Offices in Dubai International Financial Centre run on confidentiality and uptime: client data that must not leak, regulators and clients who ask for evidence of controls, and no tolerance for a morning without email. Listonics supports DIFC firms with a security-first setup and documented IT. National guidance for UAE organisations is published by the UAE Telecommunications and Digital Government Regulatory Authority.
What DIFC firms are actually asked to prove
DIFC is a financial free zone with its own civil and commercial law, its own courts and its own regulator. That changes the IT question. Elsewhere a company asks whether its systems work; in DIFC it also has to show how they work, to whom access was granted, and when that access was taken away. The technology is ordinary Microsoft 365 and networking, the difference is that every control has to leave a record.
The practical consequence is that IT here is driven by paperwork you did not write. Prospective clients send security questionnaires before they will share a file. Insurers ask what protects the mailboxes. Auditors ask who approved an account. If nobody owns the answers, a partner ends up writing them from memory the week they are due, which is how wrong answers get sent.
The buildings add their own rules. Gate District, Gate Avenue and the surrounding towers have managed landlord infrastructure, controlled risers and access procedures for contractors. Cabling and comms-room work is booked with building management rather than simply turned up for, and out-of-hours access needs arranging in advance. We plan around that instead of discovering it on the day.
Retention is the control DIFC firms most often leave at its default, and it is the one that produces the awkward conversation. Financial and professional firms are expected to hold records for years and produce them on request, but a mailbox or a document library left on standard settings quietly disposes of items on its own schedule, and a departed employee's account can take a body of correspondence with it. Microsoft's guidance on how retention works sets out the mechanism; the work is deciding the period per record type and then configuring it, rather than assuming the platform already does it.
What a DIFC office needs in place
- Microsoft 365 hardening: MFA, conditional access, data-loss prevention and audit logging.
- Access management with a joiner/leaver process and quarterly access reviews.
- Documented network, assets and controls, evidence ready for client and insurer questionnaires.
- Encrypted, tested backups of mailboxes and files with immutable copies.
- Business-hours on-site response across the DIFC towers and Gate district, 24/7 remote line.
Where DIFC firms get caught out
- A questionnaire from a client or insurer with a two-week deadline and nobody who can answer the access-control questions.
- Multi-factor authentication switched on for some staff and quietly skipped for the partners who travel most.
- Leavers whose mailboxes still work months later because offboarding was a verbal request, not a process.
- Shared logins for a portal or a trading system, so nothing in the logs shows who actually did anything.
- Backups that run but have never been restored, which means nobody knows whether they would work.
- Retention left at platform defaults, so correspondence a regulator or client could ask for ages out without anyone deciding that it should.
How we work with DIFC offices
Work in DIFC usually begins with a review rather than a purchase order: we walk the existing setup, list the assets and record who holds which access. From that we agree a joiner and leaver process and a written security baseline a client or an insurer can read without translation. Riser and comms-room work is booked with building management in advance and scheduled outside trading hours. Projects carry a fixed scope, support carries a fixed monthly fee, and the documentation stays yours.
What a DIFC engagement costs
Most DIFC engagements start with a documentation and access review rather than new equipment, because the gap is usually evidence rather than hardware. That produces an asset list, a joiner/leaver process and a written record of security settings you can hand to a client or an insurer. Where work is needed, projects are quoted as a fixed scope, Listonics projects run from AED 2,500 to AED 30,000 depending on requirement, and ongoing support is a fixed monthly fee with response times in the agreement. See what IT support costs in Dubai for how the monthly side is structured.
Running an office in DIFC? Read our in-depth guide: IT Security for DIFC Firms: Protecting Client Data and Proving Your Controls (12 min read).
Frequently asked questions
Yes, the documentation and control reports we maintain are designed to answer client, auditor and insurer questionnaires.
Yes; most installation and maintenance is scheduled outside trading hours to avoid disruption.
You remain accountable; we do the work and give you the evidence. Practically, we run the controls, keep the documentation current and answer the technical parts of questionnaires. Decisions that carry business risk, such as who should have access to what, stay with your partners, because only you can make them.
Yes, and it is usually faster. We provide the technical detail, access lists, security settings, backup and retention configuration, in the format they ask for, so your team is not relaying questions between two sets of specialists and losing detail in the middle.
Quarterly, we produce a list of every account, what it can reach, and when it was last used. You confirm or revoke. Dormant accounts and old shared logins are the two things these reviews reliably catch, and both are what a regulator or insurer asks about first.
The period depends on your regulator and your client contracts rather than on the software, so it is a decision before it is a configuration. Microsoft 365 can then hold items for a defined period, prevent deletion, and preserve a leaver's mailbox after the licence is removed. What it will not do is guess the right period for you, which is why the default settings are rarely what a regulated firm needs.
Written by Srinivasan Ramachandran, Founder, Listonics · Last reviewed October 24, 2026