UAE · DESC · Dubai Cyber Force · DIFC · ADGM

Dubai Cyber Force certified penetration testing, run end to end by Sumrite.

Dubai government entities buy penetration testing from providers certified under the Dubai Electronic Security Center’s Dubai Cyber Force programme. Sumrite runs the engagement and routes the certified step through its DESC certified partner.

Get a quoteAll accredited testing
DESC certified partnerThe certified provider step is issued through Sumrite’s UAE partner.
Mapped to UAE rulesDESC standards, DIFC, ADGM, CBUAE and the UAE PDPL.
One teamScoping, testing, fixes and retest stay with Sumrite.

The Dubai Cyber Force programme, run by the Dubai Electronic Security Center (DESC), certifies cybersecurity service providers, including for penetration testing, to work with Dubai government entities. Sumrite runs scoping, testing, remediation support and the retest, and where a DESC certified provider is required the formal step is issued through its certified partner in the UAE.

Who needs it

WhoWhen it applies
Dubai government entitiesPenetration testing bought from Dubai Cyber Force certified providers
Suppliers to Dubai governmentContracts that pass the certified-provider requirement down
DIFC and ADGM firmsRegulator expectations for independent security testing
Banks and insurersCBUAE and sector requirements for regular penetration testing

How Sumrite delivers it

Sumrite runs the engagement end to end: scoping, expert-led testing, remediation support and the retest. Where the scheme requires a specific accredited, empanelled, licensed or registered firm, the formal report or attestation is issued through a Sumrite partner firm that holds it, so you deal with one team throughout.

  1. Confirm the requirement. Dubai Cyber Force certification, CREST, or an independent test for DIFC, ADGM or CBUAE.
  2. Scope and NDA. Assets, environments and the reviewer’s format agreed first.
  3. Expert-led testing. Web, API, mobile, network and cloud testing with findings mapped to the UAE references you need.
  4. Certified step through our partner. Where a DESC certified provider must perform or issue the work, it comes through Sumrite’s partner.
  5. Report and retest. Fixes retested and the report updated.
RegionVAPT in Dubai and the UAEDIFC, ADGM, CBUAE and UAE PDPL testing.FrameworkDIFC and ADGMData protection and security evidence in the free zones.FrameworkUAE PDPLFederal data protection duties and the testing behind them.
IndiaCERT-In empanelled auditGovernment systems and websites, SEBI regulated entities, tenders that name CERT-InGlobalCREST accredited testingBanks, regulators, enterprise buyers and tenders that ask for CRESTSaudi ArabiaNCA licensed testingGovernment entities, critical national infrastructure and their suppliers

Frequently asked questions

What is Dubai Cyber Force?

A DESC programme that certifies cybersecurity service providers, including penetration testing providers, to serve Dubai government entities.

Can Sumrite deliver Dubai Cyber Force testing?

Yes. Sumrite runs the engagement end to end and routes the certified provider step through its DESC certified partner in the UAE.

Do private companies in the UAE need a DESC certified tester?

Usually only when they work for Dubai government entities or a contract names it. Otherwise an independent expert-led test, or CREST where asked, is the norm.

Accredited testing

All schemes and regionsCERT-In empanelled audit (India)CREST accredited testing (Global)NCA licensed testing (Saudi Arabia)

Need a test a regulator or buyer will accept?

Send the requirement and the deadline. NDA first, fixed-scope quote, one team end to end.

Get a Quote