EMRA (EPDK) Penetration Testing and ICS Security Testing

The Regulation on the Cybersecurity Competency Model in the Energy Sector was published in Official Gazette No. 32213 on 6 June 2023. The Security Analysis and Testing Procedures for Industrial Control Systems Used in the Energy Sector followed in Official Gazette No. 32250 on 16 July 2023.

The regulation covers activities such as electricity and natural gas distribution and transmission, crude oil pipeline transmission, electricity generation, natural gas storage and refining. An amendment in early 2024 extended scope to certain generation facilities.

The rules aim to establish and measure a minimum security level and maturity for ICS environments. The frequency and scope of security analysis and testing are set within the framework of the rules and depend on your licence type.

• Test areas: from review of the ICS network and architecture to vulnerability analysis and controlled exploitation, as defined in the procedures.
• Personnel competence: testers must meet competence requirements such as ICS training and specific certifications.
• Follow-up: vulnerabilities are remediated under a board-approved action plan; the report is retained and provided to EMRA on request.

We clarify with you, at the proposal stage, the certification and competence requirements the regulation sets for the testing provider.

In ICS environments we test without stopping generation or transmission, prioritizing passive methods and coordinating with maintenance windows.

• ICS/OT penetration testing: assessment of SCADA, PLCs, RTUs and engineering workstations.
• Testing of IT–OT separation and network segmentation.
• Internal and external network penetration testing and social engineering for the corporate IT network.
• A findings list ready for your action plan, plus retesting.