Qatar National Information Assurance Policy

Who it applies to

Government entities and organisations in designated sectors within the State of Qatar, and their suppliers where applied contractually.

What it requires

• Information classification, which drives the control depth expected
• Controls implemented according to that classification
• Risk management and periodic assessment
• Incident reporting to the national authority

What preparing for it involves

Classification comes first and everything else follows from it. Organisations that begin with control implementation before classifying their information usually find they have protected the wrong things at the wrong depth.

How it concludes

Assessed compliance against the national policy.

SecureEdge Advisory prepares you and facilitates the process. The affirmation is made by an external auditor, a certification body or the regulator, never by us.

Cross-framework reuse

Control mappings for this framework are not yet published in the library. It is carried in full for assessment and preparation, and cross-framework reuse will follow as the mapping matures. We would rather state that plainly than imply reuse that does not exist.