IAS requires of your organisation and what the consequences of non-compliance are
• What resources your security function needs and why
• How to interpret cyber security risk reporting and ask the right questions of their security and IT leaders
• Their personal accountability under UAE law for the organisation's cyber security posture

Leadership awareness training is often the most neglected component of a cyber security training programme — because senior executives are busy, because security teams are reluctant to push the topic upward, and because the content is rarely tailored to a non-technical audience. Getting this right is worth the effort. A leadership team that understands cyber security makes better decisions about it.

Documentation and Record-Keeping

Training without documentation is training that cannot be demonstrated. NESA's IAS requirements include maintaining records that evidence your training programme. When a regulator, auditor, or examiner asks whether your organisation has met its training obligations, you must be able to show:

• What training programme exists — including content, target audience, and frequency
• Who has completed what training and when — individual completion records for every employee
• That new employees received training before or at the time of system access
• That training content is current and reflects the current threat landscape and your current policies
• That training is reviewed and updated periodically

The absence of documentation is treated as the absence of training. A programme that exists but is not documented is not a programme you can rely on in an audit or examination.

How Often Is Training Required?

The IAS does not specify a single fixed frequency for all training. Instead, it takes a risk-based approach — the frequency of training should be proportionate to the risk profile of the role and the pace at which the threat environment or the organisation's systems change.

In practice, the following frequencies reflect a compliant approach for most organisations:

New employee security awareness training — at onboarding, before system access is granted. No exceptions.

Annual security awareness refresher — for all employees, covering updates to policies, new or evolving threat typologies, and any changes to organisational security procedures. Many organisations supplement this with more frequent shorter communications — monthly phishing awareness updates, alerts about active threats, or brief policy reminders.

Role-based technical training — at least annually for technical staff, with additional training triggered by significant changes to systems, tools, or the threat landscape. When a new security tool is deployed, when a major vulnerability in a commonly used platform is disclosed, or when a significant security incident occurs in your sector, that is a trigger for targeted training — not a reason to wait until the next annual cycle.

Leadership awareness — at least annually, delivered in a format that is accessible and relevant to a non-technical audience. Board-level cyber security briefings, executive workshops, or tabletop exercises are all effective formats.

Phishing simulations — while not explicitly specified as a mandatory control, phishing simulations are widely used by NESA-compliant organisations as a practical mechanism to test and reinforce awareness training. The results of phishing simulations are useful both for identifying employees who need additional support and for demonstrating the effectiveness of your awareness programme over time.

Common Gaps That Organisations Miss

Having worked through hundreds of IAS assessments and compliance reviews, the following are the training-related gaps that appear most frequently — and that NESA examiners look for specifically.

Training that exists on paper but is not operational — a training policy, a list of modules, and a learning management system (LMS) that nobody actually uses. The gap between the documented programme and the reality of who has actually completed training is one of the most consistently identified findings.

Contractors and third parties not covered — organisations focus their training programmes on direct employees and forget about contractors, secondees, and third-party staff with system access. Under NESA's IAS, third-party personnel with access to your critical systems must meet the same training requirements as your own employees.

New joiners accessing systems before completing training — operationally, there is often pressure to get new employees productive quickly. In practice, this means they sometimes get system access before security training is completed. This is a compliance gap and a real security risk.

Training content that has not been updated — a security awareness module written in 2021 that still references outdated phishing examples, refers to superseded policies, or does not cover current threats like AI-enabled social engineering or deepfake-based fraud is not effective training. Content must be reviewed and updated regularly.

No measurement of effectiveness — many organisations complete training and record completion rates but do not measure whether the training has actually changed behaviour or improved knowledge. Testing, phishing simulation pass rates, and post-training assessments are practical ways to demonstrate effectiveness.

Senior management exemptions — it is not unusual for training completion requirements to be quietly waived for senior executives. This is both a compliance gap and a cultural signal to the rest of the organisation that security is for other people. Senior management must complete the same annual awareness training as everyone else.

Practical Steps to Build a Compliant Training Programme 

If you are building or reviewing your cyber security training programme against NESA's requirements, the following steps provide a practical starting point.

Map your roles and risk levels first. Before designing training content, identify the different employee groups in your organisation — general staff, technical staff, privileged users, developers, security staff, senior management, and contractors. Each group has different training requirements. Training design that starts with content rather than audience tends to produce generic modules that serve nobody well.

