Saudi Arabia · NCA · ECC · CCC · CSCC
NCA licensed penetration testing in Saudi Arabia, run end to end by Sumrite.
Government entities, critical infrastructure and their suppliers in the Kingdom increasingly need testing from a provider licensed by the National Cybersecurity Authority. Sumrite runs the engagement and routes the licensed step through its NCA licensed partner in Saudi Arabia.
The National Cybersecurity Authority (NCA) licenses organisations that provide cybersecurity services in Saudi Arabia, including penetration testing. Entities subject to NCA controls, and the suppliers working for them, are expected to use licensed providers. Sumrite runs scoping, testing, remediation support and the retest, and the licensed provider step is issued through its NCA licensed partner in the Kingdom.
Who needs it
| Who | When it applies |
|---|---|
| Government entities | Penetration testing under ECC-2:2024 control 2-11 and NCA assessments |
| Critical national infrastructure | Operators covered by the Critical Systems Cybersecurity Controls (CSCC) |
| Cloud providers and tenants | Testing evidence for the Cloud Cybersecurity Controls (CCC) |
| Suppliers to the above | Contracts that require a provider licensed by the NCA |
How Sumrite delivers it
Sumrite runs the engagement end to end: scoping, expert-led testing, remediation support and the retest. Where the scheme requires a specific accredited, empanelled, licensed or registered firm, the formal report or attestation is issued through a Sumrite partner firm that holds it, so you deal with one team throughout.
- Confirm the requirement. Which NCA controls apply and whether the contract asks for a licensed provider.
- Scope and NDA. Assets and environments agreed; data that must stay in the Kingdom stays there.
- Expert-led testing. Web, API, mobile, network and cloud testing mapped to NCA control references.
- Licensed step through our local partner. Where an NCA licensed provider must perform or sign off the work, it is issued through Sumrite’s partner.
- Report with an Arabic summary, then retest. Findings in English with an Arabic executive summary; fixes retested.
Frequently asked questions
Does a penetration testing provider need an NCA licence?
The NCA licenses cybersecurity service providers, including penetration testing. Entities covered by NCA controls and contracts that name the requirement should use a licensed provider.
Can Sumrite deliver NCA licensed testing?
Yes. Sumrite runs the engagement end to end and routes the licensed provider step through its NCA licensed partner in Saudi Arabia.
Is the report available in Arabic?
The technical report is in English with an Arabic executive summary for leadership and reviewers.
Accredited testing
Need a test a regulator or buyer will accept?
Send the requirement and the deadline. NDA first, fixed-scope quote, one team end to end.