How often must you pentest? Sources and verbatim text Read on 12 November 2026. Draft for the post "How often must you pentest? What PCI DSS, HIPAA, ISO 27001 and SOC 2 say". Post: https://excessionlabs.ai/blog/how-often-penetration-testing/ Every quote below was found by string match in the text of the page or file named, on the date above. Line breaks inside quotes are removed. Text in square brackets is part of the source. ===================================================================== 1. PCI DSS ===================================================================== PCI DSS v4.0.1 itself: NOT READ. https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0_1.pdf -> HTTP 403 to curl on 12 Nov 2026 (page text: "You have attempted to access an out of date document using a direct link"). https://www.pcisecuritystandards.org/document_library/ -> license agreement click-through required. We did not accept the license. No Internet Archive copy was available for the PDF (archive.org availability API returned no snapshot on 12 Nov 2026). 1a. PCI SSC, Information Supplement: Penetration Testing Guidance, version 1.1, September 2017 https://listings.pcisecuritystandards.org/documents/Penetration-Testing-Guidance-v1_1.pdf Accessed 12 Nov 2026 (HTTP 200, application/pdf). Written for PCI DSS 3.2.1 numbering (11.3.x). Table of scans vs penetration tests, row "When": Vulnerability scan: "At least quarterly and after significant changes" Penetration test: "At least annually and upon significant changes" Section 2.6 "What is considered a "significant change"?": "Per PCI DSS Requirements 11.3.1 and 11.3.2, penetration testing must be performed at least annually and after any significant change-for example, infrastructure or application upgrade or modification-or new system component installations." (the PDF uses em dashes; the post does not quote that sentence) "What is deemed "significant" is highly dependent an entity's risk- assessment process and on the configuration of a given environment." [typo "dependent an" is in the PDF] "Because of this variability, a significant change is not prescribed by PCI DSS." "If the change could impact the security of the network or allow access to cardholder data, it may be considered significant by the entity." Section "Qualifications of a Penetration Tester": "Qualified internal resources or a qualified third party may perform the penetration test as long as they are organizationally independent." 1b. PCI SSC, Summary of Changes from PCI DSS Version 3.2.1 to 4.0, r1, May 2022 https://listings.pcisecuritystandards.org/documents/PCI-DSS-v3-2-1-to-v4-0-Summary-of-Changes-r1.pdf Accessed 12 Nov 2026 (HTTP 200). 11.4.1 (was 11.3), "Clarified the following": "Penetration testing results are retained for at least 12 months." 11.4.4 (was 11.3.3): "Clarified that penetration test findings are corrected in accordance with the entity's assessment of the risk posed by the security issue." (The PDF table interleaves columns; the sentence reads as above when the columns are joined.) 11.4.7: "New requirement for multi-tenant service providers to support their customers for external penetration testing." [not quoted in the post] 1c. SECONDARY ONLY, paraphrase of 11.4.2 and 11.4.3 (not verbatim PCI text, not quoted in the post) Accessed 12 Nov 2026 (HTTP 200 each): https://www.softwaresecured.com/guides-and-checklists/pci-dss-pentesting-guide "11.4.2 — Internal Penetration Test – Annual minimum and after every significant change to internal infrastructure." https://strobes.co/blog/pci-dss-penetration-testing-requirements/ "11.4.2 requires internal penetration testing at least once every 12 months and after any significant infrastructure or application change. 11.4.3 requires external penetration testing on the same cadence." https://www.eicsecure.com/blog/pci-dss-requirement-11-4-penetration-testing "At least once every 12 months, and after any significant infrastructure or application upgrade or change. Both the internal test (11.4.2) and the external test (11.4.3) carry the same cadence." These are vendors. The post says so and does not put their words in quotation marks. ===================================================================== 2. HIPAA ===================================================================== 2a. 45 CFR 164.308(a)(8), current text https://www.ecfr.gov/current/title-45/section-164.308 (fetched via https://www.ecfr.gov/api/renderer/v1/content/enhanced/current/title-45?part=164§ion=164.308) Accessed 12 Nov 2026. "(8) Standard: Evaluation. Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and, subsequently, in response to environmental or operational changes affecting the security of electronic protected health information, that establishes the extent to which a covered entity's or business associate's security policies and procedures meet the requirements of this subpart." 164.308(a)(1)(ii)(A) Risk analysis (Required): "Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate." Version check: https://www.ecfr.gov/api/versioner/v1/versions/title-45.json?part=164§ion=164.308 -> latest version date 2016-12-30, amendment_date 2016-12-30 (accessed 12 Nov 2026). 2b. HHS NPRM, "HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information", 90 FR 898, 6 January 2025 (FR Doc. 2024-30983), Proposed Rule https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information Full text: https://www.federalregister.gov/documents/full_text/text/2025/01/06/2024-30983.txt Metadata: https://www.federalregister.gov/api/v1/documents/2024-30983.json (type "Proposed Rule", comments_close_on 2025-03-07). Accessed 12 Nov 2026. (The HTML page needs a CAPTCHA for scripts; the text file and API worked.) Preamble: "The proposed implementation specification for penetration testing at 45 CFR 164.312(h)(2)(iii) would require a regulated entity to conduct periodic testing of the regulated entity's relevant electronic information systems for vulnerabilities, commonly referred to as penetration testing." Preamble: "The proposal would require a regulated entity to conduct such testing at least once every 12 months, or in accordance with the regulated entity's risk analysis, whichever is more frequent." Proposed regulatory text, 164.312(h)(2)(iii): "Penetration testing. Perform penetration testing of the covered entity's or business associate's relevant electronic information systems by a qualified person." Proposed 164.312(h)(2)(iii)(B): "Penetration testing must be performed at least once every 12 months or in accordance with the covered entity's or business associate's risk analysis required by Sec. 164.308(a)(2), whichever is more frequent." Proposed 164.312(h)(2)(i)(A) (scans): "... in accordance with the covered entity's or business associate's risk analysis required by Sec. 164.308(a)(2) or at least once every six months, whichever is more frequent." 2c. Is there a final rule? (status as of 12 Nov 2026) Federal Register documents for RIN 0945-AA22: https://www.federalregister.gov/api/v1/documents.json?conditions%5Bregulation_id_number%5D=0945-AA22&order=newest -> count 1, one document: Proposed Rule, 2025-01-06. Unified Agenda entry: https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0945-AA22 Page text: "Agenda Stage of Rulemaking: Long-Term Actions"; "Timetable: Action Date FR Cite NPRM 01/06/2025 90 FR 898 Final Action 07/00/2027". The page shows "Publication ID: 2026" although the URL has pubId=202510. Conclusion used in the post: no final rule found on 12 Nov 2026; the NPRM is a proposal. Re-checked on 14 Nov 2026 before wiring the post into the site: the same query (conditions[regulation_id_number]=0945-AA22, order=newest) returned HTTP 200, count 1, one document: Proposed Rule, 2025-01-06, FR Doc. 2024-30983. No final rule. The post text is unchanged. ===================================================================== 3. ISO/IEC 27001:2022 and 27002:2022 ===================================================================== https://www.iso.org/standard/27001 Accessed 12 Nov 2026 in a browser (the page returns a bot challenge to curl). Page shows: "ISO/IEC 27001:2022", "Edition 3", "Publication date : 2022-10", "Stage : International Standard published [60.60]", "This standard has 1 amendment." and "Buy from BSI" links. A text search of the page found no "penetration" and no "8.8". No clause text is public. We did not buy the standard. No ISO sentence is quoted in the post. Secondary (vendor paraphrase of ISO/IEC 27002:2022 guidance for 8.8), not ISO text: https://www.isms.online/iso-27002/control-8-8-management-of-technical-vulnerabilities/ (accessed 12 Nov 2026) "Carry out regular, documented penetration tests – either internally