Many organisations commission penetration tests not because they want to, but because a compliance framework, contractual requirement, or regulatory body says they must. This is not a bad starting point — but understanding what each framework actually requires, and how to get genuine security value from a compliance-driven test, makes the difference between a checkbox exercise and meaningful risk reduction.

Why compliance frameworks require penetration testing

Compliance frameworks exist to ensure that organisations managing sensitive data, financial transactions, or critical infrastructure meet a minimum standard of security. Penetration testing is included because:

  • Vulnerability scanners are not enough. Automated tools catch known issues but miss logic flaws, chained attack paths, and context-dependent vulnerabilities.
  • Self-assessment has limits. Organisations may believe their controls are effective, but only an independent test can verify this.
  • The threat landscape evolves. A system that was secure when it was deployed may not be secure today. Regular testing keeps pace with new vulnerabilities and attack techniques.
  • Accountability. A penetration test report provides documented evidence that testing was conducted and that identified issues were addressed.

PCI-DSS

The Payment Card Industry Data Security Standard applies to any organisation that stores, processes, or transmits cardholder data. Penetration testing is explicitly required.

What PCI-DSS requires

Requirement 11.4 (PCI-DSS v4.0) mandates that penetration testing is performed at least annually and after any significant change to the environment. The test must:

  • Cover the entire cardholder data environment (CDE) — the systems that store, process, or transmit cardholder data, and any systems connected to them.
  • Include both network-layer and application-layer testing.
  • Test from both outside the network (external) and inside the network (internal).
  • Validate that segmentation controls are effective — if the organisation uses network segmentation to reduce the scope of the CDE, the penetration test must verify that the segmentation actually works.
  • Be performed by a qualified internal resource or external third party.

ASV scans vs penetration tests

PCI-DSS also requires quarterly Approved Scanning Vendor (ASV) scans (Requirement 11.3.2). These are automated external vulnerability scans — not penetration tests. ASV scans check for known vulnerabilities and misconfigurations. Penetration tests go deeper, with manual testing, exploitation, and business logic analysis.

Both are required. They are not interchangeable.

Getting value beyond compliance

A PCI-DSS penetration test that only tests the minimum scope will satisfy the auditor but may miss significant risks. Organisations that want genuine security value should:

  • Ensure the tester goes beyond automated scanning and actively tests for business logic flaws and chained vulnerabilities.
  • Include testing of authentication, session management, and access controls — not just vulnerability scanning.
  • Test segmentation controls thoroughly, not just with a port scan.
  • Treat the penetration test report as a prioritised remediation roadmap, not just an audit artifact.

ISO 27001

ISO 27001 is the international standard for information security management systems (ISMS). It does not prescribe specific technical controls but requires organisations to identify, assess, and treat information security risks.

What ISO 27001 requires

ISO 27001 does not mandate penetration testing in the same explicit terms as PCI-DSS. However, Annex A includes controls that strongly imply it:

  • A.8.8 — Management of technical vulnerabilities. Organisations must identify and address technical vulnerabilities in a timely manner. Penetration testing is one of the most effective methods for doing so.
  • A.5.35 / A.5.36 — Independent review of information security / Compliance with security policies. Independent testing provides evidence that security controls are implemented and effective.

In practice, most ISO 27001 certification auditors expect to see evidence of penetration testing as part of the organisation’s risk assessment and treatment process. An organisation that claims its web application is secure but has never tested it will face questions.

Risk-based approach

ISO 27001’s risk-based framework means that the scope and depth of penetration testing should be proportionate to the risk. An organisation whose primary asset is a customer-facing web application should prioritise web application testing. An organisation with a large internal network and Active Directory infrastructure should include internal testing.

The penetration test report provides evidence for the risk register: identified vulnerabilities represent risks, and the remediation plan represents risk treatment.

Evidence for certification audits

During a certification audit, the auditor will look for:

  • Evidence that penetration testing has been conducted (the report).
  • Evidence that identified vulnerabilities have been assessed and addressed (remediation records).
  • Evidence that testing is conducted regularly (testing schedule, historical reports).
  • Alignment between the scope of testing and the organisation’s risk assessment.

Cyber Essentials

Cyber Essentials is a UK government-backed scheme designed to help organisations protect against the most common cyber threats. There are two levels: Cyber Essentials (self-assessment) and Cyber Essentials Plus (includes independent testing).

What Cyber Essentials Plus requires

Cyber Essentials Plus includes a mandatory technical assessment conducted by a qualified assessor. This assessment includes:

  • External vulnerability scanning of all internet-facing IP addresses and services.
  • Internal vulnerability assessment of a sample of devices.
  • Authenticated scanning to verify patch levels.
  • Basic tests of email and web-based malware defences.

Strictly speaking, Cyber Essentials Plus requires a vulnerability assessment rather than a full penetration test. The assessor scans for known vulnerabilities and checks that the five core Cyber Essentials controls are implemented (firewalls, secure configuration, access control, malware protection, patch management).

The limitation

Cyber Essentials Plus is a good baseline, but it is not a substitute for a penetration test. The assessment is primarily automated, focuses on known vulnerabilities and configuration issues, and does not include manual testing for business logic flaws, complex attack chains, or application-layer vulnerabilities.

Organisations that rely solely on Cyber Essentials Plus for their security assurance are testing against the minimum bar. For organisations handling sensitive data, operating critical systems, or facing sophisticated threats, a penetration test provides significantly deeper coverage.

Going beyond checkbox compliance

The difference between a compliance-driven penetration test and a security-driven penetration test is often the difference between asking “does this pass?” and asking “is this secure?”

Scope. Compliance frameworks define minimum scope. A security-driven test considers the full attack surface, including systems that are adjacent to or connected to the compliance scope.

Depth. Compliance testing may stop at identifying vulnerabilities. Security-driven testing exploits them to demonstrate real-world impact and chains them to show how multiple lower-severity issues combine into a critical attack path.

Frequency. Most frameworks require annual testing. Organisations with rapidly changing environments, frequent deployments, or high-value targets benefit from more frequent testing — after significant changes, before major releases, or on a quarterly cycle.

Remediation. Compliance requires evidence that issues are addressed. Security requires evidence that the fixes actually work — through retesting, not just documentation.

Culture. The most secure organisations treat compliance as a floor, not a ceiling. The penetration test is one input into a broader security programme that includes continuous monitoring, regular assessments, and a commitment to improving rather than simply passing.

Compliance gets the test commissioned. What the organisation does with the results determines whether it was worth doing.