Security testing rules in Saudi Arabia.

Issued by SAMA circular and listed In-Force in the SAMA Rulebook. Member organizations must adopt it and should operate at maturity level 3 or higher. Where a control cannot be applied, the entity should use compensating controls, accept the risk internally and request a formal SAMA waiver.

“To maintain the protection of information assets and online services, the Member Organizations must adopt the Framework.”

Sec. 1.1; Sec. 1.5; Sec. 2.2; Sec. 2.4

Sec. 1.4 lists all banks, insurance and reinsurance companies, financing companies and credit bureaus operating in Saudi Arabia, and the financial market infrastructure. Non-bank institutions are exempt from some subdomains. The Rulebook’s current scope line reads banking, finance, payment systems and payment service providers, credit bureaus and the regulatory sandbox, and does not list insurance.

“The Framework is applicable to all Member Organizations regulated by SAMA, which include the following:”

Sec. 1.4; SAMA Rulebook header (Scope of application)

Customer and internet facing services need an annual review and penetration test. Critical information assets need periodic cyber security reviews, and the change management process should include penetration testing where applicable.

“Customer and internet facing services should be subject to annual review and penetration tests.”

Sec. 3.2.4, control considerations 1 and 2; Sec. 3.3.7, control consideration 4(b)(1)

Sec. 3.3.16 requires a threat intelligence management process using internal and external sources, but no clause ties threat intelligence to test scope or scenarios.

The only tester requirement is independence: the security event management process must include independent periodic testing of SOC effectiveness, for example red teaming. There are no qualification, certification or accreditation rules for penetration testers.

“independent periodic testing of the effectiveness of the security operations center (e.g., red-teaming).”

Sec. 3.3.14, control consideration 4(l)

The text does not say who performs penetration tests. The SOC test must be independent, which does not by itself rule out an internal team that is independent of the SOC.

Awareness programs must cover threats such as spear-phishing and be evaluated for effectiveness (Sec. 3.1.6, control considerations 5(c) and 6). No phishing simulation or social engineering test is named.

Sec. 3.3.2 requires a physical security process whose effectiveness is monitored, measured and periodically evaluated. No physical intrusion test is named.

Contract management must cover risk-based testing of the agreed cyber security requirements and the right to periodically review and audit the third party. Sec. 3.4 defines third parties to include outsourcing and cloud providers, vendors and government agencies. Pooled or joint tests are not mentioned.

“The contract management process should cover requirements for: ... testing of the agreed cyber security requirements (risk-based);”

Sec. 3.4 (introduction); Sec. 3.4.1, control considerations 4(c) and 5(d)

No mention of operational technology or industrial control systems.

Sec. 3.2.3 requires compliance with PCI-DSS, EMV and SWIFT CSCF (March 2017), and Sec. 3.3.12 points to SARIE and mada security rules. The CSF itself sets no testing rule for payment systems; ATM controls in Sec. 3.3.13 cover prevention and detection, not testing.

Coding correction, not a regulatory change. The cloud policy must give the member organization the right to perform a cyber security review, audit and examination at the cloud provider. Under the harmonization rule, contract rights to audit a supplier are assurance_only. The September cell missed control consideration 4(g).

“the Member Organization has the right to perform a cyber security audit at the cloud service provider;”

Sec. 3.4.3, control consideration 4(g)(1) to 4(g)(3)

Corrected October 30, 2026 from Not addressed. Coding correction, not a regulatory change. The cloud policy must give the member organization the right to perform a cyber security review, audit and examination at the cloud provider. Under the harmonization rule, contract rights to audit a supplier are assurance_only. The September cell missed control consideration 4(g).

Sec. 3.4.3, control consideration 4(b) says cloud services should in principle be located in Saudi Arabia and use abroad needs explicit SAMA approval. That is a data location rule, not a testing rule.

No purple team or replay requirement.

Review results, issues and recommended actions must be recorded and reported to the business owner, then follow-up reviews check that all issues were addressed. Sec. 3.3.17 requires defined mitigation timelines per vulnerability class. No fixed deadline is set.

“Cyber security review should be subject to follow-up reviews to check that: a. all identified issues have been addressed;”

Sec. 3.2.4, control considerations 3 to 5; Sec. 3.3.17, control consideration 3(d)

SAMA reviews and audits member organizations’ self-assessments. Penetration test results are reported to the business owner; the CSF does not require sending them to SAMA.

