On this page
How frameworks talk about testing
Frameworks fall into three groups: those that name penetration testing, those that require testing of controls, and those that require “appropriate security” which regulators interpret to include testing.
Framework by framework
- PCI DSS
- Names penetration testing in requirement 11.4: internal and external, after significant changes, and at least annually. See [PCI DSS](/compliance/pci-dss/).
- SOC 2
- Does not name a test, but auditors expect evidence that controls are tested. See [SOC 2](/compliance/soc-2/) and [SOC 2 VAPT](/blog/soc-2-vapt-report).
- ISO 27001
- Technical vulnerability management and control evaluation. See [ISO 27001](/compliance/iso-27001/) and [ISO 27001 VAPT](/blog/iso-27001-vapt-audit).
- HIPAA
- Requires risk analysis and evaluation of safeguards. Testing supports both. See [HIPAA](/compliance/hipaa/).
- GDPR
- Article 32: appropriate security and regular testing of effectiveness. See [GDPR](/compliance/gdpr/).
- India DPDP, SEBI, RBI
- Reasonable safeguards, plus sector rules for regulated firms. See [DPDP](/compliance/india-dpdp/) and [SEBI and RBI](/compliance/sebi-cscrf-rbi/).
- NCA ECC, CCC, DCC (Saudi Arabia)
- Controls on vulnerability management and testing. See [NCA ECC](/compliance/nca-ecc/) and the [NCA ECC guide](/blog/nca-ecc-penetration-testing-requirements).
- SAMA CSF
- Financial-sector testing expectations. See the [SAMA guide](/blog/sama-csf-penetration-testing).
- UAE PDPL, DIFC, ADGM, CBUAE
- Security and testing expectations. See the [UAE guide](/blog/vapt-report-uae-difc-adgm-cbuae).
- DORA and NIS2 (EU)
- Resilience testing for financial entities and security measures for essential entities. See [DORA and NIS2](/compliance/dora-nis2/).
- APRA CPS 234 (Australia)
- Requires testing the effectiveness of controls. See [APRA CPS 230 and 234](/compliance/apra-cps-230-234/).
- ST4S (Australia and New Zealand schools)
- Security assessment for education software. See [ST4S](/compliance/st4s/).
Browse every framework on our compliance hub.
One report, many frameworks
A well-scoped test can serve several frameworks, provided the report maps findings to each and shows verified results and a retest. A scanner export cannot do this; read what makes a VAPT report worth paying for.
- List every framework and customer questionnaire that applies to you
- Scope one test that covers the shared assets
- Ask for findings mapped to each framework
- Keep the report, the retest and the remediation evidence together
Need the formal report or certificate too? Where a framework ends in a third-party attestation or audit, such as SOC 2, ISO 27001, PCI DSS, NCA controls or a CERT-In audit, we run the full engagement for you and route the formal step through our local partner firms, so you deal with one team and get all your work done.
Not sure which apply to you?
Send us your questionnaires and contracts. We will tell you what evidence they expect. Get a quote.
Frequently asked questions
Which frameworks explicitly require penetration testing?
PCI DSS names penetration testing directly in requirement 11.4. Several regional regimes, such as NCA ECC in Saudi Arabia and DORA's threat-led testing for some financial entities, also name testing or assessment.
Does SOC 2 require a penetration test?
SOC 2 does not name one, but auditors look for evidence that you test your security controls, and a recent third-party penetration test is the most common way to provide it.
Does ISO 27001 require penetration testing?
ISO 27001 requires you to manage technical vulnerabilities and evaluate your controls. Penetration testing is a widely used way to show that, and auditors often ask for the report.
Does GDPR require penetration testing?
Not by name. Article 32 requires appropriate security and regular testing of its effectiveness, and a penetration test is a common way to evidence that.
What about DPDP in India?
The DPDP Act requires reasonable security safeguards. Regular expert-led testing is a practical way to show them.
Faisal Khan is a Director at Summit, where he oversees penetration testing, risk assessment and compliance engagements for SaaS and enterprise clients. Case studies are anonymised and published with client permission.
