Audits and frameworks
What each framework actually says about penetration testing
Three of these require testing by name. Most do not, and expect it anyway. Each page gives the specific clause, the careful answer, and a link to the primary source rather than a vendor summary.
| Framework | Pen test required? | Where it comes from |
|---|---|---|
| SOC 2 | Common evidence | Trust Services Criteria CC4.1 and CC7.1 |
| SOC 2 Type I | Common evidence | Trust Services Criteria CC4.1 |
| SOC 2 Type II | Common evidence | Trust Services Criteria CC4.1 and CC7.1 |
| ISO 27001 | Testing expected | Annex A 8.8 and Annex A 8.29 |
| PCI DSS | Required by name | Requirement 11.4 |
| HIPAA | Testing expected | 45 CFR 164.308(a)(1)(ii)(A) and 164.308(a)(8) |
| FedRAMP | Required by name | NIST SP 800-53 Rev. 5 control CA-8 and the FedRAMP Penetration Test Guidance |
| GDPR | Testing expected | Article 32(1)(d) |
| CMMC | Common evidence | NIST SP 800-171 Rev. 2 for Level 2; NIST SP 800-172 for Level 3 |
| HITRUST | Testing expected | HITRUST CSF control 09.ab and the r2 assessment requirements |
| SOC 3 | Common evidence | Trust Services Criteria, same as SOC 2 |
| NIST CSF | Common evidence | ID.RA and DE.CM categories |
| ISO 42001 | Common evidence | Annex A controls on AI system impact assessment and verification |
| NIS2 | Testing expected | Article 21(2) |
| DORA | Required by name | Articles 24 to 27, with threat-led penetration testing at Articles 26 and 27 |
Required by name means the published text names penetration testing. Testing expected means the text mandates testing that a penetration test is the normal evidence for. Common evidence means the standard does not compel it and auditors generally ask anyway.
What enterprise buyers ask for
The reports and certificates that unblock a sale.
AICPA
SOC 2
SOC 2 is an attestation report produced by a licensed CPA firm against the AICPA Trust Services Criteria. It is the report most North American enterprise buyers ask a software vendor for.
AICPA
SOC 2 Type I
A SOC 2 Type I reports on whether controls are suitably designed at a single point in time. It is a snapshot, and it is the fastest route to having a report to hand a customer.
AICPA
SOC 2 Type II
A SOC 2 Type II reports on whether controls operated effectively across an observation window, usually three to twelve months. It is the report most enterprise procurement teams treat as the real one.
ISO and IEC
ISO 27001
ISO/IEC 27001 is a certifiable standard for an information security management system. Unlike SOC 2 it produces a certificate rather than a report, and it is the assurance European and Asian buyers usually ask for first.
AICPA
SOC 3
A SOC 3 is a short, general-use report built from the same audit work as a SOC 2. It contains no detailed control descriptions or test results, which is exactly why it can be published on a public website.
Regulated industries
Where the obligation comes from a regulator or a card brand rather than a customer.
PCI Security Standards Council
PCI DSS
PCI DSS is the card brands' security standard for anyone who stores, processes or transmits cardholder data. It is the one framework on this list that requires penetration testing in so many words.
U.S. Department of Health and Human Services
HIPAA
The HIPAA Security Rule sets safeguards for electronic protected health information. It applies to covered entities and to business associates, which is how most health technology startups are caught by it.
HITRUST Alliance
HITRUST
HITRUST CSF is a certifiable framework that maps many other standards into one control set. It is most common in healthcare, where large payers and health systems ask for it by name.
European Union
DORA
DORA is the European Union's operational resilience regulation for the financial sector. It is the only framework here that mandates threat-led penetration testing by name, for the entities designated to perform it.
Public sector
Selling to government, where the assessor is accredited into the program.
U.S. General Services Administration
FedRAMP
FedRAMP is the authorization program a cloud service must pass to be sold to United States federal agencies. It is the most demanding framework on this list and the most expensive to reach.
U.S. Department of Defense
CMMC
CMMC is the Department of Defense's certification program for contractors handling federal contract information and controlled unclassified information. Levels 1 through 3 set progressively stricter requirements.
Regional and emerging
Obligations that arrive with a market rather than a customer.
European Union
GDPR
GDPR is the European Union's data protection regulation. Its security obligation is short, outcome-based, and explicitly asks for regular testing of the measures an organization relies on.
European Union
NIS2
NIS2 is the European Union's cybersecurity directive for essential and important entities. Unlike a regulation it is transposed into national law by each member state, so the specifics vary by country.
ISO and IEC
ISO 42001
ISO/IEC 42001 is the first certifiable standard for an artificial intelligence management system. It sits alongside ISO 27001 in structure and is starting to appear in enterprise diligence for companies that ship AI features.
U.S. National Institute of Standards and Technology
NIST CSF
The NIST Cybersecurity Framework is a voluntary structure for organizing a security program. Version 2.0, published in 2024, added Govern to the original five functions and broadened the audience beyond critical infrastructure.
These pages describe published standards and regulations and are not legal advice.