Dubai · UAE

A fractional CISO for UAE companies

Security leadership without a full-time hire, for companies in the UAE that face a regulator, an audit or enterprise buyers and have no one to own security. Our CEO, Zeeshan Sultan, leads the engagement.

Talk to us → How the engagement runs

Who leads the work?

Zeeshan Sultan, Cyphlon's CEO, backed by an advisory board of practitioners from banking, healthcare and govtech. Cyphlon is a sole proprietorship registered in the Dubai International Financial Centre (DIFC). CISSP, CISM and CCSP, held across our team.

Which UAE regulations will your programme answer to?

The ones that apply to your business, and we map the programme to them during discovery. These are the main UAE regulators and laws, and the organisations each applies to.

Dubai Electronic Security Center (DESC) Information Security Regulation
Dubai government entities.
UAE Information Assurance Regulation
Federal and local government entities, and organisations designated as critical infrastructure.
Central Bank of the UAE (CBUAE)
Banks and other financial institutions licensed by the Central Bank.
Dubai Financial Services Authority (DFSA)
Financial services firms authorised in the DIFC.
Financial Services Regulatory Authority (FSRA)
Financial services firms authorised in Abu Dhabi Global Market (ADGM).
Virtual Assets Regulatory Authority (VARA)
Virtual asset service providers licensed in Dubai.
Dubai Health Authority (DHA) and ADHICS
Healthcare facilities licensed in Dubai, and organisations handling health information in Abu Dhabi (ADHICS).
UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021)
Organisations processing personal data in the UAE, except where a free zone or sector has its own data protection law, as the DIFC and ADGM do.
DIFC Data Protection Law 2020
Organisations processing personal data in or from the DIFC.

Some regulators require an approved or accredited provider. Check your requirement; we will tell you at scoping if we are not eligible.

What does a fractional CISO do?

The same work as a full-time CISO, for the time your company needs: strategy, policy, audits, customer questions and reporting to the board.

Scope: Incident response here means planning and rehearsal. We don't offer an incident response retainer.

What's included

  • Security strategy, roadmap and risk register
  • Policies, controls and audit coordination
  • Answers to customer security questionnaires
  • Incident response planning and tabletop exercises
  • Executive and board reporting

How does it start?

With discovery, then a roadmap, then the policies and controls, then ongoing leadership.

  1. 01

    Discovery

    We talk to your leadership and engineers, review what you already have, and list the regulators, audits and customer commitments you face.

  2. 02

    Roadmap

    We write the risk register and a roadmap that maps your obligations to controls, in an order you can fund.

  3. 03

    Policies and controls

    We draft the policies your regulators and auditors expect and work with your team on the controls behind them.

  4. 04

    Ongoing leadership

    We coordinate audits, answer customer questionnaires, plan and rehearse incident response, and report to leadership and the board.

How is it priced?

You get a fixed quote after a scoping call, based on what your programme needs. The quote arrives in a written proposal before any work starts.

Book a call

Book a 30-minute call

Pick a time that suits you. We'll talk through what you're building and where your security stands, then suggest where to start.

Cyphlon

1:1 Consultation Call

30 min Google Meet

An introductory call with our engineers about any engagement: a pentest, continuous testing, managed AppSec, security engineering, agentic AI security or a fractional CISO. We'll ask about your stack, your deadlines and what your customers or auditors expect, and tell you plainly if we're not the right fit.

Or open the booking page on Calendly