On this page
- Which regulators headquartered in Riyadh set penetration testing rules?
- Which Riyadh sectors are most affected by penetration testing requirements?
- What should a penetration test in Riyadh cover?
- Do you need a penetration testing company with a Riyadh office?
- How should Riyadh organisations plan the timing of a penetration test?
- What do Riyadh assessors expect to see after a penetration test?
- How Sumrite helps
- Frequently asked questions
Delivered with a verified NCA-registered partner
Sumrite runs penetration testing for Riyadh organisations end to end with our verified NCA-registered partner firm, and has served 100+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. Talk to our team.
Riyadh is where Saudi cybersecurity regulation is written and supervised. That makes penetration testing in Riyadh different from testing elsewhere: more organisations in the city are directly in scope of a control framework, and more of them are suppliers to organisations that are. This briefing covers the Riyadh-specific picture. For the national framework, read our pillar guide to penetration testing in Saudi Arabia.
Which regulators headquartered in Riyadh set penetration testing rules?
Three regulators that set or influence penetration testing rules are headquartered in Riyadh: the National Cybersecurity Authority, the Saudi Central Bank and the Communications, Space and Technology Commission. Each one supervises a different group of organisations, so the first question for any Riyadh business is which of them it answers to.
| Regulator | Headquarters (official source) | Who it covers | Penetration testing reference |
|---|---|---|---|
| National Cybersecurity Authority (NCA) | Riyadh, per NCA’s published CERT profile (RFC 2350) | Government agencies, their affiliates, CNI operators | ECC-2:2024 subdomain 2-11 |
| Saudi Central Bank (SAMA) | Riyadh, per Article 2 of the Saudi Central Bank Law | Banks, insurers, finance companies, fintechs | SAMA CSF 3.2.4 |
| Communications, Space and Technology Commission (CST) | Riyadh, per Article Two of the Commission’s ordinance | Telecom, ICT and related licensees | Cybersecurity Regulatory Framework (CRF) for ICT service providers |
Many Riyadh organisations answer to more than one of these at once. A bank that also operates critical infrastructure can fall under both SAMA CSF and NCA ECC, so one test programme should map each finding to both control sets. CST licensees should read our guide to the CST Cybersecurity Regulatory Framework, and dual-regulated institutions our comparison of NCA ECC and SAMA CSF. Whichever applies, plan testing so that evidence is ready before a review is scheduled, not after.
Which Riyadh sectors are most affected by penetration testing requirements?
Government entities and their affiliated companies, financial institutions, and multinational regional headquarters are the Riyadh sectors most affected, because they are either directly in scope of NCA ECC or SAMA CSF or supply organisations that are. As the capital, Riyadh hosts most ministries and authorities, which places a large share of ECC-scoped entities in the city.
Government entities and affiliated companies
ECC-2:2024 applies to government agencies, their affiliated companies and entities inside and outside the Kingdom, and private entities that own, operate or host Critical National Infrastructure. For these organisations, control 2-11-3-1 sets the minimum scope: infrastructure, websites, web applications, smartphone and tablet applications, email and remote access. Our ECC 2-11 guide explains the control in detail.
Banks, insurers and fintechs
SAMA’s framework, issued under Circular 381000091275 dated 24 May 2017, applies to SAMA Member Organizations. Subdomain 3.2.4 requires that “customer and internet facing services should be subject to annual review and penetration tests”. Fintechs applying for a licence or entering SAMA’s sandbox face the Cyber Resilience Fundamental Requirements, which set penetration testing at least twice a year. See SAMA penetration testing for banks and mobile app and API penetration testing for Saudi fintechs.
Regional headquarters of multinational companies
The Saudi Press Agency reported in December 2023 that the Regional Headquarters (RHQ) Program is a joint initiative of the Ministry of Investment and the Royal Commission for Riyadh City, and that approved RHQ activities receive a 30-year tax incentive package. Regional headquarters are rarely in ECC scope themselves, but many sell to Saudi government and regulated buyers. Those buyers must manage supplier risk under ECC subdomain 4-1, so a recent penetration test report is one of the first documents a Riyadh RHQ is asked for. Our guide on selling SaaS into Saudi Arabia covers the buyer side of this.
What should a penetration test in Riyadh cover?
A penetration test in Riyadh should cover every internet-facing component named in NCA ECC 2-11-3-1, plus the sector-specific assets your regulator expects, such as payment APIs for SAMA entities and internal networks for critical systems. The table below shows typical scopes by sector.
- Government entity or affiliate
- Public portals, e-services, mobile apps, email, VPN and remote access, internal network for critical systems
- Bank or insurer
- Internet and mobile banking, open banking and partner APIs, payment pages, internet-facing infrastructure
- Fintech (sandbox or licence stage)
- Mobile app, APIs, cloud environment, onboarding and e-KYC flows
- Regional headquarters
- Customer-facing SaaS or portals, cloud tenancy, corporate email and remote access
- Telecom or ICT licensee
- Customer portals, APIs, internet-facing infrastructure, cloud services
Use the matching service for each layer: web application VAPT, API security testing, mobile app VAPT and network VAPT. Riyadh’s web-facing estates are usually the largest exposure, so our guide to web application penetration testing in Saudi Arabia is a good next read.
Do you need a penetration testing company with a Riyadh office?