“The self-assessments will be reviewed and audited by SAMA to determine the level of compliance with the Framework and the cyber security maturity level of the Member Organization.”

Sec. 2.3; Sec. 3.2.4, control consideration 4

Automation appears only for monitoring and access management (maturity level 4 in Sec. 2.4.2, SIEM in Sec. 3.3.14, Sec. 3.3.5), not for testing.

Issued by SAMA circular and listed In-Force in the SAMA Rulebook. The text says SAMA mandates the framework and may require any member organization to run a test, though most operative clauses use ‘should’.

“The framework is mandated by SAMA. SAMA is the owner and is responsible for periodically updating the Framework.”

Sec. 1.4; Sec. 1.3

Applies to every financial institution regulated by SAMA. The Rulebook lists the banking sector, finance sector, payment systems and payment service providers, and credit bureaus. SAMA may select any member organization for a test, and entities may also run tests on their own.

“The Framework applies to all Member Organizations in the Financial Sector, which are regulated by SAMA. SAMA has the authority to select any Member Organization and request the organization to perform a red teaming test”

Sec. 1.3; SAMA Rulebook header (Scope of application)

Each member organization should be tested at least once every three years. SAMA can also request a test at any time based on emerging threats or threat intelligence.

“Each Member Organization within the Financial Sector of Saudi Arabia and are regulated by SAMA should be tested, as a minimum once every three (3) years, in line with this framework.”

Sec. 1.6; Sec. 1.3

SAMA’s Green Team and the entity’s White Team each supply threat intelligence; the provider adds its own and derives the scenarios. Detailed scenarios are mapped to critical assets using external, internal and sector-wide intelligence and must be agreed with the Green Team. The scenario phase lasts up to five weeks.

“Based on the combined threat intelligence the Red Team determines the attack scenarios and strategies.”

Secs. 2.5, 4.1, 4.2, 4.4

The provider is external, pre-selected and appointed by SAMA’s Green Team. Appendix A lists 7 experience criteria and 13 method, governance and data handling criteria, and suggests certifications such as CREST CCSAM and CCSAS, OSCP, GPEN, CISSP and CISM. The certifications are suggested, not mandated.

“The Green Team will appoint the red team provider, who are pre-selected to execute the Red Teaming tests, based on their experiences and skilled staff.”

Sec. 2.1(4); Sec. 3.3; Sec. 3.5; Appendix A

The framework defines the Red Team as an external, selected third party and gives no route for in-house testers. It does not state a prohibition in those words.

“The Red Team, a selected third party that executes the attack scenarios and consists of certified and experienced specialists.”

Sec. 2.1(4); Sec. 2.2 (Red Team)

The kill chain the red team simulates lists phishing and social engineering as delivery means, and reconnaissance covers staff names, emails and interests. No clause requires a social engineering scenario.

“The transmission of the crafted attack to the victims by the use of different means, such as: email (attachments), phishing, websites, physical devices or social engineering.”

Sec. 2.4 (stage 1 Reconnaissance; stage 3 Delivery)

Only physical devices and removable media appear, as ways to deliver an attack. Physical entry into premises is not mentioned.

“The transmission of the crafted attack to the victims by the use of different means, such as: email (attachments), phishing, websites, physical devices or social engineering.”

Sec. 2.4 (stage 3 Delivery; stage 4 Exploitation)

Third parties appear only as the red team provider. The tested entity’s suppliers and service providers are not named as targets or participants, and pooled tests are not mentioned.

No mention of operational technology or industrial control systems.

Payment system operators and payment service providers are in scope as entities (Rulebook header), but the text does not name payment systems, SWIFT or card systems as test targets. Targets are the entity’s own critical assets (‘flags’).

Cloud appears only in Appendix A(10): any agreed data exfiltration should be stored encrypted and locally, not at cloud providers. Cloud services are not named as test scope.

No provision on foreign group entities, multi-jurisdiction tests or mutual recognition.

After the final red and blue team reports and a 360 degree feedback session, the White Team organizes a joint Red and Blue Team Replay Exercise. Repeat replays for IT staff and senior management are strongly suggested.

“After the feedback session, a Replay Exercise should be organized, led by the Blue and Red Team.”

