What Gulf regulators actually require about penetration testing

We sell penetration testing into the Gulf, so you should read what follows knowing that. It would be easy for us to write that every regulator in the region mandates an annual test from a CREST-accredited firm, and a lot of our competitors do write exactly that. It is mostly not true, and a compliance programme built on it falls apart the first time an auditor asks which clause you are relying on.

So here is what the documents say, with the control numbers, so you can check us. Everything below was read in the issuing body’s own text in October 2026.

Saudi Arabia: the NCA controls say “periodically”

The Essential Cybersecurity Controls are now at ECC  -  2 : 2024. Penetration testing is control 2-11 - not 2-12, which is event logs and monitoring, and which we mention only because the wrong number is repeated on a lot of consultancy pages. The numbering is unchanged from ECC-1:2018.

2-11-3-1 requires the scope to cover all externally provided services over the internet: infrastructure, websites, web applications, mobile applications, email and remote access. 2-11-3-2 requires tests to be conducted periodically. That is the whole of the frequency requirement. There is no annual interval in ECC-2:2024, and anybody quoting one is inventing it. Vulnerability management is separate, at 2-10, and is also “periodic”.

Who it binds: government entities and their affiliated companies inside and outside the Kingdom, and private-sector organizations that own, operate or host Critical National Infrastructure. For everyone else the ECC is voluntary - which does not stop your enterprise customer asking you to meet it in a contract.

Saudi banking: this is where “annual” comes from

The SAMA Cyber Security Framework is still version 1.0, May 2017, and still in force. Clause 3.2.4, under Cyber Security Review, is the one worth printing: “Customer and internet facing services should be subject to annual review and penetration tests.” That is a real annual obligation, and it is where the region’s habit of saying “annual” actually comes from - but it binds SAMA-regulated financial institutions and nobody else. Clause 3.3.17, Vulnerability Management, does not mention penetration testing at all and sets no interval.

Two adjacent SAMA documents go further. The Cyber Resilience Fundamental Requirements (2022), which applies to entities in the regulatory sandbox or seeking a licence, says at 3.2.6 that entities should conduct penetration testing twice a year as a minimum, or after a major change. And the Financial Entities Ethical Red Teaming framework (2019) puts domestic systemically important entities through red teaming once every three years - which is a different exercise from a penetration test, and we have written about the difference.

The Saudi data law does not require testing

The Personal Data Protection Law (Royal Decree M/19, amended by M/148) has been in full force and enforced since 14 September 2024. Article 19 requires appropriate organisational, administrative and technical measures. Neither the law nor its Implementing Regulation mentions penetration testing, vulnerability assessment or security testing anywhere. The only assessments it mandates are data protection impact assessments and transfer risk assessments. If a proposal tells you the PDPL requires a pentest, the proposal is wrong.

The UAE: less prescriptive than people think

The UAE Information Assurance Regulation v1.1 (March 2020), the successor to what everyone still calls NESA, has 188 controls. Its mandatory, priority-one control on this subject is T7.7.1, Control of Technical Vulnerabilities - obtain and act on information about technical vulnerabilities, test systems through the development life cycle, preferably with automated tools. Penetration testing is not named in it. The words appear once, in M5.4.1, and only in the non-binding implementation guidance, as a caution that such tests should be planned, documented and repeatable. No frequency is stated anywhere.

The Cyber Security Council has since issued a version 2 of the standard. We have seen it referred to by several advisory firms with conflicting version numbers and dates, and we could not obtain the document itself, so we are not going to quote a control number from it. If somebody quotes you one, ask them for the page.

Dubai’s own standard, the DESC Information Security Regulation v2.0, binds Dubai Government Entities. Clause 8.6.1 requires technical security reviews and vulnerability tests to assess infrastructure and applications periodically - again, no interval. The only place the ISR uses the phrase “penetration testing” is 12.1.1(F), where it is listed as a source of security metrics. A version 3 was announced in January 2024; it has not been published, and digitaldubai.ae still serves v2.0.

What changed in the UAE last month

This is the newest obligation in the region and the one most likely to be missing from a proposal written earlier this year. The Central Bank of the UAE’s Operational Risk Management Regulation, C 1/2026, came into force on 14 September 2026, replacing circular 163/2018. It applies to all Licensed Financial Institutions that are juridical persons - which is a good deal broader than “banks”.

