How should one plan a good regular penetration testing schedule? Also, how to do an assessment to check what ICT systems should be eligible for regular testing?

Before pentesting, you must scan vulnerabilities and review the frequence of patching your systems + impact analysis of the updates on your applications/data.

Test your externally facing systems / services and apps once a year; the stuff looking beyond / from the DMZ that is.

The best and most cost effective way to do this is to get an external consultancy to do this for you; it is independent and only costs when you need it [at the time].

Also it is worth having robust monitoring tools that help prevent a cyber attack in the first place - like Crowdstrike [despite the recent disaster, they're really good].