NESA Penetration Testing Requirements

What the standard requires

Under technical vulnerability management, the UAE Information Assurance Standards require that vulnerability assessments and penetration tests be conducted and tracked. For covered entities that lands, in practice, at annual testing - but the obligation is a cycle rather than an event, and the three parts that get assessed are:

• The test - performed, independently, against a scope appropriate to the entity.
• The remediation - critical and high findings documented and fixed, with the decisions recorded where a risk is accepted instead.
• The retest - evidence that the fixes worked, inside a defined window, typically 90 days.

Entities that fail NESA on penetration testing have almost always done the first part and not the other two.

Two requirements that change how you buy

The 90-day clock means you cannot test late

If critical and high findings must be remediated and retested inside 90 days, the scheduling consequence is unavoidable: a test run in the final month of your compliance year leaves no room to fix anything and prove it. By the time the report lands you have weeks, not a quarter.

Test with at least a quarter of runway. Where the environment is large or the last test was some time ago, more - because the remediation effort is unknown until the report exists, and a findings list heavier than expected is exactly the scenario the window is designed to stress. This single scheduling decision causes more NESA failures than any technical issue.

Assessors review who tested

NESA assessors examine the credentials of the penetration testing provider, and OSCP or equivalent is the stated expectation. This is unusually concrete - most frameworks say "suitably qualified" and leave it there - and it has a direct commercial consequence: a cheaper test performed by someone without a recognised offensive certification can be rejected at assessment, which costs you the fee, the remediation window and the retest.

So the question to ask any provider before engaging them is simply: who will perform the testing, what do they hold, and can I verify it? For this engagement the answer is OSCP+ - the current renewed form of the certification - alongside eCPPT, eWPT and eCIR, plus AZ-500, SC-200 and SC-300 on the Microsoft security side. All independently verifiable through the OffSec credential wallet, and that link goes into your evidence pack next to the report.

Scope

What a NESA-aligned engagement covers:

• External network - the full internet-facing estate, including services published and forgotten.
• Web applications and APIs - authentication, authorisation, business logic, injection, and the APIs behind mobile apps.
• Internal network - what a foothold reaches; whether segmentation holds.
• Active Directory - ADCS certificate-template abuse, Kerberoasting, delegation, ACL paths to Domain Admin. For a UAE government entity or utility this is where a small external foothold becomes a full compromise.
• Cloud - Entra ID and Azure RBAC escalation, exposed storage, identity misconfiguration.

For critical information infrastructure specifically, the question worth scoping deliberately is not just whether the perimeter holds but how far someone gets after it doesn't - which is what an assumed-breach assessment measures, and what a board or a regulator actually wants to know.

NESA and Dubai ISR together

Many organisations carry both: NESA federally, and DESC's Information Security Regulation because they are a Dubai government entity or supply one. The two run in parallel rather than one superseding the other, and their technical testing requirements overlap almost entirely.

Scoped deliberately against both at the outset, one engagement produces evidence for both - the testing is the same, the mapping differs. Scoped against one and retrofitted later, you generally end up testing twice. It costs nothing to say at scoping which regimes apply to you, and it is the single highest-leverage thing you can tell me in the first call.

The deliverable

An executive summary for leadership and the assessor, a technical body with reproduction steps, evidence and CVSS ratings, and mapping from each finding to the applicable control so your compliance team isn't building that spreadsheet themselves. Then remediation support while you fix, a retest of the closed findings - which is a NESA requirement, not an upsell - and an attestation letter recording who tested, what scope and which dates.

Anything critical is reported the moment it's found rather than held for the report. There's a sample report if you want the format before committing.

Practicalities

The work is remote. External, web application and cloud testing needs nothing from you but scope and authorisation; internal and Active Directory testing runs over a VPN or a jump host inside your environment. Where your regulator or your own policy constrains where evidence is processed or stored, that goes into the rules of engagement in writing before anything starts.

I'm in Amman, one hour behind Dubai, working the same week as the region, in Arabic or English. No UAE office and no claim of one - what you get is the person doing the testing, with credentials you can verify in under a minute.

Next steps

Tell me whether you're covered as a federal entity, as CII, or through a contract with one; what's in scope; and when your assessment falls. Fixed quote and start date back. Given the 90-day retest window, the useful question to answer first is how much runway you have - if it's under a quarter, that changes the sequencing and we should talk sooner rather than later.

Related: penetration testing in the UAE for how the regimes fit together, CBUAE, DFSA, ADGM and VARA for financial services, and the compliance overview for everything else. Get in touch - Arabic welcome.