EPDK-compliant
ICS penetration testing
Under EPDK Board Decision No. 11956, we carry out security analysis and penetration testing on SCADA and industrial control systems without putting production at risk.
What is EPDK Compliant Penetration Testing?
EPDK penetration testing is the security analysis and penetration test that licensed energy organizations must perform on their Industrial Control Systems (ICS) under the "Procedures and Principles for Security Analysis and Testing of Industrial Control Systems Used in the Energy Sector", enacted by EPDK Board Decision No. 11956 dated 13 July 2023 (Official Gazette No. 32250 dated 16 July 2023).
The test scope covers operational technology (OT) components such as SCADA, DCS (Distributed Control Systems), PLC (Programmable Logic Controllers), RTU (Remote Terminal Units) and HMI (Human-Machine Interfaces). Unlike the classic IT-focused approach, it is conducted with an ICS-centric methodology and a minimal-intervention principle on live systems, without putting production continuity at risk.
- EPDK Board Decision No. 11956 (13 July 2023) — "Procedures and Principles for Security Analysis and Testing of Industrial Control Systems Used in the Energy Sector", published in Official Gazette No. 32250 dated 16 July 2023.
- Energy Sector Cybersecurity Competency Model Regulation (6 June 2023) — defines the cybersecurity maturity levels licensees must reach and the principles for periodic assessment.
- Security analyses and penetration tests are required to be performed by independent and competent firms holding TSE 13638 qualification.
Who Is Required to Comply?
EPDK Requirements
Critical Infrastructure & ICS Security
Verifying the resilience of SCADA, DCS, PLC, RTU and HMI components against unauthorized access, manipulation and service disruption. Segmentation and transition points between the IT and OT networks (DMZ, data diodes, remote access) are tested separately.
Regulatory Compliance
Compliance with EPDK Board Decision No. 11956 and the Energy Sector Cybersecurity Competency Model (6 June 2023). Findings are reported in a format suitable for EPDK and internal audit reviews.
Incident Response
Testing ICS-CERT (incident response team) processes and incident response plans against realistic attack scenarios; measuring detection, isolation and recovery capabilities.
Continuous Monitoring
Validating anomaly detection, log collection and security monitoring capabilities across the OT network; surfacing unmonitored assets and blind spots.
Reporting
A structured report suitable for EPDK reviews, including an executive summary, technical finding details, CVSS-based risk scores and prioritized remediation steps.
Risk Management
Building an ICS asset inventory, asset-threat mapping and risk mitigation tables; prioritizing identified vulnerabilities by business impact.
Testing Process
Scope & ICS Inventory
Identifying the SCADA/DCS/PLC/RTU/HMI assets, network segments and remote access points to be tested; agreeing the test window and intervention limits with the operations team.
Security Analysis & Penetration Testing
Performing ICS network and architecture review, vulnerability scanning, wireless network tests, social engineering and controlled exploitation testing; prioritizing passive and low-impact techniques in the OT environment.
Vulnerability Validation & Analysis
Validating identified vulnerabilities by eliminating false positives, and assessing their exploitability and real business impact on the ICS.
Risk Scoring
Prioritizing findings based on CVSS and business impact; incorporating the energy continuity and safety dimension into the risk assessment.
Reporting & Verification Testing
Preparing a report suitable for EPDK reviews and confirming, via post-remediation retesting, that the vulnerabilities have been closed.
Audit-ready deliverables
Every security analysis results in documents that both the technical team can act on and that can be submitted for EPDK review.
Your questions
Is EPDK penetration testing mandatory?
Who is required to perform EPDK penetration testing?
How often should EPDK penetration testing be performed?
What is the scope of EPDK penetration testing?
Which firms can perform EPDK penetration testing?
Why does EPDK testing differ from classic IT penetration testing?
What is delivered after the test?
Request a Meeting for EPDK Compliant Penetration Testing
Meet your energy sector security requirements