Egypt NTRA Cybersecurity Providers Register: A Buyer Checklist Before You Sign
Summary: Before your SME, clinic or private company signs for penetration testing, SOC monitoring or incident response, check the official NTRA cybersecurity providers register on the National Telecom Regulatory Authority website. Egypt’s June 2024 Regulatory Framework for Providing Cybersecurity Services bans beneficiaries from contracting with unregistered individuals or entities, and distinguishes Category-2 private-sector buyers from Level-1 and Level-2 providers. The eight-step buyer checklist below helps you match the vendor’s legal name, certificate level, authorised services and customer categories before you sign.
Many Egyptian SMEs and private clinics pick a cybersecurity vendor on price or a personal referral, then discover after signing that the name is missing from the NTRA cybersecurity providers register, that the certificate does not cover the service they bought, or that the provider’s level is not allowed to serve their customer category. This guide is written for the Category-2 buyer: how to verify a vendor before contracting — not how to register your firm as a provider, and not a rewrite of the Personal Data Protection Law website checklist.
What is the NTRA cybersecurity providers register?
In plain terms: the NTRA cybersecurity providers register is the official list, published and updated by Egypt’s National Telecom Regulatory Authority, of registered companies and accredited individuals authorised to provide cybersecurity services inside the Arab Republic of Egypt.
The Regulatory Framework for Providing Cybersecurity Services in Egypt, issued by NTRA in June 2024 and published as a PDF on the Authority’s site, governs both providers and beneficiaries. It applies from 6 August 2024, with a one-year reconciliation period. Digital Policy Alert records that after the grace period the framework was fully in force from 7 August 2025. The framework sits alongside Telecom Law No. 10 of 2003 and Anti-Cybercrime Law No. 175 of 2018.
Consult the framework PDF, the official English register page, and the October 2026 register of approved companies (PDF).
Category-1 vs Category-2: where does your clinic or company sit?
The framework defines Category-1 beneficiaries as government bodies and public business-sector companies, private companies that hold or operate critical ICT infrastructure, and licensed telecommunications companies. Category-2 beneficiaries are other private-sector companies that do not hold or operate critical ICT infrastructure and that contract for cybersecurity services. Most private companies and private clinics that are not classified as critical infrastructure sit, in practice, in Category-2.
Level-1 vs Level-2 providers
- Level-1 providers may serve both Category-1 and Category-2 beneficiaries.
- Level-2 providers may serve Category-2 beneficiaries only.
A company registration certificate is issued to a legal entity; individual accreditation is issued to a natural person. Each certificate is valid for three years and may be renewed. NTRA may suspend or cancel a certificate or remove a name from the register for breaches. Accredited individuals may not provide services on their own; they must be employed under a registered provider.
Why Category-2 buyers must check the register before signing
Section 5 of the framework (beneficiary obligations, clause 1-5) prohibits contracting for cybersecurity services with individuals or entities that do not hold an NTRA registration certificate, and requires contractual measures to ensure compliance. Providers must notify clients of their registration certificate level before contracting, and may only offer the services and customer categories authorised on their certificate. Self-provision of cybersecurity for a beneficiary’s own use needs prior written NTRA approval plus accredited staff.
For the buyer, checking the register is not a courtesy — it is an explicit contracting duty. If someone offers to work “solo” or a company does not appear on the register, the framework blocks that path.
What does the October 2026 register show?
The register PDF published on the NTRA site for October 2026 lists 47 companies with status “Accredited”, plus an official note that 19 further companies were granted provisional accreditation subject to fulfilling the requirements for permanent accreditation. Names clearly readable on the list include, among others, ISEC, Zero Sploit, Cyber Force, LIQUID C2 and Cyshield. Do not rely on an old copy you saved months ago; open the latest PDF from the NTRA site on the day you sign.
