Your Information Security Management System, in One Place
Run ISO 27001, ISO 27017 and UAE IA from one set of controls. Decide what applies, score where you stand, manage information security risk and walk into your audit with the evidence already linked.
M1Information security strategyImplementedM5Third-party securityPartialT3Communications securityPartialT7Incident managementGapEverything Information Security Needs, on One Core
Statement of Applicability
Load the framework, mark each control in or out of scope with a reason, send it for approval and export a signed PDF for your certification body. Every version is kept.
Gap Assessment
Score each control from not implemented to fully implemented. See results by domain and overall, and turn any gap into a corrective action.
Information Security Risk Register
Raise risks against assets, score them on your matrix and take each one through treat, tolerate, terminate or transfer.
Assets, Policies and Evidence
The asset register, policy acknowledgements and evidence store are shared with every other module, so nothing is entered twice.
UAE IA, Scored Properly
UAE IA is scored the way the standard expects, across management controls, technical controls and domains.
Audit Ready
Internal and external audits run from the same controls and evidence, with findings that become corrective actions.
From Set-Up to Proof in Four Steps
Load the Framework
Pick ISO 27001, UAE IA or another framework. Controls load with their structure and priorities.
Set Applicability
Mark each control in or out of scope with a reason, then send the SoA for approval.
Assess and Treat
Score every control, raise risks against assets and assign corrective actions.
Prove It
Run the audit from the same evidence and export signed reports.
Information Security as Your Team Sees It
Every screen is role-based. Focal points see their tasks, managers see the whole picture.
| Ref | Item | Owner | Status |
|---|---|---|---|
M1 | Information security strategy | Owner 1 | Implemented |
M5 | Third-party security | Owner 2 | Partial |
T3 | Communications security | Owner 3 | Partial |
T7 | Incident management | Owner 4 | Gap |
One Piece of Work, Credited Everywhere
Controls in Information Security are mapped to the frameworks below, and across to the rest of your library.
Describe It Once. Arbor AI Fills in the Rest.
Arbor AI drafts records, suggests controls and evidence, and maps them to your frameworks. You review and approve every suggestion.
Try Arbor AI for Information SecurityShaped Around How You Work
Your fields, your workflows, your risk matrix and your organisation structure.
Frequently Asked Questions
Can We Assess ISO 27001 and UAE IA Together?
Yes. Controls are mapped across both, so evidence and scores are shared and you do the work once.
Can We Import Our Existing SoA or Gap Assessment?
Yes. Use the Excel template and Arbor checks every row before it loads.
Does Arbor Produce a UAE IA Compliance Report?
Yes. Assessment audits produce a scored compliance report laid out for submission.
Works Even Better Together
ERMEnterprise Risk
One register for your strategic, operational, financial, reputational, legal and environmental risks, with third-party risk management built in.
PRIVACYPrivacy
Keep your records of processing current, answer data subject requests on time, and run DPIAs, consent and breach handling against UAE PDPL, ISO 27701 and GDPR..
BCMSBusiness Continuity
Profile your departments, run the business impact analysis, build recovery plans and test them.
See Arbor GRC with Your Own Frameworks
Bring your current risk register. We can import it from Excel during the demo, so you see your own risks in Arbor, not ours.