Back to Guides
A short AI-narrated film with English captions. Pressing play loads the YouTube player. Watch on YouTube
Guide Origin: Community | ArcKit Version: [VERSION]
/arckit:uae-ias generates a UAE IAS Statement of Applicability against the 188 controls — 60 management controls (M1–M6) plus 128 technical controls (T1–T9) — priority-tiered P1 to P4. Anchored on the UAE Cybersecurity Council Information Assurance Standard v2.
Targeted at federal entities and Critical Information Infrastructure (CII) operators.
Inputs
| Artefact | Purpose |
|---|---|
Requirements (ARC-<id>-REQ-v1.0.md) |
System scope and functional context |
Architecture (diagrams/ARC-<id>-DIAG-*-v*.md) |
Components and trust boundaries |
Security NFRs (NFR-SEC-* in ARC-<id>-REQ-v*.md) |
Security requirements |
Security design (ARC-<id>-SECD-v1.0.md) |
Existing controls and posture |
Command
/arckit:uae-ias <project ID or system description>
Output: projects/<id>/ARC-<id>-IAS-v1.0.md
Assessment Structure
| Section | Contents |
|---|---|
| Scope | System boundary, CII designation status, sector authority |
| Statement of Applicability | All 188 controls with P1–P4 priority and applicability rationale |
| Risk Treatment Plan | Per-gap risk score, treatment option, owner, deadline |
| CII Registration | Cybersecurity Council registration status and obligations |
| External References | UAE Cybersecurity Council IAS v2 citations |
Control Family Reference
| Family | Range | Description |
|---|---|---|
| Management | M1 | Strategy and Planning |
| Management | M2 | Information Security Risk Management |
| Management | M3 | Awareness and Training |
| Management | M4 | Human Resources Security |
| Management | M5 | Compliance |
| Management | M6 | Performance Evaluation and Improvement |
| Technical | T1 | Asset Management |
| Technical | T2 | Physical and Environmental Security |
| Technical | T3 | Operations Management |
| Technical | T4 | Communications |
| Technical | T5 | Access Control Management |
| Technical | T6 | Third-Party Security |
| Technical | T7 | Information Systems Acquisition, Development & Maintenance |
| Technical | T8 | Information Security Incident Management |
| Technical | T9 | Information Systems Continuity Management |
One-Page Workflow
| Phase | Key Activities | ArcKit Commands |
|---|---|---|
| Architecture | System scope and security NFRs | /arckit:requirements, /arckit:platform-design |
| IAS | Statement of Applicability + Risk Treatment Plan | /arckit:uae-ias |
| Residency | T-family controls into CSP / region choice | /arckit:uae-cloud-residency |
| Risk | Surface IAS gaps to project risk register | /arckit:risk |
Review Checklist
- All 188 controls present in the Statement of Applicability.
- Each control has Applicable / Not Applicable + rationale (no blank cells).
- Priority tier (P1–P4) assigned per control.
- Gaps have a treatment option (mitigate / transfer / accept / avoid) with named owner.
- CII registration status is explicit (registered / pending / not designated).
- T-family gaps that constrain residency choice flagged for
/arckit:uae-cloud-residency.
Key Notes
- CII status: Designation as Critical Information Infrastructure changes priority profile and obligations. Confirm with the Cybersecurity Council before relying on the SoA.
- Audit cadence: IAS expects independent assessment on a defined cycle — capture the next assessment date in Document Control.
- Run order: Run after the security architecture is stable; rerun on material architecture changes.
- Community-contributed: Output should be reviewed by qualified RSSI / federal compliance counsel before reliance.