Published · By the Aesparrow Security Research Team
Short answer
PCI DSS explicitly requires penetration testing at least every 12 months and after significant changes, plus quarterly vulnerability scans. ISO 27001 and SOC 2 do not name penetration testing, but VAPT is the standard evidence for their vulnerability-management and security-testing controls. GDPR Article 32 requires regular testing of security measures, and NIST, CMMC and DORA all expect ongoing security testing.
Which frameworks require VAPT?
| Framework | What it asks for | Typical frequency |
|---|---|---|
| PCI DSS v4.0 | Internal and external pentest (Req. 11.4), segmentation testing, quarterly scans (Req. 11.3) | Annual + after significant change; scans quarterly |
| ISO/IEC 27001:2022 | Management of technical vulnerabilities (A 8.8), security testing (A 8.29) | Annual VAPT is common evidence |
| SOC 2 | Monitoring and risk-mitigation controls evidenced by independent testing | At least once in the audit period |
| GDPR (Art. 32) | A process for regularly testing and evaluating the effectiveness of security measures | Risk-based; periodic VAPT recommended |
| NIST 800-171 / CMMC | Vulnerability scanning and security assessment of CUI systems | Periodic, per the System Security Plan |
| DORA (EU financial sector) | Digital operational resilience testing, including threat-led penetration testing | Annual testing; TLPT at least every three years for in-scope entities |
| HIPAA | Risk analysis and technical safeguards under the Security Rule | Risk-based, commonly annual |
What happens if you do not comply?
Consequences range from failed audits and lost enterprise deals to regulatory penalties. Under GDPR, infringements can attract fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher.
FAQ
Frequently Asked Questions
Clear answers about what we do — and what we don’t. If you have any other questions, feel free to reach out to our team.
Is VAPT mandatory for ISO 27001 certification?
ISO 27001 does not explicitly mandate VAPT, but certification auditors expect evidence that technical vulnerabilities are identified and managed, and VAPT reports are the most common evidence.
What is compliance penetration testing?
Penetration testing scoped and reported to meet a specific standard’s requirements, including methodology statements, control mapping and re-test evidence for auditors.