No: a Riyadh office is not a requirement, but an NCA-registered testing entity is, and some scopes need on-site or in-Kingdom access. NCA’s registration and licensing page states that registration on its digital platform has been a regulatory requirement for cybersecurity service providers since 1 August 2022.
External tests of websites, APIs and mobile apps are delivered remotely in most engagements. On-site or in-Kingdom access becomes relevant when:
- internal networks or Active Directory are in scope;
- systems are classified as critical and access rules restrict where testing traffic may originate;
- production testing at a bank needs to be coordinated live with the security operations centre.
Two other local factors are worth settling at the start. Government entities and boards in Riyadh often want the executive summary in Arabic as well as English, so agree the reporting language before testing begins. And if testers will see personal data during the engagement, the contract should say how that data is stored and deleted.
When comparing firms, use our buyer’s checklist for choosing a penetration testing company in Saudi Arabia rather than filtering on postcode.
How should Riyadh organisations plan the timing of a penetration test?
Riyadh organisations should plan tests around their approved policy cadence, major releases and regulator review dates, and agree testing windows that match the Sunday-to-Thursday working week. NCA’s Penetration Testing Standard template also calls for a rules-of-engagement document before testing, covering timing, scope and tester permissions.
- Fix the cadence in policy. ECC 2-11 says “periodically”; SAMA CSF 3.2.4 says annually. The NCA standard template uses every six months for critical systems.
- Work back from review dates. Leave time for remediation and a retest before an NCA assessment or SAMA examination.
- Attach tests to releases. New e-services, app versions and API launches should be tested before go-live. Frequent releasers should consider continuous penetration testing in Saudi Arabia.
- Agree production windows. Out-of-hours windows and stop conditions are standard for banks and government e-services.
- Plan around peak periods. Ramadan and major national events change traffic patterns and change-freeze calendars; agree dates early.
What do Riyadh assessors expect to see after a penetration test?
Riyadh assessors expect an approved penetration testing policy, a scope reconciled to the asset inventory, a report with severity ratings, a remediation tracker and retest evidence. SAMA CSF 3.2.4 makes follow-up explicit: reviews must confirm that identified issues were addressed and critical risks treated.
- Approved penetration testing policy and standard (ECC 2-11-1).
- Scope list covering every 2-11-3-1 component, reconciled to the asset inventory.
- Report with executive summary, method, findings and remediation advice. Compare against our sample VAPT report.
- Remediation plan with owners and deadlines.
- Retest report for critical and high findings.
- Record of the periodic process review (ECC 2-11-4).
If personal data is involved, align the evidence with the Saudi PDPL compliance guide. For budgeting, our guide to penetration testing cost in Saudi Arabia explains the scope drivers that set the price.
How Sumrite helps
Sumrite has delivered manual, expert-led VAPT since 2007. For Riyadh organisations, Sumrite runs penetration testing end to end with our verified NCA-registered partner firm, and has served 100+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. We scope from your asset inventory, map findings to ECC 2-11 and SAMA CSF 3.2.4, and close each engagement with a retest and an evidence pack. Where a scope needs in-Kingdom access, we plan it at the scoping stage. Our Saudi Arabia page explains how we deliver a VAPT report ready for Saudi reviews in 48 hours, and our NCA ECC compliance service covers the controls around testing.
Scope your Riyadh penetration test
Tell us which regulator you answer to and send your asset list. We will return a scope mapped to NCA ECC 2-11 or SAMA CSF 3.2.4. Book a scoping call.
Frequently asked questions
Which regulators affect penetration testing for Riyadh businesses?
Riyadh businesses mainly answer to three regulators headquartered in the city: the National Cybersecurity Authority (NCA), the Saudi Central Bank (SAMA) and the Communications, Space and Technology Commission (CST). NCA's Essential Cybersecurity Controls require periodic penetration tests of internet-facing services, and SAMA's Cyber Security Framework requires annual penetration tests of customer and internet-facing services.
Do Riyadh companies need a penetration testing firm based in Riyadh?
A Riyadh company does not need a penetration testing firm with a Riyadh office, because most external testing is delivered remotely. What a Riyadh company does need is a testing entity registered with the National Cybersecurity Authority, plus a plan for on-site or in-Kingdom access when internal networks or critical systems are in scope.
Do regional headquarters in Riyadh need penetration testing?
A regional headquarters in Riyadh is not automatically in scope of NCA ECC, but many regional headquarters sell to Saudi government entities or regulated firms. Those customers are required to manage third-party cybersecurity risk under NCA ECC 4-1, so they routinely ask suppliers for recent penetration test evidence.
How often should a Riyadh organisation run a penetration test?
A Riyadh organisation in scope of NCA ECC-2:2024 must test internet-facing services periodically at an interval set in its approved policy, and a SAMA-regulated organisation must test customer and internet-facing services annually. Testing again before major releases is the usual practice for both.
What does a Riyadh penetration test usually cover?
A Riyadh penetration test usually covers the components named in NCA ECC 2-11-3-1: infrastructure, websites, web applications, smartphone and tablet applications, email and remote access. Riyadh financial institutions add open banking and payment APIs, and government-linked entities often add internal networks and critical systems.
Faisal Khan is a Director at Sumrite, where he oversees penetration testing, risk assessment and compliance engagements for SaaS and enterprise clients. Case studies are anonymised and published with client permission.
