How to Start a Cyber Risk Management Business in Dubai

How to Start a Cyber Risk Management Business in Dubai

A board asks for a number describing something that has not happened yet, and somebody has to produce one. That is the entire commission. Directors can delegate the work of measuring an exposure and they cannot delegate accepting it, so what they need is not a technician's opinion but a statement they can put their names to: here is what could go wrong, here is roughly what it would cost us, here is what we are choosing to live with and here is what we are paying to reduce. A firm in this line produces that statement on a schedule and defends it when it is challenged.

Cyber Risk Management Services, as the activity reads in the catalogue, is therefore not a repair business and the distinction is commercial rather than semantic. The work identifies exposures, scores them, ranks them against each other, puts an owner and a date on each one and reports what moved since last time. It does not install the firewall. A practice that drifts into doing both ends up assessing its own work, which destroys the only thing the engagement was bought for.

The demand is created by other people's questionnaires

The honest account of where this revenue comes from is not that clients woke up concerned. It is that somebody above the IT director is now being asked a question he cannot answer from memory. An insurer wants a description of the controls before it will quote. A large customer sends a supplier assessment before it will contract. A lender, a group parent or an incoming investor asks what the exposure looks like and expects something more durable than reassurance. Each of those is a third party creating demand that the client did not generate himself, which is why the work survives a cost-cutting year better than most technology spending.

That shapes the sale. The buyer is rarely the person who will do most of the talking in the first meeting. The person who signs is a board member, an audit committee chair, a chief financial officer or an owner — somebody whose exposure is personal and whose question is "what do I tell them" rather than "what should we buy". A practice pitching capability to the IT department is pitching to the wrong floor.

The fee is a retainer with a date on it, and that is the product

Pricing is a recurring fee tied to a reporting cadence: a full assessment at the outset, then a shorter cycle that updates the position and reports what changed. The deliverable is a document that arrives on a known date, which is unusually good for cash flow and unusually unforgiving, because an engagement whose value is a report has nowhere to hide if the report says nothing new.

The commercial risk sits exactly there. A practice that sends the same findings four times is teaching its client that the retainer buys paper. The way out is to make movement the subject — what closed, what was accepted and by whom, what is newly exposed because the business changed — so the report is about the client's year rather than about a methodology.

The failure that ends a practice, and the one that merely annoys everybody

The ending failure is an exposure that materialised and was not in the log. It does not matter that nobody could have known; the whole proposition was that somebody was looking.

The commoner failure is a log that only grows. Every exposure is recorded, nothing is ever closed, and after two years the client has a long document and the same posture he started with. That is a design fault in the reporting rather than in the analysis, and the fix is to insist that each item carries a named owner and a date, and that accepting an exposure is a decision somebody makes in writing rather than a default that happens by silence.

CZ 230 — Cyber Risk Management Services

What the line covers is the identification, assessment, ranking and continuing oversight of exposures arising from a client's systems, data, suppliers and people: building and maintaining the risk log, assessing third parties the client depends on, measuring against a recognised control framework, testing whether a stated control is actually in place, reporting to management and to the board, and supporting the client when an insurer, a customer or a supervisor asks for the position in writing.

The fourth row is the one that decides what kind of firm this becomes. Taking the repair work is the obvious way to grow an account and it quietly removes the independence that made the assessment worth commissioning. Firms that want both usually separate them — different teams, different engagement letters, and a client who was told plainly which hat is being worn.

The line next door is cyber security consultancy

CZ 231 is the adjacent activity and the two are routinely sold as one thing. The honest boundary is cadence and audience. Consultancy is bought at a decision point, runs to an end and reports to the person who will act on it: what architecture to choose, how to respond to an incident, how to design an access model. Risk management is bought because governance requires it, never finishes, and reports upward to people who will not implement anything themselves. The skills overlap almost entirely. The buyer, the rhythm and the definition of failure do not.

What attaches is not an approval, but who you may report to

The trade licence with the activity recorded on it comes from the economic department of the emirate, and for advisory work of this kind that is the ordinary extent of the licensing question. What constrains the practice is not a permit but the standing of what it puts its name to, and there are three edges worth knowing before a client assumes otherwise.

It is not insurance. Quantifying an exposure is not carrying it. Transferring risk to a balance sheet in exchange for a premium is a supervised business under its own regime, and a firm that scores a risk is describing something another party may then choose to underwrite.

It is not an audit opinion or a certification. A practice can measure a client against a recognised framework and say what it found. Attesting conformity in a form a third party relies on is a different standing, approved on its own terms, and auditors in the UAE are a matter for the Ministry of Economy rather than for a licensing department.

It does not move accountability. The client remains the party answerable for its own systems and for what it holds. A report is evidence that the question was asked properly; it is not a transfer of responsibility, and an engagement letter that implies otherwise is writing a liability the practice cannot carry.

Because the clients are UAE companies and the work is performed for their boards on UAE soil, a mainland licence is the ordinary route; a free zone licence can hold the activity and suits a practice serving companies inside its own zone or clients outside the country. What a given licence permits, and to whom it permits it, is settled by the authority issuing it rather than assumed from the activity name — and whether the line is cut as a professional or a commercial licence is the same kind of question, answered the same way.

What the licence costs to hold, which form it takes, what the premises must satisfy and what additional standing is needed for the parts of this work the line excludes all depend on the emirate and the licensing authority. ConsultZone establishes those for the specific practice before the application is made.

References

1. Ministry of Economy — auditors and company matters, which is the boundary this line sits against when a client asks for an opinion rather than a report. Ministry of Economy
2. Central Bank of the UAE — banking, payment services and financing, the sectors whose own supervision drives much of the demand for a measured and documented risk position. Central Bank of the UAE
3. UAE Government portal — federal law and national strategy, including the UAE's position on personal data, which is one of the exposures a programme has to score. UAE Government portal
4. Federal Tax Authority — VAT and corporate tax enrolment on recurring retainer income. Federal Tax Authority
5. Ministry of Human Resources and Emiratisation — work permits and labour contracts for analysts and assessors. MoHRE