NCA ECC Penetration Testing: Control 2-11

What control 2-11 actually says

The Essential Cybersecurity Controls place penetration testing in domain 2, Cybersecurity Defence, at control 2-11. Its purpose is to assess the effectiveness of the organisation's defensive capability through simulated attack, in order to find weaknesses in the technical infrastructure that could lead to a breach.

The control breaks into three obligations, and organisations routinely satisfy the third while failing the first two:

• Define, document and approve the cybersecurity requirements for penetration testing. This is a documentation obligation in its own right - you need a written, approved statement of how testing is scoped, how often it runs, and who signs it off.
• Implement those requirements. The testing actually happens, on the cycle you documented.
• Scope the testing to cover, at minimum, internet-facing services and the technical infrastructure behind them.

The practical consequence: an entity that commissions an excellent penetration test every year but has never written down and approved its testing requirements is still non-compliant with 2-11. The assessor is reading for the policy and the approval trail as much as for the report.

The six-month trap: CSCC

If any of your systems are classified as critical, the Critical Systems Cybersecurity Controls apply on top of the ECC and raise the testing requirement for those systems to at least every six months.

This is the single most common budget and planning failure in Saudi compliance programmes. The annual assumption gets baked into procurement, the classification exercise happens later or in a different team, and the mismatch surfaces at assessment when there is no time left to run a second test. Do the classification first, then scope the testing programme around the answer - and if some systems are critical and others aren't, you can often run a smaller six-month engagement against the critical subset and a full annual engagement across everything, which is considerably cheaper than testing the whole estate twice a year.

Scoping a test that passes assessment

The control's minimum scope is internet-facing services plus the technical infrastructure behind them. That is a floor. A scope built only to the floor invites an obvious question from an assessor: if your exposure analysis stops at the perimeter, how do you know a perimeter foothold doesn't lead anywhere?

The scope that holds up without argument:

• External network - the full internet-facing estate, including the hosts and services that were published years ago and forgotten. Explicitly required by the control.
• Web applications and APIs - authentication, authorisation, business logic, injection. The technical infrastructure behind the internet-facing service, in practice.
• Internal network - what a foothold reaches, and whether segmentation holds under pressure.
• Active Directory - ADCS certificate-template abuse, Kerberoasting, delegation and ACL paths to Domain Admin. In a Saudi government or enterprise estate this is almost always where a perimeter foothold becomes a full compromise, and it is the part a scanner-based assessment will never find.
• Cloud - where workloads have moved, the Cloud Cybersecurity Controls apply alongside and the tenancy needs the same treatment: Entra ID and Azure RBAC escalation paths, exposed storage, identity misconfiguration.

The evidence package

Four artefacts, and the one most often missing is the last:

• The approved testing requirements document - this is the part of 2-11 that isn't the test.
• A scope document showing what was in and out, and why that was appropriate.
• The report: findings, CVSS ratings, reproduction steps, and explicit mapping to control 2-11.
• Remediation and retest evidence - what was fixed, when, confirmed by a retest. Risks you chose to accept need a recorded decision and a reason; acceptance is allowed, silence isn't.

An attestation letter stating who tested, against what scope, on what dates completes the package. Every engagement here includes the report, the retest and the attestation as standard rather than as paid extras, because an assessment-ready package is the actual deliverable - the report on its own isn't.

Why the tester matters

ECC doesn't prescribe a certification the way NESA does in the UAE, but the question comes up at assessment and from the government clients cascading the requirement down: who performed this, and what do they hold?

I hold OSCP+, the renewed form of the OffSec certification, with eCPPT, eWPT and eCIR alongside it, and AZ-500, SC-200 and SC-300 for the Microsoft and Azure portion of the work. All of them verify independently through the OffSec credential wallet, and that link belongs in your evidence pack next to the report.

I work from Amman on GMT+3 - identical working hours to Riyadh - in Arabic or English, remotely. Internal and Active Directory testing runs over a VPN or a jump host inside your environment, and any constraint on where evidence is processed or stored goes into the rules of engagement in writing before testing starts.

Next steps

Tell me whether CSCC applies to any of your systems, what the environment looks like, and when your assessment is. You get a fixed-price quote and a start date. If you want to see the deliverable first there's a sample report; if you want to see your current external exposure in a few minutes, the free perimeter scan does that without any commitment.

More context: penetration testing in Saudi Arabia covers how ECC, CSCC and SAMA fit together, the SAMA page covers the financial-sector requirement, and the compliance overview compares every framework. Get in touch - Arabic welcome.