Sec. 6.1; Sec. 6.2; Sec. 6.3

The White Team drafts a remediation plan with priorities and agreed due dates, shares it with SAMA’s Green Team and reports progress periodically to the entity’s cyber security committee and the Green Team. No retest is required.

“The White Team shares the internally agreed and approved remediation plan with the Green Team and periodically track the remediation progress to ensure that the vulnerabilities identified are monitored and mitigated.”

Sec. 6.4; Sec. 6.5; Appendix B (Remediation Plan)

SAMA supplies the Green Team and Test Manager, approves the provider, the scoping document, the scenarios and the final plan, and receives a copy of the final report. An anonymized summary goes via SAMA to sector committees such as the Banking Committee for Information Security.

“The final report should be agreed upon by all Teams involved and copy of the report should be submitted to SAMA by the provider.”

Sec. 2.1(1); Sec. 2.2 (Green Team); Secs. 3.3, 3.6, 4.5, 5.4; Appendix B (RTTSR)

No mention of automated, continuous or AI-driven testing or of AI systems.

The document calls its controls mandatory requirements, and SAMA may refuse a license or sandbox graduation to an entity that cannot show compliance.

“the fundamental requirements sets the essential cyber security and resilience mandatory requirements for entities that are within the scope of applicability.”

Sec. 2.2; Sec. 1.4

Applies to entities seeking a SAMA license or entry to the Regulatory Sandbox, meant for recently established entities. The Rulebook lists finance, payment systems and payment service providers, money exchange and the sandbox. It does not replace the CSF once an entity is licensed.

“The framework “Fundamental Requirements” applies to entities intending to qualify for SAMA Regulatory Sandbox environment and/or entities seeking license to operate in the kingdom of Saudi Arabia.”

Sec. 1 (Introduction); Sec. 1.2; SAMA Rulebook header (Scope of application)

Penetration testing at least twice a year and after any major or critical change. Vulnerability assessment is periodic, with the interval set by the entity.

“Entities should conduct penetration testing (PT) twice a year as a minimum or after major/ critical change to comprehensively evaluate its cyber security defense capability.”

Control 3.2.6; Control 3.2.5; Appendix A (Periodically)

No threat intelligence requirement tied to testing.

No rules on who performs the penetration test.

Silent on internal or external testers.

No social engineering or phishing test. Control 3.2.9 covers brand monitoring of apps, social media and websites.

No physical security testing.

No third-party control of any kind.

No mention of operational technology.

Payment service providers are in scope as entities, but no clause names payment systems as test targets.

No mention of cloud.

No cross-border provision, though the sandbox admits international firms (Sec. 1).

No purple team or replay requirement.

No rule on fixing penetration test findings. Control 3.2.7 requires timely patching and Control 3.1.6 a monitored risk register, neither tied to test results.

Entities send a self-assessment to SAMA, which may review it and may audit compliance at any time.

“SAMA also reserves the right to audit the compliance with the fundamental requirements of the entities at any time.”

Sec. 2.3

Entities must adopt and evaluate protections against attacks on machine learning models. This concerns defending AI systems, not AI-driven testing.

“adoption and evaluation of cyber security measures for the protection against adversarial attacks (e.g. model stealing, malicious inputs, and poisoning attack).”

Control 3.1.4(b)

Binding under Article 10(3) of the NCA Statute and High Order No. 57231. The Arabic text is the binding version.

“all entities within the scope of these Controls shall take all necessary measures to ensure ongoing and continuous compliance with these Controls.”

Implementation and Compliance; Executive Summary

Government agencies and their affiliated companies and entities inside and outside the Kingdom, plus private entities that own, operate or host critical national infrastructure. Other entities are encouraged but not required to apply it. Banks designated as CNI fall under both ECC and SAMA rules.

“These Controls are applicable to government agencies in the Kingdom of Saudi Arabia (including ministries, authorities, establishments and others) and their affiliated companies and entities (inside and outside the kingdom), as well as all private sector entities owning, operating, or hosting Critical National Infrastructures (CNIs)”

ECC Scope of Work

The control requires periodic tests without an interval. NCA’s GECC-2:2026 guide tells entities to set an annual penetration testing schedule in an action plan. Scope is all services offered over the Internet and their components (Control 2-11-3-1).

