On this page
- Who ECC-2:2024 applies to
- What control 2-11 actually says
- How often should you test under ECC?
- Penetration testing vs vulnerability management (2-10)
- What assessors ask for: the evidence pack
- Gaps we see again and again
- A note for private companies: NCNICC-1:2025
- How Summit helps
- Ready to close control 2-11?
- Frequently asked questions
Delivered with a verified NCA-registered partner
Summit runs VAPT for Saudi organisations end to end with our verified NCA-registered partner firm, and has served 115+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. Talk to our team.
That is the whole requirement in four sentences. The hard part is turning “periodically” and “all internet-facing services” into a programme that survives an NCA assessment. That is what this guide covers.
Who ECC-2:2024 applies to
ECC-2:2024 is mandatory for government agencies in the Kingdom (ministries, authorities, establishments), for their affiliated companies inside and outside Saudi Arabia, and for private-sector entities that own, operate or host Critical National Infrastructure. NCA encourages every other organisation to adopt it as good practice. Our NCA ECC guide covers the wider framework.
The framework has 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols. Penetration testing is a small slice of it, but it is one of the easiest controls for an assessor to check. The evidence either exists or it does not.
If you are a private company that is not CNI, read the NCNICC-1:2025 section further down. NCA now has a separate baseline for you.
What control 2-11 actually says
| Control | Requirement (paraphrased from NCA text) | What it means in practice |
|---|---|---|
| 2-11-1 | Penetration testing requirements are defined, documented and approved | A signed policy or standard, approved by the authorised official |
| 2-11-2 | Those requirements are implemented | Tests actually happen and match the policy |
| 2-11-3-1 | Scope covers all internet-facing services and their technical components: infrastructure, websites, web apps, smartphone and tablet apps, email, remote access | Your external attack surface, not just “the website” |
| 2-11-3-2 | Penetration tests are conducted periodically | A defined, risk-based cadence you can justify |
| 2-11-4 | Implementation of the requirements is periodically reviewed | A documented review of the pentest process itself |
Two things stand out. First, the scope list is explicit. If your VPN gateway, webmail or mobile banking app was left out, that is a finding, however good the web app test was. Second, ECC does not set a number. It does not say “annually”. It says periodically.
How often should you test under ECC?
Because ECC says “periodically”, the cadence is yours to set, and yours to defend. This is how we usually frame it with clients:
- Baseline: test every internet-facing service at least once a year. Most assessors expect this, and it fits most budgets.
- Change-driven tests: ECC 1-5-3 already requires a risk assessment before major infrastructure changes and before new technology services launch. Attach a pentest to the same triggers. New customer portal? Test it before go-live.
- Critical systems: if any of your systems are classified as critical, the Critical Systems Cybersecurity Controls (CSCC) remove the ambiguity. Penetration tests on those systems must run at least once every six months. Our CSCC guide covers that in detail.
Write the cadence into the policy you approve under 2-11-1. An assessor is far more comfortable with “annually, and before any major release, as defined in policy X” than with a calendar that has drifted.
Penetration testing vs vulnerability management (2-10)
People mix these up all the time. ECC handles them as separate subdomains:
- 2-10 Vulnerability Management requires periodic vulnerability assessment and detection, classification by severity, risk-based remediation and patch management. Think scanning, continuously or on a schedule.
- 2-11 Penetration Testing simulates real attack techniques to find weaknesses that scanners miss: chained flaws, business-logic abuse, broken access control.
A clean scan report will not satisfy 2-11, and a pentest will not satisfy 2-10. You need both. Together they are what most people mean by VAPT.
What assessors ask for: the evidence pack
NCA checks ECC compliance through self-assessment, reports from its compliance tool, and on-site audit visits. For 2-11, a strong evidence pack usually contains:
- Approved pentest policy or standard: dated, versioned, signed (2-11-1).
- Annual test plan: which assets, which dates, which test type, who performs it.
- Scope reconciliation: the list of tested assets compared against your asset inventory (subdomain 2-1). A mismatch here is the most common reason a finding sticks.
- Test reports: methodology, findings rated by severity, evidence, remediation advice.
- Remediation tracker: owner, due date and status for every finding.
- Retest results: proof that critical and high findings were actually fixed.
- Process review record: minutes or a short report showing you reviewed the pentest process (2-11-4).
- Third-party paperwork: if an external firm tests, the contract should carry the cybersecurity clauses ECC 4-1 requires, including non-disclosure and secure data removal.
Gaps we see again and again
- Remote access left out. VPNs, VDI gateways and remote-support tools are named in 2-11-3-1 and still get skipped.
- Mobile apps tested only as an API. The control lists smartphone and tablet apps separately. Test the app, not just the backend.
- Email ignored. Mail gateways and webmail are in scope.
- No retest. A report with 14 open highs and no follow-up is not compliance. It is a liability on file.
- Mixed-up numbering. In CSCC, penetration testing is 2-10, not 2-11 (2-11 in CSCC is logging). Evidence mapped to the wrong framework number confuses reviewers.
A note for private companies: NCNICC-1:2025
On 28 December 2025, NCA issued controls for private-sector entities that are not CNI (NCNICC-1:2025). Published commentary describes two tiers. Larger “Category A” companies (over 250 full-time staff or over SAR 200 million in revenue) implement all 65 main controls, penetration testing included. Smaller “Category B” companies (6 to 249 staff or SAR 3 to 200 million in revenue) apply a reduced mandatory set of 26 controls, and whether penetration testing is mandatory for them should be confirmed against NCA’s published text. Even where testing is optional, a scoped external test is usually the cheapest way to show “reasonable safeguards” to clients and to regulators such as SDAIA.
How Summit helps
Summit delivers VAPT with our verified NCA-registered partner firm, and we manage the engagement end to end: scoping against your asset inventory, testing, a report mapped to ECC 2-10 and 2-11, a remediation workshop, retesting, and the evidence pack. We have supported 115+ Saudi clients across Riyadh, Jeddah, Dammam and other cities.
If you are also building the governance side, pair the test with a cybersecurity risk assessment from our services. ECC 1-5 expects risk assessments at the same moments you will want a pentest.
Ready to close control 2-11?
Book a scoping call with Summit. We will map your internet-facing estate to ECC 2-11 and deliver testing, with our verified NCA-registered partner, that gives an assessor nothing to chase. Talk to our VAPT team.
Related reading: CSCC penetration testing cadence · How to choose a VAPT provider in Saudi Arabia · SAMA CSF penetration testing
Frequently asked questions
Does NCA ECC-2:2024 require annual penetration testing?
Not in those words. Control 2-11-3-2 requires penetration tests to be conducted periodically and leaves the cadence to the entity. Annual testing of all internet-facing services, plus testing before major changes, is a defensible baseline. Critical systems under CSCC must be tested at least every six months.
What must be in scope under ECC control 2-11?
All services exposed to the internet and their technical components: infrastructure, websites, web applications, smartphone and tablet apps, email and remote access.
Is a vulnerability scan enough for ECC compliance?
No. Scanning supports vulnerability management (2-10). Penetration testing (2-11) is a separate control that requires simulated attacks on the in-scope services.
Who must comply with ECC-2:2024?
Government agencies and their affiliated companies inside and outside the Kingdom, and private entities that own, operate or host Critical National Infrastructure. Other organisations are encouraged to adopt it as good practice.
What evidence does an NCA assessment look for?
An approved penetration testing policy, a test plan, scope reconciled to your asset inventory, test reports, a remediation tracker, retest results, and a record of the periodic review of the process.