Article 7.13 requires periodic operational-risk stress testing and names penetration testing as one such test. Article 7.14 is the one that matters: periodic testing “must include penetration testing by an independent third party”, applying at least to Critical Functions, with the results presented to the board. The regulation says “periodic” rather than naming an interval - but independent and board-reported are both new, and both are specific enough to be audited against.

Separately, the Retail Payment Services and Card Schemes Regulation (C 15/2021) tells payment service providers above AED 10 million in monthly transactions to “regularly assess the necessity” of penetration and cyber-attack simulation testing. That is a duty to think about it, not a duty to do it on a schedule.

The UAE’s own data protection law, Federal Decree-Law 45 of 2021, still had no Executive Regulations as of July 2026, which is the most recent position we could confirm. Article 5 requires appropriate technical and organisational measures. No security testing duty exists in it today.

Does your tester have to be CREST-accredited?

Almost everywhere in the Gulf, no - and we are telling you that as a firm that would benefit from the opposite being true, because buyers who believe it tend to shortlist on a logo rather than on the report.

The accreditation appears nowhere in ECC-2:2024, CSCC-1:2019, CCC-2:2024, the Saudi PDPL, the UAE Information Assurance Regulation v1.1, DESC ISR v2.0, ADHICS V2, the UAE PDPL, or either Central Bank regulation. CSCC-1:2019 asks for “a qualified team”. CBUAE C 1/2026 asks for “an independent third party”. ADHICS asks for “independent (internal/external)”. SAMA’s red teaming framework lists CREST among several certifications a provider “should consider”, alongside ISACA, (ISC)², GIAC and Offensive Security - a suggestion, in an appendix.

There is one real exception, and the people repeating the claim have probably heard of it. Dubai CyberForce is a programme run by DESC with CREST International, under which Dubai government, semi-government and critical-infrastructure entities buy penetration testing and incident response only from Cyber Force Certified Companies, for which CREST accreditation is one of the stated criteria. Note the limits carefully: it is Dubai, it is public-sector and CII buyers, and the mandate is stated on CREST’s and Dubai Cyber Innovation Park’s own pages rather than in a DESC legal instrument we could find. It is not a UAE-wide rule and it is not a Saudi rule.

One thing worth watching if you buy from abroad

Saudi Arabia’s NCA already licenses managed SOC services: six companies received Tier 1 MSOC licences in March 2025, and critical-infrastructure operators must route SOC work through them. Penetration testing is not covered by that regime today.

It might be. In February 2026 the NCA put out for consultation a Regulatory Framework for Licensing Cybersecurity Services, Products and Solutions, which places vulnerability assessment and penetration testing in a Specialized License category with capital and Saudi-ownership thresholds attached. Consultation closed in March 2026 and we could not confirm whether it has been adopted. We are flagging it because it would affect us directly, and a supplier who does not mention something that could affect their own ability to serve you is not being straight with you.

So what applies to you

• A Saudi bank, insurer or financing company. SAMA 3.2.4: annual, customer and internet-facing services. If you are in the sandbox or seeking a licence, CRFR 3.2.6: twice a year.
• A Saudi government entity, or private operator of critical national infrastructure. ECC-2:2024 2-11, periodically, scope covering everything you expose to the internet. If your systems are classified critical, CSCC 2-10-2 makes it six-monthly.
• A cloud service provider selling into Saudi Arabia. CCC-2:2024 2-10-P-1-1, six-monthly, covering the whole cloud technology stack.
• A UAE licensed financial institution. CBUAE C 1/2026 Article 7.14, in force since 14 September 2026: periodic, independent, board-reported, at least for Critical Functions.
• An Abu Dhabi hospital of 21 beds or more, payer, TPA or healthcare service provider. ADHICS CO 7.1: yearly, including connected medical devices.
• A Dubai Government Entity. ISR 8.6.1, periodically - and if you are buying the testing, the CyberForce programme applies to who you may buy it from.
• Everybody else. Nothing in Gulf law compels you. Your enterprise customers and your cyber insurer will, and they will ask for the report rather than the certificate.

If your obligation is on that list, we would rather scope against the actual clause than against a number somebody put in a sales deck. Our compliance and audit page sets out what each framework asks for side by side, and the penetration testing page covers how the work itself runs.

What this means for you