April 22, 2026 · 5 min read

ADSIC Penetration Testing - Abu Dhabi Government Cybersecurity Guide

Q: "What is ADSIC and which entities does it apply to?"

"ADSIC is the Abu Dhabi Systems and Information Centre, responsible for the Information Security Programme that applies to Abu Dhabi Government entities and government-linked organizations. Scope typically includes Abu Dhabi Government departments, municipalities, authorities, and government-owned or controlled commercial entities. ADSIC operates distinctly from UAE federal NESA - Abu Dhabi Government entities often have obligations under both frameworks concurrently."

Q: "Is ADSIC the same as NESA?"

"No. NESA (National Electronic Security Authority) / NCA is the UAE federal cybersecurity framework covering Critical Information Infrastructure across the country. ADSIC is Abu Dhabi Government's emirate-level Information Security Programme, applying specifically to Abu Dhabi Government entities. Abu Dhabi Government entities operating critical infrastructure typically have obligations under both frameworks. Reports from our engagements can map to both simultaneously."

Q: "How often must ADSIC entities conduct penetration testing?"

"ADSIC Information Security Programme expectations typically require annual penetration testing at minimum for covered entities, with additional testing triggered by significant changes (new systems, major architecture changes, cloud migrations, new third-party integrations), and quarterly or more frequent testing of customer/citizen-facing platforms. Tier-1 Abu Dhabi Government entities with large citizen service footprints typically run testing programmes exceeding the minimum."

Q: "Does ADSIC require Abu Dhabi-based penetration testers?"

"ADSIC does not require UAE-based or Abu Dhabi-based testing firms specifically, but practical expectations favor firms with on-site Abu Dhabi capability. Internal network testing, wireless testing, and regulatory readout sessions are most efficient with testing firms that can operate on-site. Data residency considerations for findings reports may also favor UAE-based firms. pentest.ae provides on-site Abu Dhabi capability from our Dubai base."

Q: "How does ADSIC interact with DOH ADHICS?"

"ADSIC is the Abu Dhabi Government cybersecurity framework. ADHICS (Abu Dhabi Healthcare Information and Cyber Security Standard) is the DOH-published healthcare-specific framework. Abu Dhabi Government healthcare entities (SEHA hospitals, DOH itself) have obligations under both. Our engagements for Abu Dhabi healthcare Government entities map findings to both frameworks where applicable - ADSIC for general cybersecurity controls and ADHICS for healthcare-specific controls."

Q: "What's the typical cost of ADSIC-scoped penetration testing?"

"Abu Dhabi Government entity penetration testing typically runs AED 200,000 to AED 800,000 annually depending on entity size and scope. Smaller authorities or agencies with focused citizen-facing platforms may be at the lower end. Large municipalities, major hospital networks, or tier-1 Government entities with extensive IT estate run at the higher end. See our [penetration testing cost guide](/blog/penetration-testing-cost-uae/) for engagement-type ranges."

ADSIC (Abu Dhabi Systems and Information Centre) penetration testing requirements for Abu Dhabi Government entities. Information Security Programme control families, scope expectations, supervisory patterns, and engagement structuring.

ADSIC penetration testing is the Abu Dhabi Government cybersecurity testing baseline. For Abu Dhabi Government entities, authorities, municipalities, and government-linked organizations, the Information Security Programme published by Abu Dhabi Systems and Information Centre establishes the cybersecurity controls and testing expectations that supervisory reviews evaluate.

This guide covers ADSIC scope, control family expectations, how ADSIC interacts with federal NESA and sector-specific frameworks, and where Abu Dhabi Government cybersecurity programmes typically need to strengthen their testing evidence.

What ADSIC Covers

The Abu Dhabi Systems and Information Centre Information Security Programme typically addresses:

Governance and risk management - establishing cybersecurity programme leadership and risk framework
Asset management - inventorying information assets material to Abu Dhabi Government operations
Access control - logical and physical access management
Cryptography - encryption standards for data at rest and in transit
Physical and environmental security - data centre and facility security
Operations security - change management, capacity planning, malware protection
Communications security - network security and data transfer controls
System acquisition, development, and maintenance - secure SDLC practices
Supplier relationships - third-party risk management
Incident management - response and recovery capability
Business continuity - resilience and recovery planning
Compliance - legal and regulatory alignment

Penetration testing supports multiple control families - notably access control, operations security, system acquisition/development, and compliance.