An 8-step buyer checklist before you sign with a cybersecurity vendor
The table below is a Smart One Group framework for Category-2 buyers. It does not replace advice from your legal counsel or the official framework and register texts.
| Step | What to verify | Acceptable evidence |
|---|---|---|
| 1. Confirm your category | Are you Category-1 (government / critical ICT / licensed telco) or Category-2 (private sector without critical ICT infrastructure)? | A short internal description of your infrastructure and services, plus legal advice if unsure |
| 2. Open the official register | Does the proposed company appear on the latest register published by NTRA? | The English register page or the register PDF from tra.gov.eg dated today |
| 3. Match the legal name | Does the trade name on the quote match the legal name on the register (not an informal abbreviation)? | Commercial register vs register row, plus a copy of the registration certificate |
| 4. Read the certificate level | Is the provider Level-1 or Level-2, and may that level serve your category? | Written notice from the provider of its certificate level before contracting (a framework duty) |
| 5. Match the service you need | Is the quoted service (penetration testing, red team, vulnerability assessment, SOC, incident response, digital forensics, integrated solutions, training, etc.) listed on the register row and on the certificate? | Register row + certificate scope |
| 6. Reject solo freelancers | Is an individual offering the service outside a registered provider? | Proof the individual is employed under a registered provider, plus their accreditation if any |
| 7. Check validity and status | Is the certificate still within its three-year term, not suspended or removed, and is accreditation permanent or provisional? | Issue/renewal dates on the certificate and the status column in the latest PDF |
| 8. Lock contractual duties | Does the contract cite NTRA registration, service scope, an NDA, and notice of any change to the certificate? | Contract clause + non-disclosure agreement before work starts |
Which services does Annex 1 of the framework cover?
Annex 1 includes, among others: Penetration Testing, Red Team services, Vulnerability Assessment, SOC monitoring, Incident Response, Digital Forensics, Integrated Solutions & Consulting, Training, and cybersecurity cadre classification. A provider may not sell you a service outside the scope on its certificate even if its name appears on the register.
Registration and renewal fees are paid by provider companies to NTRA; they are not an invoice the buyer pays to the Authority. For context only, the framework’s Level-1 tables list, for example, penetration testing issue/renewal at EGP 125,000 (temporary EGP 40,000) with an application fee of EGP 2,000; red team EGP 75,000; vulnerability assessment EGP 50,000; SOC EGP 120,000; incident response EGP 50,000; digital forensics EGP 50,000; integrated solutions EGP 150,000; and training EGP 75,000. Level-2 fees are lower (for example penetration testing EGP 30,000 and application fee EGP 1,000). Individual accreditation: application EGP 1,000 plus issue/renewal EGP 4,000. These figures explain provider-side compliance cost — not what you remit to NTRA as a buyer.
Common mistakes when contracting cybersecurity services
- Trusting a business card or website without opening the latest register PDF on signing day.
- Confusing a company registration certificate with an individual’s accreditation, or accepting a “solo” freelancers’ quote.
- Buying SOC or digital forensics from a provider whose register row only lists training.
- Treating provisional accreditation as identical to permanent accreditation without follow-up.
- Ignoring neighbouring controls: personal data duties covered in our PDPL website compliance checklist, and DNS-layer hardening in our .eg DNSSEC unsigned checklist.
How hosting, support and custom systems strengthen your security posture
Verifying a cybersecurity vendor is a contracting step, but it sits inside a wider posture: disciplined hosting, support that can respond to incidents, and systems that handle patient or customer data properly. Smart One Group offers hosting and support contracts, and through custom software can build clinic and enterprise systems that need secure handling of patient data alongside data-protection compliance.
Frequently asked questions
Can a Category-2 clinic or private company contract a Level-2 provider?
Yes. Level-2 providers are authorised to serve Category-2 beneficiaries only. Category-1 beneficiaries must not contract Level-2 providers under the framework.
What if an NTRA-accredited engineer offers to work as a freelancer?
The framework forbids accredited individuals from providing services alone; they must be employed under a registered provider. Ask for proof of that employment before you sign.
How long is a registration certificate valid?
Three years from the issue date, renewable for further three-year periods under NTRA’s conditions. NTRA may suspend or cancel the certificate or remove the name from the register for breaches.
Is an old social-media post enough proof that a company is on the register?
No. The reference is the register published and updated on the official NTRA website. The October 2026 PDF lists 47 accredited companies plus 19 with provisional accreditation; later updates may change those counts.
Can we run penetration tests in-house without an external vendor?
A beneficiary may provide cybersecurity services for its own use — not to others — only after prior written NTRA approval and accreditation of the staff who perform that work, under the procedures NTRA sets.
Where should registration queries to NTRA go?
NTRA cites cyberaccreditation@tra.gov.eg for accreditation and registration queries. Checking the register and the contract before you sign remains the buyer’s duty with their legal adviser.
If you want a review of hosting, backups and access controls in your organisation before you contract any vendor on the register, the Smart One Group team can help through technical support and hosting. Contact us to arrange a review session.
