NIS2
Network and Information Systems Directive
Article 21 requires risk controls to be tested for effectiveness, although it does not prescribe a pentest.
We cover all technical code
and cloud security
requirements for 
and more
Sample reportEuropean frameworks
EU rules for cyber risk, operational resilience, personal data, and digital products.
DORA
Digital Operational Resilience Act
Articles 24–25 require a testing programme; the separate TLPT duty applies only to selected financial entities.
GDPR
General Data Protection Regulation
Article 32 requires regular evaluation of security measures, but it leaves the testing method risk-based.
EU CRA
EU Cyber Resilience Act
Manufacturers must test products with digital elements and manage vulnerabilities throughout the support period.
Global frameworks
Assurance, payment, healthcare, government, application, and cloud security standards.
SOC 2
System and Organization Controls 2
The criteria do not name pentesting, but auditors and customers commonly expect current independent evidence.
ISO 27001
Information Security Management Systems
Auditors use testing evidence to assess technical vulnerability management and security testing controls.
PCI DSS
Payment Card Industry Data Security Standard
Requirement 11.4 explicitly requires internal and external penetration testing at least every 12 months.
HIPAA
Health Insurance Portability and Accountability Act
The Security Rule requires risk analysis and periodic technical evaluation, not a named pentest.
NIST 800-53
Security and Privacy Controls for Information Systems
CA-8 explicitly covers penetration testing when that control is selected for the system.
OWASP ASVS
Application Security Verification Standard
A verification standard whose higher assurance levels depend on hands-on security testing.
ISO 27017/27018
Cloud Security and PII Protection
Cloud and PII guidance extends ISO 27001 controls; testing evidence follows the shared-responsibility boundary.