Regulatory Radar
Active GRC, cybersecurity & privacy regulations we track.
A working inventory of the regulations, frameworks and supervisory standards MAST helps clients comply with — across the UAE, KSA, wider GCC, India, EU and global jurisdictions.
53 of 53 regulations.
Europe
| Regulation | Country | Regulator | Domain |
|---|---|---|---|
EU NIS 2 Directive — Network & Information Security EU_NIS2 | European Union | European Commission / National CSIRTs | Cybersecurity |
EU Digital Operational Resilience Act (DORA) EU_DORA | European Union | European Supervisory Authorities (EBA, ESMA, EIOPA) | Financial Services |
EU Artificial Intelligence Act EU_AI_ACT | European Union | European AI Office / National Competent Authorities | AI Governance |
GCC
| Regulation | Country | Regulator | Domain |
|---|---|---|---|
ADGM Data Protection Regulations ADGM_DPR | United Arab Emirates | ADGM Financial Services Regulatory Authority | Data Privacy & Protection |
CBUAE AI / ML Guidance CBUAE_AI | United Arab Emirates | Central Bank of the UAE | AI Governance |
CBUAE Business Continuity Standards CBUAE_BCS | United Arab Emirates | Central Bank of the UAE | Business Continuity |
CBUAE Information Security Regulation CBUAE_ISR | United Arab Emirates | Central Bank of the UAE | Information Security |
CBUAE IT Risk Regulation CBUAE_ITR | United Arab Emirates | Central Bank of the UAE | Financial Services |
CBUAE Outsourcing Regulation CBUAE_OUT | United Arab Emirates | Central Bank of the UAE | Financial Services |
CST Cloud Computing Regulatory Framework CST_CCRF | Saudi Arabia | Communications, Space & Technology Commission | Cloud Security |
DESC Cloud Security Standard DESC_CSS | United Arab Emirates | Dubai Electronic Security Center | Cloud Security |
DIFC Data Protection Law DIFC_DPL | United Arab Emirates | DIFC Authority | Data Privacy & Protection |
Dubai DESC Information Security Regulation DESC_ISR | United Arab Emirates | Dubai Electronic Security Center | Information Security |
KSA Personal Data Protection Law KSA_PDPL | Saudi Arabia | Saudi Data & AI Authority | Data Privacy & Protection |
NCA Cloud Cybersecurity Controls (CCC-1) NCA_CCC | Saudi Arabia | National Cybersecurity Authority | Cloud Security |
NCA Essential Cybersecurity Controls (ECC-1) NCA_ECC | Saudi Arabia | National Cybersecurity Authority | Cybersecurity |
NCA OT Cybersecurity Controls (OTCC-1) NCA_OTCC | Saudi Arabia | National Cybersecurity Authority | OT / ICS Security |
NCEMA 7000 — Business Continuity Standard NCEMA_7000 | United Arab Emirates | National Emergency Crisis & Disasters Management Authority | Business Continuity |
SAMA Business Continuity Framework SAMA_BCM | Saudi Arabia | Saudi Central Bank (SAMA) | Business Continuity |
SAMA Cybersecurity Framework SAMA_CSF | Saudi Arabia | Saudi Central Bank (SAMA) | Financial Services |
SAMA Technology Risk Framework SAMA_TRF | Saudi Arabia | Saudi Central Bank (SAMA) | Risk Management |
SDAIA AI Ethics Principles SDAIA_AI | Saudi Arabia | Saudi Data & AI Authority | AI Governance |
UAE Information Assurance Framework UAE_IAF | United Arab Emirates | Telecom & Digital Government Regulatory Authority | Cybersecurity |
UAE IoT Security Policy UAE_IOT | United Arab Emirates | Telecom & Digital Government Regulatory Authority | Cybersecurity |
UAE Personal Data Protection Law UAE_PDPL | United Arab Emirates | UAE Data Office | Data Privacy & Protection |
Global
| Regulation | Country | Regulator | Domain |
|---|---|---|---|
CIS Controls CIS_CTRL | Global / International | Center for Internet Security | Cybersecurity |
COBIT COBIT | Global / International | ISACA (COBIT) | IT Service Management |
GDPR — EU General Data Protection Regulation GDPR | Global / International | European Commission (GDPR) | Data Privacy & Protection |
IEC 62443 — OT/ICS Security IEC_62443 | Global / International | International Electrotechnical Commission | OT / ICS Security |
ISO 22301 — Business Continuity Management ISO_22301 | Global / International | International Organization for Standardization | Business Continuity |
ISO 31000 — Risk Management ISO_31000 | Global / International | International Organization for Standardization | Risk Management |
ISO/IEC 20000-1 — IT Service Management ISO_20000 | Global / International | International Organization for Standardization | IT Service Management |
ISO/IEC 27001 — Information Security Management ISO_27001 | Global / International | International Organization for Standardization | Information Security |
ISO/IEC 27002 — Information Security Controls ISO_27002 | Global / International | International Organization for Standardization | Information Security |
ISO/IEC 27005 — Information Security Risk Management ISO_27005 | Global / International | International Organization for Standardization | Risk Management |
ISO/IEC 27701 — Privacy Information Management ISO_27701 | Global / International | International Organization for Standardization | Data Privacy & Protection |
ISO/IEC 42001 — AI Management System ISO_42001 | Global / International | International Organization for Standardization | AI Governance |
NIST AI Risk Management Framework NIST_AIRMF | Global / International | National Institute of Standards and Technology | AI Governance |
NIST Cybersecurity Framework NIST_CSF | Global / International | National Institute of Standards and Technology | Cybersecurity |
PCI DSS PCI_DSS | Global / International | PCI Security Standards Council | Financial Services |
SOC 1 Type 1 SOC1_T1 | Global / International | American Institute of CPAs (SOC reports) | Financial Services |
SOC 1 Type 2 SOC1_T2 | Global / International | American Institute of CPAs (SOC reports) | Financial Services |
SOC 2 Type 1 SOC2_T1 | Global / International | American Institute of CPAs (SOC reports) | Information Security |
SOC 2 Type 2 SOC2_T2 | Global / International | American Institute of CPAs (SOC reports) | Information Security |
South Asia
| Regulation | Country | Regulator | Domain |
|---|---|---|---|
Aadhaar Data Protection Requirements AADHAAR_DP | India | Unique Identification Authority of India | Data Privacy & Protection |
CERT-In Directions 2022 CERTIN_2022 | India | Indian Computer Emergency Response Team | Cybersecurity |
Digital Personal Data Protection Act 2023 IN_DPDPA | India | Ministry of Electronics and Information Technology | Data Privacy & Protection |
IRDAI Cybersecurity Guidelines IRDAI_CSG | India | Insurance Regulatory and Development Authority of India | Financial Services |
MeitY Responsible AI Guidance MEITY_AI | India | Ministry of Electronics and Information Technology | AI Governance |
RBI Cybersecurity Framework RBI_CSF | India | Reserve Bank of India | Financial Services |
RBI Digital Payment Security Controls RBI_DPSC | India | Reserve Bank of India | Financial Services |
RBI Outsourcing Guidelines RBI_OUT | India | Reserve Bank of India | Financial Services |
SEBI Cybersecurity Framework SEBI_CSF | India | Securities and Exchange Board of India | Financial Services |
How we help
Turn the radar into a programme.
MAST builds a single control set that satisfies multiple regulations at once — so you audit your evidence library, not every regulator separately.