UAE boards face new cybersecurity accountability

Cybersecurity oversight in the UAE has moved into the boardroom as regulators add breach notifications, disclosure rules and, in some cases, director accountability. Companies now need documented board engagement on cyber risk, incident planning and vendor oversight to show they are meeting the new standard.

Why it matters: - UAE regulators are treating cybersecurity as a governance issue, not just an IT function. - Board oversight now has direct consequences for breach response, disclosure and, in some cases, individual director accountability. - Companies that cannot show active board involvement may face greater exposure after an incident.

What happened: - Cybersecurity oversight in the UAE shifted to the board level after sector-specific regulation expanded across finance, telecom and critical infrastructure. - The rules now include breach notification timelines and mandatory disclosure requirements. - Some frameworks also introduce direct accountability for individual directors. - Dubai-headquartered Microminder Cyber Security is working with boards and security teams across the UAE's regulated sectors on incident response planning, vendor risk evaluation and compliance reporting.

The details: - UAE boards are expected to show documented engagement on cyber risk, not just a signed annual report. - Regulators are looking for meeting minutes that discuss security risk, questions sent to the security function and decisions tied back to that input. - Boards do not need to know firewall configuration details to oversee security effectively. - Boards do need to ask what the organization's attack surface looks like, what the incident response plan says for the first 24 hours after a suspected breach, how vendor risk is assessed before contracts are signed and whether security spending reduces measurable risk. - These questions matter more when they are asked consistently throughout the year, not only during an audit cycle. - The UAE Government's cyber safety and digital security portal is a direct resource for board leaders, because the obligations apply to organizational leadership as a whole. - Microminder Cyber Security is a CREST- and ISO 27001-certified consultancy with more than four decades of experience. - Microminder Cyber Security offers penetration testing, managed detection and response, critical national infrastructure and operational technology protection, and compliance consulting. - The company says it has worked with more than 2,600 organizations worldwide, including governments and enterprises in finance, energy, healthcare and manufacturing.

Between the lines: - The regulatory shift raises the cost of passive oversight and makes cyber risk a board-level recordkeeping issue. - Regional regulatory familiarity has become a differentiator for outside security providers because generic services may not address UAE reporting obligations. - Boards that can show a clear paper trail after an incident are in a stronger position than boards that cannot.

What's next: - Boards are likely to face continued pressure to document cyber oversight and to revisit security risk more often than once a year. - Organizations working in regulated sectors will need stronger incident response planning, vendor controls and evidence of board-level review. - More companies may seek providers with UAE-specific compliance experience as the regulatory environment tightens.