“Conducting penetration tests periodically.”

Subcontrol 2-11-3-2; GECC-2:2026 guidance on 2-11-3-2

Subcontrols 2-13-3-4 and 2-13-3-5 require sharing threat intelligence with NCA and handling threat feeds, but nothing ties threat intelligence to penetration test scope or scenarios.

The ECC is silent on testers. NCA’s implementation guide tells entities to write their own requirements for the testing team into a penetration testing policy but sets none itself. Separately, NCA registration has been required since August 1, 2022 for any provider of cybersecurity services in the Kingdom.

“Define the requirements for the team responsible for performing the penetration testing.”

GECC-2:2026, guidance on Control 2-11-1; NCA Registration and Licensing page

Neither the ECC nor the GECC says whether tests must be internal or external.

Subcontrol 1-10-3-1 requires awareness training on phishing emails, and the GECC names social engineering as awareness content. No phishing simulation or social engineering test is required.

Subdomain 2-14 sets physical security requirements and periodic review, with no physical test.

Test scope covers all externally provided services and their technical components, which may be run by suppliers, but third parties are not named. Subdomain 4-1 sets contract clauses only.

ECC-2 deleted the Industrial Control Systems domain (domain 5) of ECC-1 and moved it to the OTCC.

No mention of payment systems. SWIFT and PCI appear only as examples of international requirements in the definitions.

Subdomain 4-2 covers cloud and hosting security, with no testing rule. ECC-2 moved data localization rules to the National Data Management Office.

The controls, including penetration testing, apply to government affiliates inside and outside the Kingdom; ECC-2 added the words ‘inside and outside the kingdom’. Managed security operations centers that use remote access must be located fully in Saudi Arabia.

“Cybersecurity managed service centers for monitoring and operations which use remote access shall be fully located in the Kingdom of Saudi Arabia.”

ECC Scope of Work; Appendix (C) (scope modification); Subcontrol 4-1-3-2

No purple team or replay requirement.

Vulnerabilities must be remediated according to their classification and risk, and audit results must include remediation plans. No deadline or retest is tied to penetration test findings.

“Vulnerabilities remediation based on their classification and the associated cyber risks.”

Subcontrol 2-10-3-3; Control 1-8-3

NCA assesses compliance through self-assessments, compliance tool reports and field audits. It does not run or receive individual tests.

“The NCA shall evaluate the entities’ compliance with the ECC through multiple means, such as self-assessment by the entities, periodic reports of the compliance tool, and/or field auditing visits, in accordance with the mechanism deemed appropriate by the NCA.”

Implementation and Compliance

Artificial intelligence appears only in the executive summary as a general trend. The GECC mentions automated channels for compliance review, not testing.

Unchanged. All entities in scope must achieve full and continuous compliance. CSCC-2 drops the compliance period that CSCC-1 allowed. Quote is Arabic, the binding text. English summary is ours.

“يجب على جميع الجهات ضمن نطاق عمل هذه الضوابط تنفيذ ما يحقق الالتزام الكامل والمستمر بهذه الضوابط.”

CSCC-2:2026, Implementation and Compliance (p. 9)

Code unchanged. Scope now reads “national entities” instead of “public entities” (Appendix D). It covers government bodies inside and outside the Kingdom, their companies and private entities that own or operate critical systems. Critical systems are now identified by criteria in NCA’s Haseen portal, not by criteria printed in the document.

“يجب تطبيق هذه الضوابط على الأنظمة الحساسة -وفقاً للمعايير المذكورة في هذه الوثيقة- من قبل الجهات الوطنية المالكة أو المشغلة لهذه الأنظمة، سواء أكانت جهات حكومية (مثل وزارات وهيئات ومؤسسات وسفارات وغيرها) داخل المملكة العربية السعودية؛ أو خارجها، أو جهات وشركات تابعة للجهات الحكومية، أو جهات القطاع الخاص”

CSCC-2:2026, Scope of Work and Applicability (p. 8); Critical Systems Identification Criteria (p. 7); Appendix D

Unchanged. Critical systems must be penetration tested at least every six months. Test scope must cover all technical components and all internal and external services (2-10-1-1).

“يجب عمل اختبار الاختراق على الأنظمة الحساسة، كل ستة أشهر؛ على الأقل.”