ADSIC Entities and Coverage

ADSIC typically applies to:

Abu Dhabi Government departments (Department of Finance, Department of Health, Department of Culture and Tourism, Department of Economic Development, and others)
Abu Dhabi municipalities (Municipality of Abu Dhabi, Al Ain Municipality, Al Dhafra Municipality)
Abu Dhabi Government authorities and agencies (Abu Dhabi Customs, Abu Dhabi Accountability Authority, and others)
Government-owned or controlled commercial entities depending on classification
Government-linked technology service providers where providing services to ADSIC-covered entities

Specific scope for each entity is determined through engagement with ADSIC. Our role is typically at the implementation layer - supporting entities in demonstrating cybersecurity controls through independent penetration testing.

ADSIC and NESA - The Dual Framework

Abu Dhabi Government entities frequently have obligations under both:

ADSIC - emirate-level Abu Dhabi Government cybersecurity programme
NESA / NCA - UAE federal cybersecurity framework for Critical Information Infrastructure

These frameworks are complementary, not alternatives. Abu Dhabi Government entities operating critical infrastructure typically demonstrate cybersecurity posture against both. Penetration testing reports can map findings to both control frameworks simultaneously, reducing documentation burden.

Abu Dhabi Government healthcare entities additionally have ADHICS (Abu Dhabi Healthcare Information and Cyber Security) obligations via Department of Health. ADSIC covers general cybersecurity; ADHICS covers healthcare-specific controls.

Testing Scope for Abu Dhabi Government Entities

Typical engagement scope for Abu Dhabi Government entities:

Citizen-facing platforms

The highest-visibility attack surface. Testing must cover:

Citizen service web portals
Mobile applications (UAE PASS integrations, service request, payment)
Public-facing APIs
Self-service kiosks where applicable
Contact centre integration systems

Inter-agency integration

Abu Dhabi Government operates on extensive inter-agency data sharing. Testing scope should cover:

Inter-agency data exchange integrations
Shared service platforms
Federated identity flows between agencies
Data sharing APIs and message buses

Backend operational systems

Administrative and staff-facing applications
Financial and procurement systems
HR and workforce management
Document management and records systems

Infrastructure

Cloud workloads (AWS, Azure, Oracle, G42 Cloud depending on entity)
Internal network and Active Directory
Identity and access management infrastructure
Data centre physical infrastructure where applicable

Emerging service channels

Chatbots and virtual assistants
AI-augmented service delivery
Data analytics platforms

Supervisory and Audit Patterns

Based on patterns observed across Abu Dhabi Government cybersecurity engagements:

Programme-level documentation expectations

Information security policy mapped to ADSIC control families
Annual cybersecurity testing plan with scope coverage rationale
Engagement-specific statements of work with defined scope and methodology
Testing firm independence attestation
Findings reports with severity classification and business impact

Engagement-specific expectations

Tester qualifications documented (OSCP, CREST, CVEs, conference speaking)
Testing methodology aligned with recognized frameworks (OWASP, NIST SP 800-115, PTES)
Findings with CVSS v3.1 scoring
Remediation tracking with finding-to-closure traceability
Retest attestations for critical and high findings
Risk acceptance documentation for unremediated findings with appropriate authority

Programme maturity expectations

Year-over-year trend analysis showing improvement
Integration with incident response and change management programmes
Evidence that findings inform broader security programme evolution
Supplier testing coverage for material third-party services

Common Gaps in Abu Dhabi Government Cybersecurity Programmes

Patterns observed across engagements:

Citizen-facing tested, inter-agency integration under-scoped. Portal tested thoroughly; backend integrations between agencies assumed secure.
Shared service platforms treated as someone else’s responsibility. Multiple agencies using the same platform assume the platform provider handles testing; coverage gaps emerge.
Third-party technology suppliers assumed to meet ADSIC expectations. Supplier security posture not independently validated.
Cloud migrations lacking pre-migration and post-migration testing. New cloud estate is a significant change that triggers testing.
Red teaming absent. ADSIC programme maturity increasingly warrants adversary simulation for tier-1 Abu Dhabi Government entities.
Arabic-language service flow security under-tested. Applications with Arabic interfaces and RTL handling sometimes have security flaws specific to localization that generic testing misses.

