ITFCyber
Make an enquiry

Ask ITF

Answers from this site. Your search stays in this tab and is not saved.

Use arrow keys to move through results, Enter to open and Escape to close.

Loading the site index.

GuidesContact
Menu
ITF Cyber
Cyber homeNCA ECC readinessPDPL readinessCommissioning a penetration testSecurity policies and governanceIncident response planningVendor securitySecure developmentSecurity awarenessEvery Cyber serviceGuides
ITF Training
Training homeAll 20 coursesEmergency responseFire safety and basic firefightingFirst aid and CPR with AEDManagement systemsFood safetyHealth and safetyLearning pathsCorporate and in-house
ITF FM
FM homeAll FM servicesAnnual maintenance contractO&M contractsPlanned maintenancePest controlMobilisationSLA and KPIWhat you receiveSectorsLocations
ITF Hygienix
Hygienix homeFORMULAZONEMEASUREDOSEThe zone planThe zone surveyColour codingZone configuratorCustom formulationVerification rounds
ITF Digital
Digital homeAll digital servicesAI agentsAudit and inspection appsMobile apps for field workDocument control systemsData extractionDashboards and reportingWebsites and web appsSectorsHow we build
ITF Health
Health homeCBAHI readinessMock surveyFacility management and safetyPolicies and recordsISO 13485Revenue cycle managementInsurance claims through nphiesHealthcare facility servicesEvery Health service
ITF Consult
Consult homeISO 9001:2026 transitionISO 14001:2026 transitionAll consult servicesISO 9001ISO 14001ISO 45001ISO 22000HACCPSFDA licence readinessISO 27001 readinessGap analysisInternal auditOur methodWhich standard do I needClosing audit findingsIndustries
About ITFThe markHow we workIndustriesWhere we workGuidesContactBook a call
Make an enquiry
العربية
ITF Cyber

Guides for the buyer's side of security

Nine guides for the person who signs the test order, reads the report or answers the regulator, each ending in something you can use without us.

Practical guides for the people who commission, read and answer for security work: test scoping and reports, scan or test, ECC and PDPL explained, ECC compared with ISO 27001 and PDPL, and a first tabletop exercise.

A vertical line follows one penetration test from the buyer's side. Choosing between a scan and a test leaves a comparison table. Scoping before signing leaves a scope checklist. Judging a sample report leaves a twelve-line checklist. A dashed band marks the test window, run by the provider the buyer contracts. Accepting the final report uses the same twelve lines. Turning findings into a fix plan leaves a fix plan template. Below, the other three guides: NCA ECC-2:2024 with a domain map and the PDPL with a twenty-line checklist under Saudi regulation, and a first tabletop exercise with a half-day agenda under resilience.A TEST, FROM THE BUYER'S CHAIRYOU LEAVE WITHTEST WINDOW · RUN BY THE PROVIDER YOU CONTRACT1WHICH TEST: SCAN OR PEN TESTCOMPARISON TABLE2SCOPE IT BEFORE YOU SIGNSCOPE CHECKLIST3JUDGE A SAMPLE REPORTTWELVE-LINE CHECKLIST4ACCEPT THE FINAL REPORTTHE SAME TWELVE LINES5TURN FINDINGS INTO A FIX PLANFIX PLAN TEMPLATETHE OTHER THREE GUIDESNCA ECC-2:2024DOMAIN MAPPDPL20-LINE CHECKLISTFIRST TABLETOPHALF-DAY AGENDASAUDI REGULATIONRESILIENCEEACH ONE ENDS IN SOMETHING YOU CAN USE WITHOUT US
Seven guides, placed where the buyer needs themThe test itself belongs to your providerSwipe to pan

In this section

Scope checklist

How to scope a penetration test

What must be settled before you sign a test order: the question, the targets, the tester's starting point and the rules of engagement.

Read moreTwelve-line checklist

What a good penetration test report contains

Is this sample report worth paying for? The nine parts of a good finding, and the signs of a scan sold as a test.

Read moreFix plan template

From penetration test report to fix plan

The PDF has arrived. Re-rating severity for your business, grouping findings by cause, and booking the retest before sign-off.

Read moreComparison table

Scan or penetration test: what you are buying

Which test answers your question: a scan, a penetration test or a red team exercise, and the order to buy them in.

Read moreDomain map

NCA ECC-2:2024 explained

Does ECC bind you, and what does it ask? The four domains, why there is no certificate, and where the first week goes.

Read morePDPL checklist

PDPL for operations managers

What the law asks of an ordinary company: records of processing, rights requests, breach notice, registration and the DPO test.

Read moreComparison table

NCA ECC vs ISO 27001

The control baseline and the management system, where evidence overlaps and what still needs assessment.

Read moreComparison table

NCA ECC vs PDPL

Cybersecurity controls and personal data obligations, with shared evidence and separate assessment results.

Read moreHalf-day agenda

Running your first tabletop exercise

How to test the incident plan without touching a system: who sits in the room, how injects work, and three starter scenarios.

Read more
/

Part of one system

Every division keeps records to the same standard, so the second one you need works the way the first one did.

ITF TrainingTaught by people who audit these systems for a living.ITF FMFacilities run like systems, with the records to prove it.ITF HygienixSix chemicals and the kit around them, specified zone by zone.ITF DigitalSoftware for audited operations, handed over with the code.ITF HealthEverything around the care, kept to one evidence standard.ITF ConsultManagement systems built with your people, not handed to them.

A question these do not cover

If the question in front of you is not answered here, a short call usually settles which test, which control set or which document comes first.

Book a readiness call