CSCC-2:2026, Control 2-10-2; Subcontrol 2-10-1-1 (p. 17)

Unchanged. The penetration testing objective mentions simulating real attack techniques, but no clause ties threat intelligence to test scope or scenarios.

Unchanged. Tests must be run by a qualified team. Qualification is not defined.

“عمل اختبار الاختراق من قبل فريق مؤهل.”

CSCC-2:2026, Subcontrol 2-10-1-2 (p. 17)

Unchanged. The text does not say whether the qualified team may be in-house.

Unchanged.

Unchanged.

Unchanged. Domain 4 requires vetting of outsourcing staff and national providers for outsourced and managed services on critical systems (4-1-1-1, 4-1-1-2), with no testing rule.

Unchanged. Operational technology appears only in the executive summary.

Unchanged.

Unchanged code. Hosting rule changed: critical systems must be hosted in the entity’s own data center, the National Information Center or a sovereign cloud (4-2-1-1). CSCC-1 also allowed CCC-compliant government or Saudi cloud providers. No rule on testing cloud services.

Unchanged code. Remote access to critical systems from outside the Kingdom stays prohibited (2-2-1-1). Scope still covers government bodies abroad. The new hosting rule (4-2-1-1) keeps critical systems in the entity’s data center, the National Information Center or a sovereign cloud.

“منع الدخول عن بعد من خارج المملكة.”

CSCC-2:2026, Subcontrol 2-2-1-1 (p. 14); Subcontrol 4-2-1-1 (p. 20); Scope of Work and Applicability (p. 8)

Unchanged.

Unchanged. Vulnerabilities must be assessed and remediated monthly for external and internet-facing critical systems and quarterly for internal ones (2-9-1-2). Newly found critical vulnerabilities must be fixed immediately (2-9-1-3).

“معالجة فورية للثغرات الحرجة (Critical Vulnerabilities) المكتشفة حديثاً؛ مع اتباع آليات إدارة التغيير، المعتمدة لدى الجهة.”

CSCC-2:2026, Subcontrols 2-9-1-2 and 2-9-1-3 (p. 17)

Code unchanged. NCA now assesses compliance through its Haseen portal and on-site audit visits. CSCC-1 named self-assessment and field visits. NCA reported inspection visits to national entities on September 8, 2026.

“تقوم الهيئة بتقييم التزام الجهات بما ورد في هذه الضوابط من خلال بوابة حصين والقيام بالزيارات الميدانية للتدقيق، وفق الآلية التي تراها الهيئة مناسبة لذلك.”

CSCC-2:2026, Implementation and Compliance (p. 9); Appendix D

Unchanged. Artificial intelligence appears only in the executive summary, not in any testing control.

Binding under Article 10(3) of the NCA mandate and Royal Decree 57231. Organizations comply at the control level set for each facility (L1 high, L2 moderate, L3 low criticality).

“All applicable organizations must implement all necessary measures to ensure continuous compliance with these controls”

Executive Summary; Implementation and Compliance; OTCC Controls and Sub-controls Levels

Industrial control systems in facilities deemed critical, owned or operated by government bodies or private CNI operators, in the Kingdom or abroad. Controls apply only where they will not jeopardize operational continuity.

“These controls are applicable to Industrial Control Systems (ICSs) that reside in facilities that are deemed critical and owned and/or operated by government organizations ... as well as private sector organizations owning, operating or hosting Critical National Infrastructures (CNIs), whether they are in the kingdom or abroad”

Scope of Work; Statement of Applicability

OT penetration tests every 3 months at L1, 6 months at L2 and 12 months at L3. Vulnerability assessments follow the same cycle (2-9-1-3).

“With reference to the ECC subcontrol 2-11-3-2, penetration testing for OT/ICS systems must be conducted periodically.”

Subcontrol 2-10-1-3 (control level table, p. 31)

At L1, threat intelligence must identify TTPs of groups targeting OT (2-12-1-8) and tune SIEM alerts (2-11-1-9). Neither is tied to penetration test scope or scenarios.

At L1, test scope must cover the OT environment and connected networks, delivered by a qualified team. No definition, certification or accreditation is given.

“scope and activities of penetration testing must be defined to ensure the coverage of OT/ICS environment and networks connected to the operational network by qualified team.”

Subcontrol 2-10-1-1 (L1 only, p. 31)

Silent on internal or external testers.

