AE/SCNS/NCEMA 7000:2021, the UAE's national business continuity standard, applies to all UAE entities and related bodies, and its 2021 third edition is still current. Between 2021 and March 2025, Abu Dhabi's crisis management centre audited 93 entities against it, and 89 met the compliance requirements.
This guide is for business continuity, risk and compliance managers in UAE government entities, government-owned companies and the private firms that supply them.
Which edition of NCEMA 7000 is current?
The National Emergency Crisis and Disaster Management Authority (NCEMA), which works under the Supreme Council for National Security, owns the standard. The 2021 document is its third version. The first, AE/HSC/7000:2012, was issued in Arabic. The second was AE/SCNS/NCEMA 7000:2015.
Search results still mix the editions. A copy of the superseded 2015 edition, hosted by the Mohammed bin Rashid School of Government, ranks for 2021 searches. Check the cover. The current title is "The National Standard for Business Continuity Management System (Specifications)", while the 2015 edition was called "Business Continuity Management Standard (Specifications)".
NCEMA's Publications page, in a web archive capture of 21 May 2024, offered the 2021 PDF. No later edition turned up when this guide was checked in October 2026. The standard prints no effective date or transition period. The copy most readers can open is the 2021 standard hosted by ENEC, which is identical to the file NCEMA published.
Who must comply, and what is the legal basis?
Section 1.6 says the standard applies to all UAE entities and related bodies, including organisations that perform the functions of principal government institutions and community services. Section 1.2 adds that the requirements suit any organisation, whatever its type or size.
The legal hook is Article 19, "Ensuring Business Continuity", of Federal Decree-Law 2 of 2011, which set up NCEMA. It requires all parties and the private sector to develop business continuity plans that keep basic services running in an emergency, crisis or disaster, to the standards NCEMA adopts. The wording here follows NCEMA's English translation of the law, archived on 29 October 2021.
The 2011 law is still in force as amended. Federal Decree-Law 35 of 2024 set up a Civil Defence Authority within NCEMA. Federal Decree-Law 8 of 2025, in force since 1 January 2026, repealed it and created the Federal Authority for Ambulance and Civil Defense instead. Both cite the 2011 law "as amended", and neither changes the business continuity standard.
NCEMA describes itself as the standard's "exporter and legislator" and monitors implementation at federal and local level. Its implementation chart links the private sector to both federal and local entities. One national BCMS objective is the security of supply chains needed for essential operations. A private firm that supplies a government entity should therefore expect continuity questions from its client, although no supplier audit programme is published.
Who audits NCEMA 7000, and what do the results show?
In Abu Dhabi, the Emergencies, Crises and Disasters Management Centre (ADCMC) audits entities against the 2021 edition. Its release of 12 March 2025 reports 93 entities audited since 2021. They were 90 government entities and companies and 3 private-sector organisations, and 89 met the compliance requirements.
An ADCMC representative led each audit team, which included ADCMC staff and an NCEMA representative. The results feed a local strategic indicator, "Entities' Compliance percentage to Business Continuity Standard". The release names no entities, findings or sanctions, and it does not say how many failed.
No equivalent published audit programme was found for Dubai or the other emirates.
What changed from the 2015 edition?
NCEMA's Preface says the update simplified the text, added local requirements from stakeholder feedback and aligned with international BCMS requirements. It also separates management system requirements (Clauses 3 to 7, 9 and 10) from BCMS operations (Clause 8). Side by side, the two texts differ here.
| Topic | 2015 edition | 2021 edition |
|---|---|---|
| Structure | 11 sections: programme review 9, management review 10, improvement 11 | 10 clauses: review and evaluation 9 (management review 9.3), improvement 10 |
| References | ISO 22301:2012, ISO 31000:2009, BS 25999-1, NFPA 1600, AS/NZS 5050 and SS 540 | ISO 22301:2019 and ISO 31000:2018 only |
| Internal audit | Complete annual internal audit of all requirements (9.3.1) | Planned intervals set by your context (9.2) |
| BIA outputs | RTO and Maximum Acceptable Outage (MAO) for each activity (8.1) | RTO within the time impacts become unacceptable, plus resumption capacity (8.2) |
| Response plans | Incident response plan, BCP and media response plan (8.4 to 8.6) | One response structure that must cover six minimum areas, whatever the plans are called (8.5.2) |
| Performance | Annual BCM review (9.1) | 16 minimum performance indicators, a to p (9.1.2) |
Only the "shall" requirements decide conformance. The guidance under each clause explains them but adds no obligation.