How pentest.ae Supports ADSIC Engagements

We run penetration testing for Abu Dhabi Government entities with specific ADSIC-aligned scope design, Abu Dhabi on-site capability, and reporting structured for ADSIC supervisory evidence. Our team includes researchers with Arabic-language application testing experience and familiarity with UAE Government operational contexts.

For Abu Dhabi Government healthcare entities needing combined ADSIC and ADHICS coverage, we scope coordinated engagements. For cross-border or commercial Abu Dhabi Government entities additionally subject to DFSA (if ADGM-based) or CBUAE, we include those framework mappings.

Penetration Testing UAE - full service overview
Penetration Testing Abu Dhabi - dedicated Abu Dhabi service page
NESA Penetration Testing Guide - UAE federal framework
Healthcare Penetration Testing Guide - DHA + ADHICS
ISR v2 Penetration Testing Guide - telecom and digital government
UAE PDPL Penetration Testing - federal data protection

Common Questions

Frequently Asked Questions

What is ADSIC and which entities does it apply to?

ADSIC is the Abu Dhabi Systems and Information Centre, responsible for the Information Security Programme that applies to Abu Dhabi Government entities and government-linked organizations. Scope typically includes Abu Dhabi Government departments, municipalities, authorities, and government-owned or controlled commercial entities. ADSIC operates distinctly from UAE federal NESA - Abu Dhabi Government entities often have obligations under both frameworks concurrently.

Is ADSIC the same as NESA?

No. NESA (National Electronic Security Authority) / NCA is the UAE federal cybersecurity framework covering Critical Information Infrastructure across the country. ADSIC is Abu Dhabi Government's emirate-level Information Security Programme, applying specifically to Abu Dhabi Government entities. Abu Dhabi Government entities operating critical infrastructure typically have obligations under both frameworks. Reports from our engagements can map to both simultaneously.

How often must ADSIC entities conduct penetration testing?

ADSIC Information Security Programme expectations typically require annual penetration testing at minimum for covered entities, with additional testing triggered by significant changes (new systems, major architecture changes, cloud migrations, new third-party integrations), and quarterly or more frequent testing of customer/citizen-facing platforms. Tier-1 Abu Dhabi Government entities with large citizen service footprints typically run testing programmes exceeding the minimum.

Does ADSIC require Abu Dhabi-based penetration testers?

ADSIC does not require UAE-based or Abu Dhabi-based testing firms specifically, but practical expectations favor firms with on-site Abu Dhabi capability. Internal network testing, wireless testing, and regulatory readout sessions are most efficient with testing firms that can operate on-site. Data residency considerations for findings reports may also favor UAE-based firms. pentest.ae provides on-site Abu Dhabi capability from our Dubai base.

How does ADSIC interact with DOH ADHICS?

ADSIC is the Abu Dhabi Government cybersecurity framework. ADHICS (Abu Dhabi Healthcare Information and Cyber Security Standard) is the DOH-published healthcare-specific framework. Abu Dhabi Government healthcare entities (SEHA hospitals, DOH itself) have obligations under both. Our engagements for Abu Dhabi healthcare Government entities map findings to both frameworks where applicable - ADSIC for general cybersecurity controls and ADHICS for healthcare-specific controls.

What's the typical cost of ADSIC-scoped penetration testing?

Abu Dhabi Government entity penetration testing typically runs AED 200,000 to AED 800,000 annually depending on entity size and scope. Smaller authorities or agencies with focused citizen-facing platforms may be at the lower end. Large municipalities, major hospital networks, or tier-1 Government entities with extensive IT estate run at the higher end. See our [penetration testing cost guide](/blog/penetration-testing-cost-uae/) for engagement-type ranges.

Find It Before They Do

Book a free 30-minute security discovery call with our AI Security experts in Dubai, UAE. We identify your highest-risk AI attack vectors - actionable findings in days.

Talk to an Expert