Penetration testing for NCA ECC subdomain 2-11

What subdomain 2-11 asks for

Subdomain 2-11 has four controls:

• 2-11-1 The entity identifies, documents and approves its cybersecurity requirements for penetration testing.
• 2-11-2 The entity carries out penetration testing.
• 2-11-3 Those requirements cover, as a minimum, a scope that includes all services the entity provides over the internet and their technical components (2-11-3-1), and testing periodically (2-11-3-2).
• 2-11-4 The entity reviews periodically how it applies these requirements.

The ECC states the aim plainly: to test how effective the entity's cybersecurity capabilities are by simulating real attack techniques, and to find unknown weaknesses that could lead to a breach.

Who the ECC applies to

The ECC applies to:

• Government agencies in Saudi Arabia, including ministries, authorities and establishments
• Their affiliated companies and entities, inside and outside the Kingdom
• Private sector organisations that own, operate or host critical national infrastructure

The NCA also strongly encourages every other organisation in the Kingdom to use the controls.

The ECC can also reach you through a contract. Control 4-1-2-3 requires entities in scope to oblige third parties, in contracts that could affect their data or services, to apply the entity's cybersecurity requirements. If you provide services to a government entity, your contract may pass those requirements on to you.

How we scope your test to 2-11-3-1

Control 2-11-3-1 lists the technical components your penetration testing must cover. This is what we test for each one.

• Infrastructure

  Internet-facing hosts, exposed services and your external perimeter.

  Our service: Network & infrastructure testing

• Websites and web applications

  Authentication, session handling, access control, injection points and business logic.

  Our service: Web application penetration testing

• Smartphone and tablet applications

  Your iOS and Android apps and the APIs they depend on.

  Our service: Mobile app penetration testing

• Email

  Your internet-facing mail services and webmail.

  Our service: Network & infrastructure testing

• Remote access

  VPN gateways and other remote access portals.

  Our service: Network & infrastructure testing

We agree with you which services you provide over the internet, list them in the statement of work and your authorisation letter, and test only what is listed. If we find an asset that appears to be yours but is not in scope, we do not test it. We tell you and ask how you want to proceed. Systems hosted by third parties, such as cloud platforms and managed service providers, are tested only where their policies allow it or with their permission.

Penetration test or vulnerability scan?

The ECC treats them as two separate requirements. Subdomain 2-10 (vulnerabilities management) calls for periodic vulnerability assessment, classification by severity and remediation. Subdomain 2-11 calls for penetration testing that simulates real attacks.

A scanner report helps with 2-10. It does not show what an attacker could actually do with a weakness, and that is what 2-11 asks you to test. Our testers confirm every finding by hand and look for what scanners miss, such as business logic flaws and low-severity issues that chain into serious ones.

What your compliance team receives

• Each finding mapped to the ECC controls it affects, in a format your compliance team can file as audit evidence
• A scope section listing every service tested, so you can show what the test covered
• An executive summary for leadership, a technical report for your engineers and a remediation roadmap prioritised by risk and effort
• One retest of all confirmed findings within 90 days at no extra cost, then a closure letter recording the status of each finding
• Every deliverable in Arabic, English or both

We do not issue certifications or carry out official compliance assessments. The NCA assesses compliance itself, through field audits, self-assessment by entities or another method it chooses.

How often to test

The ECC requires penetration tests to be carried out periodically (2-11-3-2) and leaves the interval to the requirements you document and approve under 2-11-1. When you set it, take account of the other rules you follow. SAMA's Cyber Security Framework, for example, calls for annual tests of customer and internet-facing services. Testing again after a major change, such as a new app or a move to a new platform, keeps your evidence current.

Control 2-11-4 also asks you to review periodically how you apply your penetration testing requirements, so keep every report and closure letter.

Common questions