On this page
- Which Saudi regulations require penetration testing?
- How does each penetration test type map to NCA ECC 2-11 and SAMA CSF 3.2.4?
- How often should you run a penetration test in Saudi Arabia?
- Is a vulnerability scan the same as a penetration test under Saudi rules?
- What evidence do NCA and SAMA reviewers expect from a penetration test?
- How do you run a penetration testing programme in Saudi Arabia, step by step?
- What should you look for in a penetration testing provider in Saudi Arabia?
- How Sumrite helps
- Frequently asked questions
Delivered with a verified NCA-registered partner
Sumrite runs penetration testing for Saudi organisations end to end with our verified NCA-registered partner firm, and has served 100+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. Talk to our team.
This guide is the hub for our Saudi penetration testing series. It explains which rules apply, maps every common test type to the control it satisfies, and links out to deeper guides on choosing a provider, cost, Riyadh-specific considerations and individual test types.
Which Saudi regulations require penetration testing?
Two frameworks set explicit penetration testing requirements in Saudi Arabia: NCA ECC-2:2024 for government entities and Critical National Infrastructure (CNI) operators, and the SAMA Cyber Security Framework for SAMA-regulated financial institutions. Other NCA control sets, such as the Critical Systems Cybersecurity Controls (CSCC), add stricter expectations for systems classified as critical.
NCA Essential Cybersecurity Controls (ECC-2:2024)
According to the ECC-2:2024 document published by NCA, the controls apply to government agencies in the Kingdom, their affiliated companies and entities inside and outside Saudi Arabia, and private-sector entities that own, operate or host CNI. The framework contains 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols. Penetration testing sits in subdomain 2-11. Our full guide to NCA ECC compliance covers the rest of the framework, and the ECC 2-11 deep dive walks through the control text line by line.
SAMA Cyber Security Framework (CSF)
SAMA’s framework, issued under Circular 381000091275 dated 24 May 2017, applies to SAMA Member Organizations such as banks, insurers and finance companies. Its subdomain 3.2.4, Cyber Security Review, states that “customer and internet facing services should be subject to annual review and penetration tests”, and that reviews must be followed up to confirm issues were addressed. See our guide to the SAMA Cyber Security Framework and the bank-focused SAMA penetration testing guide.
Other rules that reference testing
- SAMA Cyber Resilience Fundamental Requirements (CRFR): control 3.2.6 says entities should conduct penetration testing twice a year as a minimum, and after major or critical change.
- NCA CSCC: applies to systems classified as critical. Our CSCC guide covers it.
- NCA Cloud Cybersecurity Controls (CCC): relevant to cloud providers and tenants. See NCA CCC testing.
How does each penetration test type map to NCA ECC 2-11 and SAMA CSF 3.2.4?
Every component named in ECC 2-11-3-1 needs a matching test type, and for SAMA Member Organizations the same tests also cover “customer and internet facing services” under SAMA CSF 3.2.4. ECC 2-11-3-1 lists infrastructure, websites, web applications, smartphone and tablet applications, email and remote access as the minimum scope for internet-facing services.
| Test type | NCA ECC-2:2024 control | SAMA CSF control | What the test covers |
|---|---|---|---|
| Web application VAPT | 2-11-3-1 (websites, web applications); supports 2-15 Web Application Security | 3.2.4 (internet-facing services) | Authentication, access control, business logic, injection, session handling |
| API security testing | 2-11-3-1 (technical components of internet-facing services) | 3.2.4 (customer-facing services, open banking APIs) | Object-level authorisation, rate limits, token handling |
| Mobile app VAPT | 2-11-3-1 (smartphone and tablet applications) | 3.2.4 (mobile banking and payment apps) | App binary, local storage, transport security, backend calls |
| External network VAPT | 2-11-3-1 (infrastructure, email, remote access) | 3.2.4 (internet-facing infrastructure) | Perimeter hosts, VPN and remote-access gateways, mail servers |
| Internal network VAPT | Not named in 2-11-3-1; expected for critical systems (CSCC) | 3.2.4 first bullet: periodic reviews of critical information assets | Lateral movement, Active Directory, segmentation |
| Cloud security assessment | 2-11-3-1 where cloud hosts internet-facing services; NCA CCC | 3.2.4 (where services run in cloud) | Identity and access, storage exposure, network rules |
| Red team operations | Complements 2-11; not a substitute | SAMA publishes a separate Financial Entities Ethical Red-Teaming framework | Objective-led, multi-vector attack simulation |
Two practical points follow from that table. First, a single engagement can serve both frameworks if the report maps each finding to both control numbers. Second, internal testing is not in ECC 2-11-3-1’s minimum list, but NCA’s Penetration Testing Standard template includes internal systems in its scope, so most mature programmes test both. Financial institutions weighing a red team exercise should read SAMA ethical red teaming vs penetration testing, and web and app owners can go deeper with web application penetration testing in Saudi Arabia and mobile app and API testing for Saudi fintechs. For the difference between test perspectives, read internal vs external penetration testing and black box, grey box and white box testing.