At L1 and L2, physical security readiness must be tested periodically through simulation exercises, with social engineering given as the example. No interval is set.

“Physical security capabilities and readiness must be periodically tested by performing simulation exercises (such as social engineering).”

Subcontrol 2-13-1-9 (L1 and L2, p. 34)

At L1 and L2, physical security capabilities around OT assets must be tested periodically through simulation exercises. This is the only Saudi text reviewed that requires a physical test.

“Physical security capabilities and readiness must be periodically tested by performing simulation exercises (such as social engineering).”

Subcontrol 2-13-1-9 (L1 and L2, p. 34)

At L1 and L2, cybersecurity requirements must be part of acceptance testing, including Factory Acceptance Testing, which the glossary places at the vendor’s facility. Vendor personnel work on site must be monitored (2-13-1-7). No red team or penetration test of suppliers is required.

“Cybersecurity requirements must be included as part of any functional and acceptance testing and evaluation process (such as Factory Acceptance Testing “FAT” , Site Acceptance Testing “SAT”, Commissioning Testing, Change Testing, Integration Testing and Source Code Review).”

Subcontrol 1-4-1-2 (L1 and L2, p. 19); Terms and Definitions (Factory Acceptance Test)

OT penetration testing is required at every level. At L1, tests must have limited or no production impact or run on an identical separate environment, and passive methods must be defined where impact is possible.

“penetration testing must only be conducted with limited or no impact on the production environment, or on an identical separate environment.”

Subcontrols 2-10-1-2, 2-10-1-3, 2-10-1-4 (p. 31)

No mention of payment systems.

No mention of cloud.

Scope covers in-scope facilities in the Kingdom or abroad. Remote access to OT networks is exceptional and must be risk assessed, time limited and recorded (2-2-1-7).

“whether they are in the kingdom or abroad”

Scope of Work; Subcontrol 2-2-1-7

No purple team or replay requirement. At L1 and L2, incident response must be tested through cyber-attack simulation exercises (2-12-1-7), and BCP and DRP through tabletop exercises (3-1-1-6).

At L1, newly found critical vulnerabilities with significant risk must be remediated in a timely manner. No deadline or retest is tied to penetration test findings.

“remediation of newly discovered critical vulnerabilities presenting significant risks to the OT/ICS environment must be performed in a timely manner.”

Subcontrol 2-9-1-2 (L1 only, p. 30)

NCA assesses compliance through self-assessment and field audits by NCA or third parties it designates.

“NCA evaluates the organization’s compliance with the (OTCC:1-2022) through multiple means such as self-assessment by the Organization and/or audit field visits by NCA or designated third-parties”

Implementation and Compliance

Automation appears for asset inventory (2-1-1-2) and change detection (1-5-3-5), not testing.

CMA calls the document guidelines for all capital market institutions, says CMA may apply it to any entity it supervises, and says its “Main Controls” are mandatory. The Arabic text, which CMA names as the official reference, says CMA has the right to impose it.

“This document is considered as “guidelines” to all capital market institutions. CMA may apply this document to any entity under follow-up and supervision of CMA.”

Sec. 2.3 (Applicability); Sec. 3.1; Disclaimer

Saudi capital market institutions under CMA supervision, such as brokers and asset managers. Market infrastructure operators are not named.

“The Guidelines clarifies Cybersecurity controls for Saudi capital market institutions under the supervision of CMA.”

Sec. 2.2 (Scope of Work)

All external online services need a penetration test at least once a year. Change management must also include security testing with penetration testing (4.3.3, main control 2(2)).

“Conducting penetration testing for all external (Online) services annually at minimum.”

Sec. 4.3.10, main control 5(5); Sec. 4.3.3, main control 2(2)

Sec. 4.3.9 requires a threat management process fed by internal and external threat intelligence sources, but no clause ties it to test scope or scenarios.

The only tester rule is independence: the SOC must be tested periodically and independently, for example by a red team. No qualification or certification rule for penetration testers. Coded the same way as SAMA CSF 3.3.14.

“Conducting a periodic and independent test to verify SOC effectiveness (For example: Red Team).”

Sec. 4.3.8, main control 7(12)

The text does not say who runs penetration tests. The SOC test must be independent.

