Security testing commissioned to meet a compliance framework, a regulator or a customer's security review.
What the Trust Services Criteria do and do not say about penetration testing, why auditors and customers still expect one, how to scope it to the system description, and how the report and retest serve as evidence in a Type 1 or Type 2 examination.
How penetration testing supports Annex A controls A.8.8 and A.8.29 and the risk treatment plan, what certification auditors typically look for, and how to size the test to the ISMS scope rather than the whole company.
Requirement 11.4 in detail: methodology, internal and external tests every 12 months, segmentation testing every 12 or 6 months, retesting under 11.4.4 and 12 month record retention, plus how the test relates to ASV scans and SAQ or ROC validation.
Where penetration testing fits under the HIPAA Security Rule's evaluation standard and risk analysis today, what the January 2025 proposed rule would require if finalized, and how to scope testing around systems holding ePHI.
How DORA TLPT works under Delegated Regulation (EU) 2025/1190: who is required to test, the 3 year cycle, scenarios, 12 week active testing, tester requirements, reports, purple teaming and attestation, and how it relates to TIBER-EU.
What NIS2 and Implementing Regulation 2024/2690 point 6.5 require for security testing policy, risk-based frequency and documented results, the evidence ENISA lists, and how supervisory audits and security scans by authorities differ from your own testing.
Why CMMC Level 2 has no explicit penetration testing requirement but vulnerability scanning and assessment requirements still apply, what Level 3 requirement CA.L3-3.12.1e adds, and how testing evidence supports an assessment.
How penetration test reports serve as evidence for HITRUST e1, i1 and r2 requirement statements, the assessor independence rules on who may perform testing, and how to time testing against the assessment fieldwork window.
Commissioning a test because an enterprise customer's security questionnaire or vendor review asks for one: what scope and report format customers expect, sharing summary letters versus full reports, and how retest evidence closes findings.
How insurer questionnaires ask about external testing, vulnerability management and remediation, which test types usually answer those questions, and what evidence to keep; no insurer requirements are assumed beyond what the policy wording states.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.