Define your minimum standards. For each employee group, define what training they must complete, how often, and by when. Formalise this in a training policy that is approved at the appropriate governance level — typically by the CISO and senior management.

Choose delivery methods that work. A long annual e-learning module is the least effective format for most audiences. Short, frequent, engaging content performs significantly better in terms of retention and behaviour change. Consider: short video modules (five to ten minutes), scenario-based learning that uses real examples from your sector, phishing simulations with immediate educational feedback, live workshops for technical and leadership audiences, and regular awareness communications that keep security visible throughout the year.

Automate enrolment and tracking. A learning management system that automatically enrols new joiners in mandatory onboarding training, tracks completion in real time, and generates reports for compliance purposes saves significant administrative effort and reduces the risk of gaps.

Test whether it is working. Completion rates tell you who has sat through training. Phishing simulation results, post-training knowledge tests, and the volume and quality of security incident reports from staff tell you whether the training has actually changed behaviour. The latter is what matters.

Review content annually as a minimum. Assign a named owner for each training module with a documented review cycle. When your policies change, your training must change to reflect them. When a new threat type becomes prevalent in your sector, your awareness content must address it.

Document everything. Maintain completion records, content version histories, review dates, and assessment results. Structure your records so that you can rapidly produce a complete training compliance report for any employee or employee group.

How NESA Assesses Training Compliance

When NESA examiners assess your organisation's compliance with the IAS — whether through a formal examination or a targeted review — training is one of the areas they will examine directly. You should expect them to:

• Ask to see your training policy and programme documentation
• Request completion records for a sample of employees — including senior staff, technical staff, and contractors
• Interview employees to assess whether training has produced genuine understanding — not just completion metrics
• Review training content to assess whether it is current, relevant, and role-appropriate
• Ask how you measure training effectiveness and what you do when gaps are identified

The questions examiners ask of employees directly are often the most revealing. If a front-line employee cannot explain how to report a phishing email, or if a system administrator is uncertain about their privileged access responsibilities, it reflects the state of your training programme regardless of what your completion records show.

Why Training Matters More in 2026

The UAE's threat landscape in 2026 is significantly more challenging than it was three years ago. Adversaries — both cybercriminal groups and state-sponsored actors — are more sophisticated, more persistent, and increasingly using artificial intelligence to improve the effectiveness of their attacks.

AI-generated phishing has dramatically lowered the quality bar that distinguishes suspicious from legitimate communications. In 2020, a poorly written email with unusual formatting was a reliable indicator of a phishing attempt. In 2026, AI-generated phishing emails are grammatically perfect, contextually relevant, and sometimes personalised using data harvested from LinkedIn, company websites, or previous breaches. Employees who were trained to spot the obvious markers of old-style phishing are not necessarily equipped to handle current-generation attacks.

Deepfake-based social engineering — voice and video impersonation of senior executives or trusted colleagues — is an emerging and increasingly accessible attack technique. Employees need to understand that receiving a voice call or a video message from someone who appears to be their CEO is no longer sufficient verification for a sensitive request.

Insider threat remains a consistent risk, particularly in critical infrastructure environments where access to operational systems is inherently sensitive. Training that builds a culture of responsible reporting and psychological safety — where employees feel comfortable reporting concerns without fear of blame — is part of your insider threat mitigation.

These evolving threats mean that training content developed even two years ago may not adequately prepare your employees for the attacks they will actually face. Keeping training current is not administrative housekeeping — it is an operational security requirement.

What You Should Have in Place

If you are taking stock of your NESA training compliance, here is a practical checklist:

• A documented training policy, approved at governance level, defining requirements by role
• Organisation-wide security awareness training delivered to all employees, refreshed at least annually
• Role-based technical training for IT staff, privileged users, security staff, and developers
• Leadership and governance awareness training for senior management and board-level stakeholders
• Training for contractors and third parties with system access — before access is granted
• Completion records maintained for every employee, for every training module, accessible for examination
• Training content that is current — reviewed within the past 12 months and updated to reflect current threats and policies
• A mechanism for measuring training effectiveness beyond completion rates
• A process for triggered training when significant changes occur — new systems, new threats, security incidents

NESA's training requirements are not administratively burdensome when they are properly embedded in your organisation's operations. The challenge is not the standard — it is the discipline of maintaining a live, current, measurable programme year-round rather than treating training as a pre-audit activity.

The organisations that handle NESA examinations well are the ones where training is genuinely part of how they operate — not something they do to tick a box.