How often should you run a penetration test in Saudi Arabia?
ECC-2:2024 requires penetration tests “periodically” without fixing an interval, SAMA CSF 3.2.4 requires an annual test of customer and internet-facing services, and NCA’s published Penetration Testing Standard template uses every six months for critical systems. The interval you choose must be written into your approved policy.
- NCA ECC-2:2024, 2-11-3-2
- Periodically, at an interval your approved policy defines
- SAMA CSF 3.2.4
- Annual review and penetration test of customer and internet-facing services
- SAMA CRFR 3.2.6
- At least twice a year, and after major or critical change
- NCA Penetration Testing Standard template, 2-3
- Critical systems: scheduled and regular, every 6 months
- NCA Penetration Testing Standard template, 2-4
- Remote work systems: at least once per year
The NCA templates are model documents that an organisation adapts and approves, not controls in their own right, but assessors recognise them, and adopting their intervals is an easy way to show a defensible cadence. A sensible baseline for most ECC entities is an annual test of every internet-facing service plus a test before any major release. Teams that ship often should look at continuous penetration testing in Saudi Arabia, delivered through our continuous penetration testing service, so that new features are tested between annual cycles. For a general view of cadence, see how often you should run a penetration test.
Is a vulnerability scan the same as a penetration test under Saudi rules?
No: NCA ECC treats vulnerability management (2-10) and penetration testing (2-11) as separate subdomains, so a clean scan report does not close 2-11. Subdomain 2-10 asks for periodic vulnerability assessment, severity ranking and risk-based remediation; subdomain 2-11 asks for tests that simulate real attacks.
Automated scanners find missing patches and known misconfigurations. A manual penetration test finds chained flaws, broken access control and business-logic abuse, the issues that most often lead to data exposure. Our vulnerability assessment vs penetration testing guide explains how the two fit together under NCA ECC.
What evidence do NCA and SAMA reviewers expect from a penetration test?
Reviewers expect an approved penetration testing policy, a scope that reconciles to the asset inventory, test reports with severity ratings, a remediation tracker and proof of retesting. SAMA CSF 3.2.4 makes follow-up explicit: reviews must confirm that identified issues have been addressed and critical risks treated.
- An approved penetration testing policy and standard (ECC 2-11-1). NCA publishes a policy template and a standard template you can adapt.
- An annual test plan naming assets, dates, test type and testers.
- Rules of engagement agreed before testing, as the NCA standard template requires.
- A scope list reconciled to your asset inventory, covering every 2-11-3-1 component.
- A report with an executive summary, methodology, findings by severity and remediation advice. Our sample VAPT report shows the format.
- A remediation plan with a technical owner, business owner and deadlines.
- Retest results for critical and high findings.
- A record of the periodic review of the testing process (ECC 2-11-4).
For what separates a useful report from a box-ticking one, read what makes a VAPT report worth paying for.
How do you run a penetration testing programme in Saudi Arabia, step by step?
Start from your asset inventory and regulatory scope, test each in-scope asset with the right method, fix and retest, then record the review. The steps below follow the order NCA’s standard template and SAMA CSF 3.2.4 imply.
- Confirm which frameworks apply. ECC, SAMA CSF, CRFR, CSCC or a mix. Many banks answer to both NCA and SAMA.