Awareness programs must cover threats such as phishing (4.1.4, main control 4(2)). No phishing simulation or social engineering test is named.

Sec. 4.3.14 requires physical security controls whose effectiveness is measured and periodically evaluated. No physical intrusion test is named. Coded the same way as SAMA CSF 3.3.2.

Contracts must give an authority to audit and review the supplier and must cover risk-based testing of the agreed controls. Third parties include outsourcing, cloud and government providers (Sec. 4.4). Supplier systems are not placed in the institution’s own test.

“Test the agreed cybersecurity controls (Risks-Based Testing).”

Sec. 4.4.1, main controls 4(2) and 5(4); Sec. 4.4 (introduction)

The text is silent on this point.

E-trading services have their own controls (4.3.13) and fall within the annual test of external online services, but no clause names payment, card or market infrastructure systems.

The cloud policy must give the institution the right to review, audit and inspect the cloud provider. No rule on testing cloud services.

“The market institution shall have the right to conduct cybersecurity review, audit and inspection of the cloud computing service provider.”

Sec. 4.4.3, main control 4(8)

Outsourced security monitoring must use providers in Saudi Arabia, and cloud services must be in Saudi Arabia (4.4.3, main control 4(3)). The head of cybersecurity must be Saudi (4.1.1, main control 2).

“Outsourcing is limited to providing security operations monitoring services for service providers within KSA.”

Sec. 4.4.2, main control 5; Sec. 4.4.3, main control 4(3)

The text is silent on this point.

The vulnerability management process must set patch timelines by severity. Review results must be documented and reported (4.2.2). No retest rule.

“Setting timelines to patch vulnerabilities, based on their classification;”

Sec. 4.3.12, main control 3(4); Sec. 4.2.2, main control 2

Implementation is subject to periodic self-assessment through questionnaires on a mechanism CMA sets. Test results are not sent to CMA. Cyber incidents are reported to CMA (4.3.7).

“Implementation of the Guidelines in market institutions is subject to periodic self-assessment based on questionnaires and self-assessment forms according to a mechanism that CMA deems appropriate.”

Sec. 3.2

Automation appears only for access management and log analysis, not testing.

Cloud providers and government or CNI tenants in scope must comply continuously, by provider level 1 to 4 (Annex A). The Arabic version is binding.

“all CSPs and CSTs within the scope of these controls must implement whatever necessary to ensure continuous compliance with the CCC”

Implementation and Compliance

Tenants in scope are government bodies inside or outside the Kingdom, their companies and private CNI operators that use cloud services. Providers in scope are any cloud provider serving them.

“CSPs within the scope of CCC are any CSP which provides cloud computing services to the CSTs within the scope of work.”

CCC Scope of Work

Cloud providers must penetration test the cloud technology stack at least every six months, at all four provider levels (Annex A, Table 2). Tenants have no CCC test control and fall back on ECC 2-11-3.

“Scope of penetration tests must cover Cloud Technology Stack and must be conducted at least once every six months.”

Subcontrol 2-10-P-1-1

Providers must subscribe to specialized groups to stay current on threats (2-12-P-1-1), but no clause ties this to testing.

CCC sets no tester rule. ECC applies alongside it.

The text is silent on this point.

The text is silent on this point.

Subdomain 2-13 requires monitoring of access to provider sites, with no testing rule.

CCC regulates the cloud suppliers of government bodies and requires each to penetration test the stack that serves them every six months. Coded on the same basis as FedRAMP in the US slice. Tenants need not test the provider or obtain its report.

“Scope of penetration tests must cover Cloud Technology Stack and must be conducted at least once every six months.”

Subcontrol 2-10-P-1-1; CCC Scope of Work

The text is silent on this point.

PCI and SWIFT appear only as examples of international standards in the glossary.

Provider penetration tests must cover the cloud technology stack. This is the first Saudi text found that puts cloud infrastructure inside a mandatory test.

“Scope of penetration tests must cover Cloud Technology Stack and must be conducted at least once every six months.”

Subcontrol 2-10-P-1-1

Tenants abroad are in scope. Cybersecurity positions in provider data centers in the Kingdom must be held by Saudi nationals (1-4-P-1-1). CCC-2 deleted the data localization controls and refers entities to the National Data Management Office (Annex D).

