Which rules require recurring penetration testing?
PCI DSS, DORA, NIS2, ISO 27001 and GDPR have different testing requirements. Match the method, scope and tester qualifications to the actual obligation.
The cover image is an AI-generated editorial illustration. Screens and documents are illustrative concepts.
“We need a pentest for compliance” leaves several questions unanswered. Which requirement applies? What must be tested? How often? Who is qualified to perform it?
A recurring application test can provide useful evidence. It does not automatically satisfy every legal, certification or contractual requirement.
PCI DSS specifies penetration testing
PCI DSS 4.0.1 Requirement 11.4 addresses internal and external penetration testing, including recurring tests and tests after significant changes. Scope, methodology, qualified testers, organisational independence, correction and retesting matter. Segmentation can carry additional requirements.
Use the current standard from the PCI SSC document library. The Council’s penetration-testing guidance distinguishes a pentest from a vulnerability scan, though its numbering refers to an older edition.
A scheduled automated scan should not be presented as a complete PCI pentest without assessing scope and methodology with the responsible assessor.
DORA has more than one testing layer
DORA’s general testing programme uses a range of appropriate methods. For relevant entities other than microenterprises, systems supporting critical or important functions require appropriate testing at least annually. This does not mean every listed method must be used for every system.
Selected entities have separate threat-led penetration testing obligations, with specific provider and process requirements. An application test does not replace TLPT. See the DORA testing guide and Finanstilsynet’s guidance.
NIS2 requires effectiveness assessment
NIS2 requires policies and procedures to assess the effectiveness of cybersecurity risk-management measures. Detailed testing requirements can arise under national law and, for specified digital-service sectors, Implementing Regulation 2024/2690.
ENISA’s guidance supports that regulation. Its scope is not every business in every sector.
ISO 27001 and GDPR need a wider assessment
ISO 27001 testing follows risks, selected controls and obligations. A product’s “audit-ready” label does not establish the sufficiency of its evidence. The ISO testing article connects reports to the management system.
GDPR Article 32 calls for appropriate security measures, including regular assessment of their effectiveness where appropriate. An application pentest covers only part of that question. It cannot establish that recovery, access administration or organisational processes work. The regulation provides the requirement.
Buy against a written scope
Record the requirement, systems, frequency, method, qualifications and evidence needed. Check customer contracts too.
FM’s application pentest offering uses Aikido, with FM reporting. Assess its fit against the specific obligation and identify additional testing required. Frequency helps when the test covers the right thing.
