NCA CSCC Penetration Testing and Vulnerability Assessment Cadence, scope and evidence.

ECC tells you to test “periodically”. CSCC tells you exactly how often. For anyone running a critical system, that ends the debate.

Is your system “critical”?

CSCC defines a critical system as one whose failure, unauthorised change, unauthorised access or data compromise could hurt the organisation’s services, or cause negative economic, financial, security or social impact at the national level. NCA’s identification criteria include:

• negative impact on national security or the Kingdom’s reputation;
• financial losses above 0.01% of GDP;
• impact on services used by more than 5% of the population;
• loss of life;
• unauthorised disclosure of Top Secret or Secret data;
• impact on the operations of one or more vital sectors.

CSCC applies to organisations that own or operate such systems. ECC compliance is a prerequisite: you cannot be CSCC-compliant without being ECC-compliant (see our NCA ECC guide). The framework has 4 domains, 21 subdomains, 32 main controls and 73 subcontrols.

The CSCC cadence table

Activity	Minimum frequency	CSCC control
Vulnerability assessment of critical systems’ technical components	Monthly	2-9-2
Patching: external or internet-connected critical systems	Monthly	2-9-1-2
Patching: internal critical systems	Every three months	2-9-1-2
Critical vulnerabilities	Remediate immediately	2-9-1-3
Penetration testing (all components, internal and external services)	Every six months	2-10-1, 2-10-2
Configuration and hardening review	Every six months	2-3-1-6
Firewall rules and access list review	Every six months	2-4-1-2
Cybersecurity risk assessment of critical systems	Annually (register reviewed monthly)	1-2-1-1, 1-2-1-2
Backup restore test	Every three months	2-8-2
Security event log retention	At least 18 months	2-11-2
Internal CSCC implementation review	Annually	1-4-1
Independent review outside the cybersecurity function	Every three years	1-4-2

Three scope differences from ECC that catch people out

1. Internal services are in. ECC’s pentest scope is the internet-facing estate. CSCC 2-10-1-1 widens it to all technical components of the critical system and all its internal and external services. That means internal networks, databases, middleware, admin interfaces and the management network.

2. “Qualified team” is a requirement, not a nice-to-have. CSCC 2-10-1-2 requires tests to be performed by a qualified team. Keep CVs, certifications and the methodology on file with each report.

3. Watch the numbering. CSCC renumbers its subdomains. Penetration testing is CSCC 2-10 and vulnerability management is 2-9. CSCC 2-11 is event logs and monitoring, which is not the same as ECC 2-11 (penetration testing). Label your evidence with the right framework and number.

Delivery constraints that affect how your pentest is run

Two CSCC controls shape how a testing firm can work on critical systems:

• 2-2-1-1 prohibits remote access to critical systems from outside the Kingdom. If a tester plans to connect from abroad, that conflicts with your own control. Internal testing of critical systems should happen from inside Saudi Arabia, under access the organisation controls and monitors (2-2-1-2).
• 4-1-1-2 requires outsourcing and managed services for critical systems to rely on Saudi companies, in line with the relevant regulations, and 4-1-1-1 requires screening of outsourced personnel who work on critical systems.

Put both into the statement of work before testing starts. It is far cheaper than explaining an offshore connection to an auditor afterwards.

Building a 12-month CSCC testing calendar

A rhythm that works for most critical-system owners:

• Every month: authenticated vulnerability scans of all critical system components. Fix critical findings immediately and external findings within the month. Update the risk register.
• Months 3, 6, 9, 12: confirm internal patching is done and test backup restores.
• Months 6 and 12: full penetration test of internal and external services, plus a configuration and firewall rule review.
• Month 12: annual risk assessment and the internal CSCC review.
• After any major change: a targeted retest of the changed component, so the six-month cycle is not left carrying a known gap.

Evidence that holds up

For each six-monthly pentest, keep the scope (mapped to the critical-system asset inventory, CSCC 2-1-1-1), the qualified-team records, the report, the remediation tracker and the retest. For monthly assessments, keep the scan outputs, the remediation tickets and a monthly summary signed off by the cybersecurity function. Auditors look at the trend line, not just the latest PDF.

How Summit runs CSCC testing

Summit delivers VAPT with our verified NCA-registered partner firm. We run the monthly assessment and six-monthly penetration test cycle as one managed programme, scope engagements around the in-Kingdom access rules above, and map reports to CSCC 2-9 and 2-10 and to the underlying ECC controls. We have supported 115+ Saudi clients across Riyadh, Jeddah, Dammam and beyond, handling scoping, testing, remediation support and evidence end to end. Pair it with a risk assessment from our services to cover CSCC 1-2’s annual risk assessment and monthly register review.

Plan your next six-month cycle

Talk to Summit about a CSCC testing calendar that gives your auditors a clean trend line. Explore our VAPT services.

Related reading: ECC-2:2024 penetration testing requirements · VAPT provider checklist and cost guide