- Build the scope from the asset inventory. List every internet-facing service and its components. A free external check at scan.sumrite.com helps you spot forgotten hosts.
- Approve the policy and the cadence. Write the interval and change triggers into the 2-11-1 policy.
- Choose a registered provider. Use our buyer’s checklist for Saudi penetration testing companies.
- Agree rules of engagement. Production windows, stop conditions and SOC coordination, especially for banks.
- Test and report. Map each finding to ECC and SAMA control numbers.
- Remediate and retest. Close critical and high findings and keep the retest report.
- Review the process. Minute the review that 2-11-4 and SAMA’s follow-up clause expect.
What should you look for in a penetration testing provider in Saudi Arabia?
Choose a provider whose testing entity is registered with NCA, who tests manually as well as with tools, and who maps findings to ECC and SAMA control numbers and includes a retest. NCA states on its registration and licensing page that registration on its digital platform has been a regulatory requirement for cybersecurity service providers since 1 August 2022, and it publishes a list of registered providers.
Cost is the other question buyers ask first. Price depends on the number and complexity of assets, test depth and delivery constraints rather than the city; our guide to penetration testing cost in Saudi Arabia explains each driver. Organisations based in the capital should also read penetration testing in Riyadh, and those protecting personal data should pair testing with the Saudi PDPL compliance guide.
How Sumrite helps
Sumrite has delivered manual, expert-led VAPT since 2007. For Saudi organisations, Sumrite runs penetration testing end to end with our verified NCA-registered partner firm, and has served 100+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. Each engagement is scoped from your asset inventory, mapped to ECC 2-11 and SAMA CSF 3.2.4, and closed with a retest and an evidence pack. Our Saudi Arabia page explains how we deliver a VAPT report ready for Saudi reviews in 48 hours, and our NCA ECC compliance service covers the governance side.
Plan your 2027 testing cycle now
Send us your asset list and the frameworks you answer to, and we will return a test plan mapped to NCA ECC 2-11 and SAMA CSF 3.2.4. Book a scoping call.
Frequently asked questions
Is penetration testing mandatory in Saudi Arabia?
Penetration testing is mandatory for organisations in scope of the National Cybersecurity Authority's Essential Cybersecurity Controls (ECC-2:2024), which require periodic tests of every internet-facing service under subdomain 2-11. SAMA-regulated financial institutions must also put customer and internet-facing services through an annual review and penetration test under SAMA CSF 3.2.4. Other private companies are not covered by those two frameworks but are usually asked for test evidence by regulated customers.
What does NCA ECC 2-11 require a penetration test to cover?
NCA ECC 2-11-3-1 requires the penetration testing scope to include all services provided externally via the internet and their technical components: infrastructure, websites, web applications, smartphone and tablet applications, email and remote access. A test that covers only the main website leaves the rest of that list as an open gap.
How often should a Saudi organisation run a penetration test?
NCA ECC-2:2024 says penetration tests must be conducted periodically and leaves the interval to the entity's approved policy, while SAMA CSF 3.2.4 sets an annual test for customer and internet-facing services. NCA's published Penetration Testing Standard template uses every six months for critical systems. Most Saudi organisations test annually at minimum and again before major releases.
Does an ECC or SAMA penetration test need to be done by an NCA-registered firm?
The National Cybersecurity Authority has required every entity providing cybersecurity services in Saudi Arabia to register on its platform since 1 August 2022. A Saudi buyer should therefore confirm that the firm performing the penetration test, or its delivery partner, appears on NCA's list of registered service providers.
Is a vulnerability scan enough to satisfy NCA ECC or SAMA?
A vulnerability scan is not enough on its own. NCA ECC treats vulnerability management (2-10) and penetration testing (2-11) as separate subdomains, and SAMA CSF 3.2.4 asks specifically for penetration tests of customer and internet-facing services. A scan supports 2-10; a manual penetration test is what closes 2-11 and 3.2.4.
Faisal Khan is a Director at Sumrite, where he oversees penetration testing, risk assessment and compliance engagements for SaaS and enterprise clients. Case studies are anonymised and published with client permission.
