Compliance Frameworks Requiring Pentesting

Most compliance frameworks require qualified and independent security testing. Here’s how to achieve that.

Compliance is one of the most common reasons organizations commission a penetration test. Each of the major compliance frameworks takes a slightly different approach, but a common thread is requiring a qualified, independent review. Here’s what you should know.

Which Compliance Frameworks Require Penetration Testing?

Standard cybersecurity advice is to run a penetration test once per year, but many businesses are increasing the frequency.

Five widely used compliance frameworks explicitly require penetration testing: PCI DSS, the New York DFS Cybersecurity Regulation, the FTC Safeguards Rule, CMMC Level 3, and FedRAMP.

Most require testing at least annually, and most allow either an internal or external tester as long as that tester is qualified. Only FedRAMP requires an accredited third party by name.

Framework	Who It Applies To	What It Requires	Who Performs the Test
PCI DSS v4.0.1	Organizations that store, process, or transmit payment card data	Internal and external testing at least every 12 months and after any significant infrastructure or application upgrade or change	A qualified internal resource or qualified external third party, with organizational independence from the systems tested
NYDFS 23 NYCRR 500.5	Banks, insurers, agents, brokers, and other entities licensed under New York’s Banking, Insurance, or Financial Services Law	Testing from both inside and outside system boundaries at least annually (if your organization has 20+ employees)	A qualified internal or external party
FTC Safeguards Rule, 16 CFR 314.4(d)	Non-bank financial institutions such as mortgage brokers, auto dealers, and tax preparers	Annual penetration testing, unless the organization has effective continuous monitoring or fewer than 5,000 consumers in its database	Not specified; may be internal or external
CMMC Level 3	Defense contractors handling the most sensitive controlled unclassified information	Testing at least annually or when significant security changes are made	Not specified; may be internal or external
FedRAMP	Cloud providers serving federal agencies	Penetration testing as part of authorization and ongoing annual assessment	A FedRAMP-recognized third-party assessment organization (3PAO)

HIPAA and SOC 2

Some of the most common compliance frameworks don’t explicitly require penetration testing today, but that doesn’t mean organizations can skip it.

HIPAA. The current HIPAA Security Rule does not name penetration testing explicitly, but it does require ongoing risk analysis and risk management (HHS fact sheet). Healthcare organizations still have to perform a risk analysis today, and penetration testing is one of the most direct ways to validate it.

SOC 2. SOC 2 doesn’t technically require penetration testing either. The AICPA’s Trust Services Criteria mention it only in a “point of focus” under criterion CC4.1, as one example of how an organization might evaluate its controls. Points of focus are guidance, not requirements. In practice, though, many auditors and customers expect to see a recent test, and once an organization commits to annual testing in its system description, the auditor will test whether it happened.

Contracts and insurance. Customers, partners, and cyber insurers can create a requirement where no regulation does. A clause in a vendor agreement or a question on an insurance application can make a penetration test just as necessary as a regulatory mandate.

Does the Test Have To Be Done by a Third Party?

Requirements vary for pen testing in the different compliance frameworks, but third-party audits are considered a best practice.

PCI DSS and NYDFS both allow a qualified internal tester. PCI DSS adds a condition that matters: the tester must have organizational independence, meaning they can’t be responsible for managing or securing the systems being tested. FedRAMP is the clear exception, requiring a recognized third-party assessment organization.

For most small and mid-sized organizations, an outside tester ends up being the practical answer for three reasons:

Few have qualified testers on staff. Penetration testing is a specialized skill set, and most internal IT teams are built to run systems, not attack them.
Independence is hard to achieve internally. When the same team or managed service provider designs, deploys, and maintains the network, it can’t credibly test its own work.
Qualifications and independence get scrutinized. Examiners, assessors, and auditors look at who performed the test, not just whether it happened. A report that can’t demonstrate both can create the very gap it was meant to close.

Automated tools alone are rarely enough. A vulnerability scanner identifies possible weaknesses, while a penetration test requires a skilled tester to confirm which of them can actually be exploited.

Meet Pentesting Requirements with WHITECAP

WHITECAP Technologies helps organizations across Connecticut, Rhode Island, and New York take a vendor-neutral approach to understanding their testing obligations and selecting qualified, independent testing that fits their environment.

We work with qualified, third-party testing organizations. WHITECAP arranges all of the logistical details for a pen test, ensuring no disruption to your daily business operations. The results of the test are completely confidential. Ready to learn more? Get in touch with our team today.

Rod Capobianco | President + Founder

Rod Capobianco is the President + Founder of WHITECAP Technologies, bringing nearly 30 years of experience in the telecommunications and technology industry. Since founding WHITECAP in 2006, Rod has focused on building lasting customer relationships and helping businesses navigate an increasingly complex technology landscape.