The common transition trap is a system still built the 2015 way, with three separately titled plans and an annual BCM review. The 2021 edition expects the six response areas, a Clause 4.3 risk statement with risk criteria, the 16 indicators and audit intervals justified by your context.
What do NCEMA auditors ask to see?
Clause 7.3 lists the minimum documented information. It covers roles, context and risk attitude (Clauses 3 and 4), policy and support (5 and 6), the BIA through exercise records (8.1 to 8.6), and monitoring through corrective action (9.1 to 10.2). A missing item is an easy finding. An NCEMA or ADCMC auditor can also trace these points to the text.
- A signed risk appetite and risk criteria statement under Clause 4.3. Strategy selection in 8.4.2 depends on it.
- BIA records (8.2) showing impact timeframes, recovery time objectives (RTOs), the capacity at which each activity resumes and its dependencies, in a form top management can use to decide.
- An evaluation of any single external provider that a prioritised activity depends on.
- Strategies, signed off by top management, that resume activities at agreed capacity within the RTO (8.4).
- A response structure covering command and control, detection and immediate response, communication, technology recovery, resumption and return to normal (8.5.2).
- Life safety first, with evacuation procedures, assembly points, first aid and a way to locate people under your control, visitors included (8.5.3.2), plus approved media templates (8.5.3.3).
- An exercise plan, exercises at planned intervals and after significant change, and post-exercise reports (8.6).
- The 16 performance indicators in Clause 9.1.2, measured. They include a completed and approved BIA, internal audit coverage and a management review held within the past year.
- An internal audit programme with intervals justified by context, run by a competent, impartial auditor, internal or external (9.2).
- Management review records at least once a year, covering the 9.3.1 inputs.
Exercises need not cover everything at once. The guidance allows a programme spread over several years, starting with team walk-throughs.
Does ISO 22301 cover NCEMA 7000?
Not automatically. NCEMA used ISO 22301:2019 and ISO 31000:2018 as references and says its requirements are consistent with them, but ADCMC audits against NCEMA 7000:2021 itself. The structure differs too. In NCEMA 7000, Clause 2 holds the definitions and Clause 3 is the governance framework, so clause numbers do not line up one-to-one with ISO 22301.
Your evidence therefore has to trace to NCEMA's clauses, its Clause 7.3 list and its 16 indicators. Some organisations run both standards. The Sharjah Chamber of Commerce and Industry, for example, reports a BCMS policy that applies ISO 22301:2019 and NCEMA 7000:2021 together.
ISO 22301:2019 now stands with Amendment 1:2024, and a new edition is at committee draft stage. Our ISO 22301 guide covers the international standard. For the risk side, see our guide to ISO 31000 and IEC 31010. ISO 22316 covers wider organisational resilience.
How AGS can help
The UAE Business Continuity Management System (AE/SCNS/NCEMA 7000:2021) holds 90 editable Microsoft Word documents. They include a master document index and compliance matrix covering Clauses 3 to 10, a BCMS manual, 24 procedures and 40 forms. Among them are a risk appetite and risk criteria statement and a monitoring procedure built on the 16 Clause 9.1.2 indicators. It does not contain the NCEMA standard, Arabic text or an ISO 22301 cross-walk.
Frequently asked questions
Can we get certification against NCEMA 7000:2021?
The standard says you can assess compliance by self-assessment or by external audit to seek certification. It names no certification body or scheme.
Is there a fine for not meeting NCEMA 7000?
The 2011 law sets no specific penalty for failing to conform to the standard. Its Article 40 penalties, up to six months in prison and a fine of at least AED 100,000, apply to acts during emergencies, crises and disasters, such as intentionally refusing instructions.
Does the Arabic or English version prevail?
For the standard, the English version prevails where the two differ (Section 1.1).
What if a regulator's rule conflicts with NCEMA 7000?
You must also meet extra requirements set by legislative, licensing and regulatory bodies (Section 1.8). Where one conflicts with the standard, you refer the conflict to NCEMA to settle.
AGS provides independent documentation toolkits. This guide and the referenced kit are not affiliated with, endorsed by or approved by NCEMA, the Supreme Council for National Security or ADCMC. It is general information, not legal advice. How the standard applies depends on your entity, its regulators and the authority that audits it.
Reviewed October 2026. Facts checked against the sources current at publication.
