How to Start a Managed Data and Cyber Security Business in Dubai

How to Start a Managed Data and Cyber Security Business in Dubai

There is a morning in every engagement of this kind when the credentials change hands. Before it, a provider is a supplier with opinions. After it, he can reach everything the client owns, change it, copy it or lose it, and whatever happens next happens on his watch. That single transfer is what separates this activity from every advisory line beside it in the catalogue, and almost all of the commercial character of the business follows from it — the pricing, the contracts, the insurance, the way staff are hired and the reason clients find it so difficult to leave.

Data Management & cyber security, as the line reads in the catalogue, is an operating responsibility rather than a recommendation. Nobody here delivers a report and walks away. The provider keeps an estate running, keeps the copies of it that will be needed when something goes wrong, watches what reaches it, and answers the telephone at the hour the client least wants to make that call.

What the activity covers, and why the two halves are sold together

What the line covers on the data side is the running of a client's information estate: storage and the arrangement of it, backup and the periodic proof that a backup actually restores, availability and failover, retention and disposal in line with whatever rules bind the client, access administration, and the reporting that shows all of it is being done. On the security side it is monitoring, patching and configuration control, identity and privilege administration, detection, and the first hours of a response when something is found.

They are one catalogue line because they are one job. A provider cannot sensibly be answerable for a company's information and indifferent to who can reach it, and the client who tried to split the two across two suppliers has created an argument about whose fault the next incident was. The practical consequence for a new provider is that the capability has to be built in both directions at once, which raises the cost of the first client considerably.

The absence of incidents is the service working and a weak argument at renewal

A quiet year is the product. It is also the reason a board two years in asks what the monthly fee is buying, because nothing it can see has happened. Providers who do not solve this lose accounts they served perfectly.

The answer is to report the work rather than the outcome: what was patched, what was blocked, how many access requests were handled, what the last restore test actually proved, and which three things the provider wants the client to fix and has been waiting for a decision on. A monthly page describing activity beats an annual page describing calm, and the list of outstanding client decisions is the single most valuable paragraph in it — it moves the record of unaddressed exposure from the provider's inbox to the client's minutes.

The buyer is deciding whether to hire two people instead

The signature belongs to a chief operating officer, an IT director or an owner, and the decision is not really a comparison between providers. It is a comparison with headcount. The alternative on the table is two or three salaried staff, their recruitment, their holidays, their resignations and the fact that one of them will be the only person who understands something important.

That framing is worth adopting openly in the sale, because it is the ground the provider wins on. A small internal team cannot cover nights and weekends, cannot hold specialist depth in several directions at once, and stops entirely when one person leaves. What it does offer is attention and loyalty, and a provider who pretends otherwise sounds like he has not understood the question.

Standardisation is the margin, and the first few clients decide whether there is any

The economics are the inverse of project consultancy. Revenue is recurring and predictable, the per-unit margin is thin, and the business only works if one toolset, one monitoring platform and one set of procedures serve many clients at once. Every client permitted to keep a different stack converts a scalable provider into a collection of bespoke jobs, each needing its own expert and its own documentation.

This is almost always decided badly in the first year, because the first clients are the ones a provider cannot afford to refuse. The discipline worth imposing early is a published list of what is supported, a migration offer for clients outside it, and a frankly higher price for anybody insisting on an exception — priced so that it pays for the exception rather than hiding it.

The last row is the one to read first. An on-site model is a staffing business wearing a managed-service name, and its margin is capped by what an hour can be billed at. A remote operations centre is the only one of the three where serving a tenth client costs materially less than serving the first, and the co-managed arrangement sits between them — defensible, and only as profitable as the written split of duties is clear.

What attaches to holding another company's keys

The trade licence with the activity recorded on it comes from the economic department of the emirate, and the licence is the simple part. What binds a provider in practice is the access, and four things attach to it that no permit will tell him about.

Accountability does not move with the credentials. The client remains the party answerable for its own information and for what it does with it. The provider is answerable for the service he contracted to deliver. Both are true at once, and the engagement letter is where they are separated — which is why the scope of privileged access, the change-control route, what may be done without asking and what must always be asked belong in the first draft.

The provider does not inherit the client's licence. Running the systems of a bank, a clinic or a school does not make a provider a supervised institution, and it confers no entitlement to do anything the client itself could not do. It cuts the other way too: where a client is supervised, its own obligations follow its information into the provider's hands, and the provider finds himself holding material governed by rules written for somebody else's industry. Those terms arrive through the client's contract rather than through the licence.

Round-the-clock cover is a labour arrangement before it is a technical one. A rostered operations desk means shift patterns, contracts and permits, and that is a federal labour matter rather than a licensing one.

The exit is part of the product. A client who cannot leave cheaply is a client who resents the renewal. Documented handover, the return and deletion of copies, and a stated notice period make the account more defensible rather than less, because the buyer who believes he can leave is the buyer who signs the longer term.

Because the clients are UAE companies whose estates and staff sit here, a mainland licence is the ordinary route; a free zone licence can hold the activity and suits a provider serving companies inside its own zone or clients abroad. What a given licence permits, and to whom, is settled by the authority issuing it rather than assumed from the activity name. What it costs to hold, which form it takes, what the premises must satisfy for an operations desk and what additional standing is needed for work this line excludes all depend on the emirate and the licensing authority. ConsultZone establishes those for the specific provider before anything is applied for.

The two advisory lines next door are worth naming, because clients ask one provider for all three. Cyber Risk Management, CZ 230, measures exposure and reports it upward without touching the controls. Cyber Security Consultancy, CZ 231, is commissioned at a decision point and ends with a document. This line runs the estate. A provider who holds the keys and also assesses his own work has collapsed the independence those other two are bought for, which is a reason to keep the engagements and the teams separate rather than a reason to decline the work.

References

1. UAE Government portal — federal law and national strategy, including the UAE's position on personal data held on a client's behalf. UAE Government portal
2. Central Bank of the UAE — banking and payment services, whose supervisory expectations follow a client's information into a provider's hands. Central Bank of the UAE
3. Dubai Health Authority — health facilities in Dubai, whose records carry sector conditions a managed provider inherits by contract. Dubai Health Authority
4. Ministry of Human Resources and Emiratisation — work permits, labour contracts and the shift arrangements a rostered operations desk requires. MoHRE
5. Federal Tax Authority — VAT and corporate tax enrolment on recurring per-seat revenue, and the records a taxable person must keep. Federal Tax Authority