Oil and gas firms in Dubai are usually service companies, EPC contractors or regional offices rather than operators. Their IT problem is passing client audits, moving large engineering files, running a yard alongside an office, and respecting the boundary with operational technology. Listonics builds the office side at a fixed scope from AED 2,500 to AED 30,000 depending on requirement.
Your client's security questionnaire is the real specification
Most Dubai oil and gas businesses do not set their own security bar. It is set by whoever they supply. A national oil company, a major operator or a tier-one EPC sends a vendor questionnaire before a contract, and that document decides what you must be able to evidence. It typically asks about access control, patching, backup and incident response, and it asks for proof rather than assurance.
That makes the work predictable, which is useful. Build the controls those questionnaires ask about, document them as you go, and the next tender becomes an afternoon rather than a fortnight. Firms that treat each questionnaire as a fresh exercise spend the same effort repeatedly and answer inconsistently, which auditors notice. Our cyber security audit produces that evidence folder as a deliverable.
Engineering data is heavy, and losing it is unrecoverable
Pipeline alignment sheets, P&IDs, isometrics, inspection reports, survey data and as-built packages are large, long-lived and frequently the only record of what was actually built. Unlike office documents they cannot be recreated from memory, and they often carry contractual weight years after the project closed.
The arrangement that works is local network storage for working speed, a cloud copy for survivability and sharing, versioning so a superseded revision is recoverable, and retention set against your contractual obligations rather than against disk space. Our cloud storage for business page covers the structure, and business backup services covers the copy that has actually been restored from.
- Network storage on site for the speed engineers need on large files.
- A cloud copy that survives the office, with sharing that expires.
- Versioning, so a superseded drawing revision can still be produced.
- Retention matched to contract and warranty periods, not to available space.
The yard is not an office
Many Dubai oil and gas firms run a yard, workshop or fabrication shop alongside the commercial office, often in Jebel Ali, Al Quoz or one of the industrial areas. The conditions are entirely different: heat, dust, metal structures that block wireless, machinery that generates electrical noise, and power that is less clean than an office tower's.
Equipment specified for an office fails early in that environment. Cabinets need ventilation and dust protection, power needs protection against cuts and surges, and wireless coverage has to be surveyed with the racking and machinery in place rather than designed from a plan. Our Al Quoz page covers the warehouse and workshop conditions in more detail.
Where IT ends and operational technology begins
The boundary between IT and operational technology matters more in energy than in almost any other sector, and being honest about it is part of the job. Control systems, SCADA, safety instrumented systems and anything on a plant or rig are operational technology. They are engineered, certified and maintained by specialist vendors under their own standards, principally the ISA/IEC 62443 series, and general office IT has no business making changes to them.
What an office IT provider can properly do is three things. Keep the business network entirely separate from anything operational, so an office compromise cannot reach a control system. Coordinate with the OT vendor when the two share physical infrastructure. And make sure the boundary is documented, because an auditor will ask where it sits. NIST Special Publication 800-82 and CISA's industrial control systems guidance are the references we work to when advising on that separation.
We say plainly what we do not do. Listonics does not configure, patch or secure control systems. Where a client needs that, they need an OT specialist, and we will say so rather than taking the work.
Mobile teams, remote sites and the people who travel
Oil and gas staff travel: to client sites, to offshore facilities, to a yard in another emirate, to a plant in another country. Their laptops leave the office and connect to networks nobody controls, which makes device security more important than office network security for this sector.
That means encryption on every laptop as standard, so a device left in a taxi is a lost asset rather than a disclosure. It means multi-factor authentication with no exception for senior people who travel most. And it means access that follows identity rather than location, so working from a client site is not a reason to weaken anything. Our cybersecurity service covers the baseline.
Regional offices reporting to a parent
A large share of Dubai energy businesses are regional offices of an international parent, which introduces a specific tension: the parent has group IT policy and often group systems, but the Dubai office needs local support, local procurement and someone who can attend site. Neither running entirely on group IT nor running entirely independently works well.
The workable arrangement is a documented split: the parent owns identity, core applications and policy, and the local provider owns the office network, devices, the yard and day-to-day support, working within the group standard. We have done this often enough to know that the failure mode is an undocumented split where both sides assume the other is handling something. We write it down at the start.
Where the UAE entity has its own regulatory reporting, the federal picture runs through the Ministry of Energy and Infrastructure, and the national operator most firms supply is ADNOC, whose vendor requirements often set the practical standard.
How an oil and gas engagement runs
A survey of the office and any yard or workshop, a review of the client questionnaires you already have to answer, and a conversation about where the OT boundary sits. That produces a fixed-scope proposal covering the network at each site, engineering file storage and backup, the security baseline with its evidence, device management for travelling staff, and the documented split with any parent company. Listonics projects run from AED 2,500 to AED 30,000 depending on requirement.
Support is a fixed monthly fee with response times written down. The deliverable that matters most in this sector is the documentation, because it doubles as the answer to the next vendor audit.
Frequently asked questions
No, and we will say so rather than take the work. Control systems, SCADA and safety instrumented systems are operational technology, engineered and certified by specialist vendors under standards such as ISA/IEC 62443. What we do is keep the business network properly separate from anything operational, coordinate with the OT vendor where infrastructure is shared, and document the boundary for auditors.
Yes, and it is the most common reason energy suppliers call us. We complete the technical sections in the format the client requires and tell you plainly where the honest answer is currently weak, so you can fix it before replying rather than discover it during an audit. The usual gaps are access reviews, patching evidence and backup testing.
It is common and it is avoidable. Office-grade installation in a yard or workshop fails early because of heat, dust and unclean power. Proper cabinets with ventilation and dust protection, power protection against cuts and surges, and wireless surveyed with the machinery in place will change the failure rate substantially.
With a documented split. The parent typically owns identity, core applications and policy; the local provider owns the office network, devices, the yard and daily support, working inside the group standard. The failure we see most is an undocumented split where both sides assume the other handles backup or patching, so we write it down before starting.
Encryption on every device as standard, multi-factor authentication with no exemption for senior staff, and access tied to identity rather than location. For a sector where staff routinely connect from client sites and hotels, device security matters more than office network security, because the device is the thing that leaves.
It is quoted as a fixed scope after a free survey of the office and any yard. Listonics projects run from AED 2,500 to AED 30,000 depending on requirement, with the number of sites, engineering storage volume and the evidence work moving the figure most. Support is then a fixed monthly fee with written response times.
Written by Srinivasan Ramachandran, Founder, Listonics · Last reviewed October 8, 2026