Questions before you start
What we do, who tests, where we work, and what you keep whatever you decide.
- Testing
- Run by a provider you contract directly
- Saudi regulation
- NCA ECC-2:2024 and the PDPL
- Outside Saudi Arabia
- Everything else, remotely, in English
- What you keep
- Scope, register, documents and action plan
ITF Cyber does readiness, governance and advisory work. Testing is run by a qualified provider you contract directly; we scope it, read the report with you and track fixes to the retest. NCA ECC and PDPL work is for organisations in Saudi Arabia, and everything else is delivered remotely, anywhere, in English.
Answers that cost us work
A few of these go against our own interest, and the comfortable version would cost you more than it costs us.
Nobody can guarantee you pass an audit, a customer review or an NCA assessment. What can be controlled is whether every control is either evidenced or on a dated plan, and whether the person answering can defend each answer.
There is no ECC certificate. NCA checks compliance itself, through self-assessment, its compliance tool and field audits. A document sold as an ECC certificate is something NCA does not issue.
And some deadlines cannot be met honestly. If the only way to hit a date is to write records of things that did not happen, we say so at the first call and put the missing control on a dated plan instead.
The short answers
One line each. The longer answers follow, and the page named has the full picture.
| If you are asking about | Short answer | Read this |
|---|---|---|
| Testing | We scope it, compare providers with you and read the report. A provider you contract runs it. | Commissioning a penetration test |
| Live incidents | Your plan names who responds, and we help you choose that provider before you need one. | Incident response planning |
| Saudi regulation | NCA ECC-2:2024 and the PDPL. | NCA ECC readiness, PDPL readiness |
| Outside Saudi Arabia | Everything except those two, remotely, in English. | Every service |
| Certificates | We issue none. There is no ECC certificate, and ISO 27001 certification is by a body you choose. | ISO 27001, and who owns it |
| What you keep | The scope statement, the register, the documents and the action plan. | How an engagement runs |
| Prices | Quoted per scope. Each service page lists what drives the cost. | The service page |
Answered properly
Do you run the penetration test?
A qualified provider you contract directly runs it. We scope the test, help you compare providers, read the report with you and track each fix to the provider's retest.
Why pay an adviser when a testing firm will scope for free?
Because the firm that sells the test also decides what it covers. A scope written on your side starts from what you need to know, and it usually changes what gets tested.
Does NCA ECC apply to us?
ECC-2:2024 binds government bodies, their affiliates, and private organisations that own, operate or host critical national infrastructure. Many other companies meet it through a customer, when a government buyer writes ECC requirements into the contract. The clause then decides what you must show.
Does the PDPL apply to a small company?
Yes. It covers any processing of personal data in the Kingdom whatever the volume or type of data, and paper records count. SDAIA's one-year grace period ended on 14 September 2024.
Who owns ISO 27001 work?
ITF Consult, as one project. Cyber writes the security documents inside it: policies, the incident plan, supplier assessments and the ECC mapping.
Do you work outside Saudi Arabia?
Yes, for everything except NCA ECC and PDPL readiness. If you commission a test, the provider must be licensed or accepted in your own jurisdiction.
What drives the cost?
The number of entities, sites and systems in scope, how much already exists in writing, how many people must be interviewed, and whether suppliers and cloud services are included.
Can we start small?
Yes. A written scope is the first step, and you keep it whether or not you continue.
Go from here
Every service
All nine, filterable, each with its own page and its own register.
Read moreMethodHow an engagement runs
The six steps, what you hold after each, and where you can stop.
Read moreTestingCommissioning a penetration test
The buyer's side of a test, from the scope to the retest.
Read moreSaudiNCA ECC readiness
A control-by-control position against ECC-2:2024, with the evidence behind it.
Read morePart of one system
Every division keeps records to the same standard, so the second one you need works the way the first one did.
Your question is not on this page
It usually depends on your scope. A short call settles it faster than a page can, and the first thing you receive is a written scope.