Understanding mandatory pen testing requirements under NCA ECC, SAMA CSF, and how to select qualified Saudi-based security testers.