Identity, Access & Authentication
A.5.16, A.5.17, A.6.7, A.8.5 — Entra ID, MFA, Conditional Access, password policy, privileged access, FortiGate VPN. Foundation of ISO 27001 technical control layer.
ISO 27001 Technical Layer · Honest Scope
ISO 27001 Technical Controls — Honest Scope for Abu Dhabi Organisations
Emirtech Technology delivers the ISO/IEC 27001 Annex A technical control layer — endpoint security, network segmentation, MFA, encryption, logging, backup, vulnerability management. We are not an ISO-certified consultancy, not a certification body, not an ISO/IEC 27001 lead-implementer firm.
Get a free site survey Talk to a specialist
ADMCC Approved
Control4 installer
Since 2018
Honest Scope
In short: This page covers the technical controls that support ISO 27001 for Abu Dhabi organisations, with honest scope. Emirtech is not a certification body or auditor and holds no ISO 27001 certificate for managed security services; confirm certification with an accredited body. A site survey or assessment comes first, then a written itemised quotation.
ISO 27001 technical controls: key facts
| Who provides it? | Emirtech Technology, based at M44, Mussafah Industrial Area, Abu Dhabi, in operation since 2018. The work is carried out by Emirtech's own engineers. |
|---|---|
| Where? | Abu Dhabi and Al Ain, served from Emirtech's Mussafah, Abu Dhabi base; there is no Al Ain office. In Dubai: smart home, PABX and IP-PBX phone systems, IT AMC and time attendance by scheduled on-site visits, gate barriers, ANPR, video intercoms and turnstiles by Emirtech itself; CCTV, alarm and access control through SIRA-approved partners, with Emirtech coordinating. |
| What is covered | The technical controls that support an ISO 27001 programme. |
| Survey and quotation | Emirtech publishes no price list: it surveys or assesses first and then gives a written, itemised quotation. |
| Credentials | Emirtech is an independent systems integrator. It holds no manufacturer-level credential of its own, and its ADMCC approval covers security systems only, not IT services. |
| Please note | General information, not legal, audit or certification advice. Emirtech is not an auditor, certification body or legal adviser; confirm the standard or regulation with the relevant authority, auditor or adviser. |
| Last reviewed | 21 October 2026 |
What does ISO 27001 actually require, and what does Emirtech honestly deliver?
ISO/IEC 27001:2022 is the international standard for Information Security Management Systems (ISMS) — combining a management-system framework (Clauses 4-10) with 93 reference controls in Annex A (organisational, people, physical and technological). For an organisation to be ISO 27001 certified, an accredited certification body must audit and certify the ISMS. Emirtech does not provide ISO 27001 certification consultancy, ISMS implementation, lead-implementer services or certification audit support. We deliver the technical-control layer from Annex A — the underlying technology controls that many Annex A items require: A.5.16 Identity management (Entra ID, MFA, Conditional Access); A.5.17 Authentication information (MFA, password policy, privileged access); A.6.7 Remote working (FortiGate VPN, encryption); A.7.4 Physical security monitoring (ADMCC-approved CCTV); A.8.5 Secure authentication (MFA); A.8.7 Protection against malware (EDR — Defender for Business, Sophos, SentinelOne); A.8.8 Management of technical vulnerabilities (vulnerability scanning, patch management); A.8.9 Configuration management (Intune, baseline configurations); A.8.10 Information deletion (secure erasure, retention policies); A.8.11 Data masking (sensitivity labels); A.8.12 Data leakage prevention (Defender for Office 365, sensitivity labels); A.8.13 Information backup (3-2-1 backup with off-site copies); A.8.14 Redundancy of information processing facilities (HA / DR); A.8.15 Logging (Microsoft Sentinel, Wazuh, Elastic SIEM); A.8.16 Monitoring activities (SIEM monitoring, EDR alerting); A.8.20 Networks security (FortiGate, VLAN segmentation, network access control); A.8.21 Security of network services (secure protocols, firewall rules); A.8.23 Web filtering (FortiGate web filter, DNS filtering); A.8.24 Use of cryptography (BitLocker, TLS, encryption at rest); A.8.26 Application security requirements (secure baselines on application servers). The management-system layer — risk assessment, Statement of Applicability, internal audit, management review, ISMS documentation, certification body engagement — must be delivered by a qualified ISO 27001 consultancy or by the customer's own ISMS team. Emirtech is an honest technology implementation vendor — we deliver what we deliver, we do not pretend to deliver what we do not.
Annex A technical controls we deliver
Technical control areas
Endpoint & Vulnerability
A.8.7, A.8.8, A.8.9 — EDR (Defender for Business, Sophos, SentinelOne), vulnerability scanning, patch management, Intune configuration baselines.
Backup, Logging & Monitoring
A.8.13, A.8.14, A.8.15, A.8.16 — 3-2-1 backup with off-site copies, HA/DR, Microsoft Sentinel / Wazuh / Elastic SIEM, monitoring activities.
Network, Cryptography & Web
A.8.20, A.8.21, A.8.23, A.8.24 — FortiGate / Sophos firewall, VLAN segmentation, secure protocols, web filtering, BitLocker, TLS, encryption at rest.
What we explicitly do NOT do — and why being clear matters
ISO 27001 capability is easy to claim and hard to evidence. Emirtech is explicit about scope so customers know exactly what they are buying. Call +971 55 651 7843 or discuss ISO 27001 technical controls.