“CSTs within the scope of CCC are any government agency in the Kingdom of Saudi Arabia inside or outside the Kingdom”

CCC Scope of Work; Subcontrol 1-4-P-1-1; Annex D

The text is silent on this point.

Providers must assess and remediate vulnerabilities monthly for external and quarterly for internal stack components. Tenants must do so at least quarterly (2-9-T-1-1).

“Assessing and remediating vulnerabilities on external components of Cloud Technology Stack at least once every month, and at least once every three months for internal components of Cloud Technology Stack.”

Subcontrols 2-9-P-1-1 and 2-9-T-1-1

NCA checks compliance through self-assessments, compliance tool reports and on-site audits.

“NCA evaluates entities’ compliance with the CCC through multiple means such as self-assessments by the entities, periodic reports of the compliance tool or on-site audits.”

Implementation and Compliance

Automation appears only for monitoring remote access sessions (2-11-P-1-7), not testing.

Entities in scope must comply continuously. The Arabic version is binding.

“all organizations within the scope of these controls must implement whatever is necessary to ensure continuous compliance with the controls.”

Implementation and Compliance

Government bodies, their companies and private CNI operators that allow telework.

“Every organization that allows telework must comply with all applicable controls in this document.”

TCC Scope of Work; TCC Statement of Applicability

Telework systems must be penetration tested at least once a year, covering all their technical components (2-10-1-1).

“penetration tests must be conducted on telework systems at least once every year.”

Control 2-10-2; Subcontrol 2-10-1-1

Threat intelligence appears only in incident and threat management (2-12-1-2), not testing.

The text is silent on this point.

The text is silent on this point.

The text is silent on this point.

The text is silent on this point.

The text is silent on this point.

ICS appears only in the ECC reference figure.

The text is silent on this point.

Hosted telework systems must be in the Kingdom (3-1-1-1), with no rule on testing cloud services.

TCC scope covers organizations in the Kingdom only. Hosted telework systems must be in Saudi Arabia (3-1-1-1), and remote access from outside the Kingdom must be monitored (2-11-1-4). Neither rule limits who may test or from where, and neither reaches foreign entities.

The text is silent on this point.

Vulnerabilities in telework systems must be assessed and remediated at least every three months.

“Remediating vulnerabilities for telework systems, at least once every three months.”

Subcontrols 2-9-1-1 and 2-9-1-2

NCA checks compliance through self-assessments and external compliance assessments.

“NCA evaluates organizations’ compliance with the TCC through multiple means such as self-assessments by the organizations, and/or External Compliance Assessment.”

Implementation and Compliance

Artificial intelligence appears only in the introduction.

Issued by SAMA circular; in force from the issue date (para 35).

“Banks shall conduct a comprehensive testing program to ensure cyber resiliency and controls effectiveness of the systems and applications used in the IPO process”

Para. 24; para. 35

Testing covers the systems and applications used in the IPO process, not the whole bank.

“These Rules apply to all banks that take part in an IPO of Securities, whether inside or outside Saudi Arabia, in the capacity of:”

Para. 3 (Scope); para. 24

No cycle is set. Banks must ensure all relevant systems are effective before starting an IPO (para 6). The program must include vulnerability assessment, penetration testing and compromise assessment (para 24(a) to (b)).

“Banks shall ensure the effectiveness of all relevant systems before commencing an IPO.”

Para. 24; para. 6

The text is silent on this point.

The text is silent on this point.

The text is silent on this point.

The text is silent on this point.

The text is silent on this point.

Para 26 requires measures against third-party dependency risk and readiness of third-party arrangements, with no test or audit right.

The text is silent on this point.

Test scope is IPO process systems, which handle subscription money (definition of receiving bank), but no clause names payment, card or market infrastructure systems.

The text is silent on this point.

The rules apply to banks taking part in an IPO inside or outside Saudi Arabia. Coded on the same basis as the ECC scope.

“These Rules apply to all banks that take part in an IPO of Securities, whether inside or outside Saudi Arabia”

Para. 3

The text is silent on this point.

The text is silent on this point.

A bank acting as receiving bank for the first time, or in a large-scale or government offering, must notify SAMA in advance and prove its operational capacity. Test results are not sent to SAMA.

“the bank shall notify SAMA in advance and, in particular, prove its financial and operational capacity to process the share applications”

Para. 12

The text is silent on this point.