ADHICS vs ISO 27001: Which Do You Need?
ADHICS is Abu Dhabi’s mandatory healthcare security standard, enforced through DoH licensure. ISO 27001 is the international standard for information security management, chosen by any organisation that needs a global, buyer-recognised certificate. Abu Dhabi healthcare teams typically need ADHICS and run ISO 27001 alongside it for ~70% evidence reuse and non-UAE buyer credibility.
ADHICS and ISO 27001 share an architectural lineage — ADHICS V2 adopts the ISO 27001 Annex A control structure as its spine. The difference is in scope, audit regime and the artefacts each one requires on top. If you run both, you build evidence once and emit it in two formats.
Quick comparison
| Factor | ADHICS | ISO 27001 |
|---|---|---|
| Type | Mandatory standard (licensure condition) | Voluntary certification |
| Issuer | Department of Health, Abu Dhabi | ISO/IEC Joint Technical Committee |
| Jurisdiction | Abu Dhabi | Global |
| Audience | DoH-licensed healthcare facilities and HIMS vendors | Any organisation handling sensitive information |
| Structure | 12 control families, 3 tiers (Basic / Transitional / Advanced) | ISMS clauses + 93 Annex A controls (2022 revision) |
| Core artefact | Per-facility Statement of Applicability | ISMS-wide Statement of Applicability |
| Audit | Technical Review Board Audit (TRBA) | Stage 1 + Stage 2 by accredited certification body |
| Reporting cadence | Quarterly DoH compliance report | Annual surveillance audit, 3-year recertification |
| Buyer value | UAE licensure, Malaffi connection | Global enterprise and EU procurement |
| Timeline to ready | 30 days with LowerPlane | 30 days with LowerPlane |
Understanding the key differences
ADHICS: healthcare-specific, licensure-driven
ADHICS V2 is published by the Department of Health in Abu Dhabi and is a condition of licensure for every DoH-licensed facility. It takes the ISO 27001 Annex A control structure and layers healthcare-specific requirements on top — DoH notification paths, Malaffi connection controls, quarterly compliance reporting, per-facility Statement of Applicability.
ADHICS adds on top of ISO 27001
- • Three tiers by facility type (Basic / Transitional / Advanced)
- • Per-facility SoA — one per DoH-licensed site
- • Quarterly DoH report on control effectiveness and incidents
- • Malaffi connection controls — authentication, logging, access review
- • TRBA audit regime with 90-day findings window
ISO 27001: global ISMS certification
ISO 27001 is the international standard for information security management systems. It is sector-agnostic — the same certificate works for a SaaS platform, a bank, a hospital or a defence contractor. The certification is widely recognised and often required for enterprise and EU procurement.
ISO 27001 provides
- • Globally recognised certificate from an accredited body
- • ISMS framework — context, leadership, risk management, continual improvement
- • 93 Annex A controls (2022 revision) across four themes
- • 3-year cycle with annual surveillance
- • Buyer trust that scales to any geography
You need ADHICS if…
- ✓ You operate a DoH-licensed facility in Abu Dhabi
- ✓ You are a HIMS vendor serving Abu Dhabi healthcare providers
- ✓ Your systems connect to Malaffi
- ✓ You are facing a TRBA audit at licensure renewal
- ✓ Your clinical operations expand into new Abu Dhabi sites
You need ISO 27001 if…
- ✓ Enterprise or EU buyers ask for the certificate during procurement
- ✓ You sell outside the UAE and need a globally recognised attestation
- ✓ You run a HIMS or healthcare platform with buyers in multiple regions
- ✓ You want a flexible, buyer-recognised ISMS without jurisdictional constraints
- ✓ You pair the certificate with ISO 27018, 27701 or 42001 overlays
You need BOTH if…
- ✓ You are a HIMS vendor selling into Abu Dhabi and other markets
- ✓ You are a multi-site clinical group with international buyers or investors
- ✓ You expect enterprise procurement to ask for ISO 27001 alongside DoH licensure
- ✓ You want one evidence pack that satisfies both audit regimes
- ✓ You plan to add ISO 27018 (cloud PII) or ISO 42001 (AI) overlays later
Control overlap: ~70%
ADHICS V2 adopts the ISO 27001 Annex A control structure as its spine. The overlap is high — your Annex A controls populate most of the ADHICS Statement of Applicability by evidence. The ADHICS-only additions are jurisdictional artefacts and healthcare-specific controls.
Overlapping requirements
- • Governance, policies, accountable owner / CISO
- • Risk management procedure with quarterly review
- • Human resources security — training, onboarding, offboarding
- • Access control + MFA on sensitive systems
- • Cryptography — at rest and in transit
- • Operations security — patching, backup, logging
- • Supplier relationships with contract clauses
- • Incident management and business continuity
ADHICS-only additions
- • Per-facility SoA (not a single corporate SoA)
- • Quarterly DoH compliance report
- • Malaffi connection controls
- • DoH incident notification path
- • Tier-specific documentation (Basic / Transitional / Advanced)
- • TRBA audit regime with 90-day findings window
- • Clinical-site physical security specifics
Running both together
The most efficient path for Abu Dhabi healthcare teams is to run ADHICS and ISO 27001 together. One ISMS, one evidence pack, two audit outputs. The ADHICS SoA references the same evidence as the ISO 27001 SoA — plus the ADHICS-only artefacts.
Timeline comparison
ADHICS timeline
- Tier scoping: 1 week
- Policy + control rollout: 2–3 weeks
- TRBA audit prep + first quarterly report: 1 week
- With LowerPlane: 30 days
ISO 27001 timeline
- ISMS scoping: 1 week
- Annex A rollout + evidence pack: 2–3 weeks
- Stage 1 + Stage 2 audit: 1 week
- With LowerPlane: 30 days
Common questions
Does ISO 27001 satisfy ADHICS?
Partially. ISO 27001 populates ~70% of ADHICS by evidence, but ADHICS has jurisdictional artefacts (per-facility SoA, quarterly DoH report, Malaffi connection controls, TRBA audit) that ISO 27001 does not provide. You need ADHICS specifically to meet DoH licensure.
Does ADHICS satisfy ISO 27001?
No. ADHICS is scoped to healthcare facilities in Abu Dhabi. If your non-UAE buyers ask for ISO 27001, they expect the ISO certificate from an accredited certification body — not a TRBA report.
Which should I do first?
Start with the one your business forces. ADHICS is a licensure condition in Abu Dhabi — if you are facing a TRBA audit, do it first. ISO 27001 is procurement-driven — if deals are blocked, do it first. If both apply, run them together on one engagement.
Can one auditor issue both?
No. ISO 27001 is audited by an accredited certification body. ADHICS is audited by a DoH-approved TRBA firm. They are separate engagements, but the evidence pack is shared. LowerPlane keeps both aligned on the same control library.
What about ISO 27018?
If you are a HIMS vendor acting as a cloud PII processor, ISO 27018 is often requested on top of ISO 27001. It is audited as part of the same ISO 27001 engagement and overlaps heavily with ADHICS data-governance expectations. See ISO 27018.
Related resources
- ADHICS platform page
- ISO 27001 framework page
- ADHICS V2 requirements
- ADHICS vs HIPAA comparison
- SOC 2 vs ISO 27001 comparison
Run ADHICS + ISO 27001 together
LowerPlane maps your Annex A controls into the ADHICS Statement of Applicability automatically, so one evidence pack feeds both audits. Dedicated advisor, 30 days to audit-ready.