- We do NOT provide ISO 27001 certification consultancy
- We do NOT provide ISMS implementation
- We do NOT provide ISO 27001 lead implementer / lead auditor services
- We do NOT provide Statement of Applicability authoring
- We do NOT provide certification body audit services
- We do NOT provide ISO 27001 internal audit
- We do NOT provide ISMS documentation authoring
- We do NOT hold ISO 27001 certification ourselves
- We DO deliver the Annex A technical control layer
- We DO integrate with the customer's ISO consultancy / ISMS team
How we work alongside an ISO consultancy
Working alongside ISO consultancy
Customer engages ISO consultancy
Customer engages a qualified ISO 27001 consultancy or builds internal ISMS team for the management-system layer — risk assessment, Statement of Applicability, ISMS documentation, internal audit, management review.
Emirtech delivers Annex A technical layer
Emirtech delivers the Annex A technical control layer mapped to the customer's Statement of Applicability — endpoint security, MFA, encryption, logging, backup, vulnerability management.
Joint workshops & evidence handover
Joint workshops with the customer's ISO consultancy to align scope; evidence handover (configuration screenshots, policy documents, log samples) for certification audit evidence.
Certification body engagement
Certification body audit handled by the customer and ISO consultancy. Emirtech supports during technical evidence sessions where requested.
What our customers honestly need to know
Plain-English summary:
- Emirtech is not an ISO 27001 certified consultancy — we do not hold ISO 27001 lead-implementer or lead-auditor accreditation.
- Emirtech is not a certification body — only accredited certification bodies (DNV, BSI, TÜV SÜD, Bureau Veritas, others) can certify an ISMS.
- Emirtech does not author Statements of Applicability, ISMS policies or ISO 27001 documentation — these are the customer's ISO consultancy / ISMS team scope.
- Emirtech delivers the underlying technical controls that many Annex A items require — MFA, EDR, SIEM, backup, encryption, network segmentation, vulnerability management.
- Many customers approach ISO 27001 in two parallel workstreams — ISO consultancy delivering the management layer, Emirtech delivering the technical layer, joint workshops for alignment.
- We are not affiliated with: DNV, BSI, TÜV SÜD, Bureau Veritas, ISACA, IRCA, Exemplar Global, PECB or any ISO certification body / accreditation body unless explicitly on record.
- This is the honest path — customers know what they are buying. No false claims of certified scope. No oversold "ISO 27001-ready in 30 days" promises.
Pairs with our ADHICS Technical Controls and PDPL Technical Readiness pages — the same honest-positioning approach applied to UAE-specific frameworks.
Common questions
FAQs
Are you ISO 27001 certified?
No. Emirtech is not ISO 27001 certified as an organisation — and we do not claim to be. The companies that legitimately hold ISO 27001 certification have been audited by accredited certification bodies (DNV, BSI, TÜV SÜD, Bureau Veritas, others) against their ISMS. We deliver the technical control layer; we do not hold the certification.
Can you make our organisation ISO 27001 certified?
No. ISO 27001 certification requires (a) implementing an ISMS — typically with help of a qualified ISO 27001 consultancy or internal ISMS team — and (b) being audited by an accredited certification body. Emirtech delivers the technical control layer (MFA, EDR, SIEM, backup, encryption, network segmentation) that many Annex A items require, but we are not the consultancy or the certification body.
Who should we engage for ISO 27001 certification consultancy?
We recommend customers engage an ISO 27001 lead-implementer / lead-auditor consultancy with verifiable accreditation (PECB, IRCA, Exemplar Global). We can work alongside that consultancy on the technical layer. We do not maintain a recommended consultancy list — customers should verify accreditation directly.
What does the "honest scope" approach mean practically?
It means: when you ask "are you ISO certified?" we say no. When you ask "can you deliver Annex A technical controls?" we list exactly what we deliver. When you ask "can you produce the Statement of Applicability?" we say that is the ISO consultancy's scope. When you ask "will you support the certification audit?" we say yes for the technical evidence sessions, but the audit is run by the certification body and your consultancy.
How does ISO 27001 relate to UAE frameworks like NESA, ADHICS, PDPL?
ISO 27001 is international. NESA (the former National Electronic Security Authority, renamed the Signals Intelligence Agency — its standards apply to relevant entities in the UAE), ADHICS (DoH Abu Dhabi healthcare), PDPL (UAE Personal Data Protection Law) are UAE-specific. There is significant control overlap — many Annex A controls map to ADHICS and PDPL technical requirements. Emirtech delivers the technical layer underlying all of them; we do not provide certification consultancy on any of them.
How do I get a quote for ISO 27001 technical control implementation?
Call +971 55 651 7843 or request a free technical-layer consultation. Share your ISMS scope, current technical posture and ISO consultancy contact if engaged. A specialist will reply the same working day, and a scoped technical proposal — explicitly mapped to Annex A — follows the consultation.
ISO 27001 Technical Layer · Honest Scope
Talk to an Abu Dhabi specialist
Free site survey · transparent scope · honest costs · ADMCC-approved for security systems · Mussafah M44 home base since 2018.
Need a free Abu Dhabi site visit? Call +971 55 651 7843 or email [email protected] — we reply the same working day across Abu Dhabi and Al Ain.