Integrated technology where failure carries consequences.

Work on assets that cannot stop is governed less by the technology than by the permission to touch it. A change to a live system is assessed and approved before equipment is opened, the working window is fixed in advance, often inside a planned shutdown, and designers are expected to show what happens if the change fails and how the site returns to its previous state before the work is authorised. Resilience is then assessed on demonstrated behaviour rather than design intent, because one shared cable route can undo a nominally redundant design.

The control expectations are written nationally. The UAE Information Assurance Standard sets a control set for entities in critical sectors, with controls prioritised so an operator can show which apply and why, and it reaches suppliers through contract rather than by direct application. Dubai government entities and their suppliers additionally work to the Information Security Regulation issued by the Dubai Electronic Security Center. IEC 62443 provides the zones and conduits model for partitioning the industrial control environment. At handover the operator inherits the asset, so the record set and test evidence carry as much weight as the installation.