or via a certified third-party." "27002:2013-12.6.1 is largely concerned with the implementation of remedial action once a vulnerability has been identified, whereas 18.2.3 is limited to technical tools (mostly penetration testing)." No interval appears in this paraphrase. NOT USED: a copy of the ISO 27001 PDF hosted on a third-party site appeared in a search result. We did not open or quote it (copyright, unclear permission). ===================================================================== 4. SOC 2 ===================================================================== AICPA, TSP Section 100, 2017 Trust Services Criteria ... Red-lined Version (includes March 2020 updates) https://web.archive.org/web/20220117114302/https://us.aicpa.org/content/dam/aicpa/interestareas/frc/assuranceadvisoryservices/downloadabledocuments/trust-services-criteria-redlined.pdf Accessed 12 Nov 2026 (HTTP 200, application/pdf). Same file as the evidence for the SOC 2 post. CC4.1: "The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning." CC4.1 point of focus "Adjusts Scope and Frequency": "Management varies the scope and frequency of separate evaluations depending on risk." CC4.1 point of focus "Objectively Evaluates": "Separate evaluations are performed periodically to provide objective feedback." CC4.1 point of focus "Considers Different Types of Ongoing and Separate Evaluations": "Management uses a variety of different types of ongoing and separate evaluations, including penetration testing, independent certification made against established specifications (for example, ISO certifications), and internal audit assessments." CC7.1: "To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities." CC7.1 point of focus "Conducts Vulnerability Scans": "The entity conducts vulnerability scans designed to identify potential vulnerabilities or misconfigurations on a periodic basis and after any significant change in the environment and takes action to remediate identified deficiencies on a timely basis." Paragraph on points of focus: "Use of the trust services criteria does not require an assessment of whether each point of focus is addressed." The regex count of "penetration" in the extracted text: 1. The 2022 revised points of focus were not read (AICPA download needs a free account). Linford & Company LLP, "The 351-Day Risk Window: Why Annual Pentests Fail", published April 22, 2026, updated August 11, 2026 https://linfordco.com/blog/why-annual-pentests-fail/ Accessed 12 Nov 2026. "How Often Should Penetration Testing Be Done? At a minimum, annually for compliance purposes. In practice, testing should align more closely with how often your environment changes." ===================================================================== 5. NIST SP 800-53, CA-8 ===================================================================== NIST OSCAL catalogue, SP 800-53 Rev 5.2.0 (metadata last-modified 2026-10-22) https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json Accessed 12 Nov 2026. CA-8 statement (parameters shown as placeholders in OSCAL): "Conduct penetration testing {{ insert: param, ca-08_odp.01 }} on {{ insert: param, ca-08_odp.02 }}." CA-8 guidance: "Risk assessments guide the decisions on the level of independence required for the personnel conducting penetration testing." CA-8(1) statement: "Employ an independent penetration testing agent or team to perform penetration testing on the system or system components." Same text with parameter labels, as rendered by FedRAMP (accessed 12 Nov 2026): https://www.fedramp.gov/2026/providers/rev5/controls/assessment-authorization-and-monitoring/ "Conduct penetration testing [Assignment: organization-defined frequency] on [Assignment: organization-defined system(s) or system components]." "Catalog version: 5.2.0 ... Catalog last modified: May 11, 2026" (FedRAMP's page; differs from the OSCAL metadata date above) "FedRAMP Guidance Penetration testing is part of vulnerability detection and is subject to the Vulnerability Detection and Response rules." ===================================================================== 6. FedRAMP ===================================================================== FedRAMP Penetration Test Guidance, Version 3, 06/30/2022 https://www.fedramp.gov/resources/documents/CSP_Penetration_Test_Guidance.pdf Accessed 12 Nov 2026. Section 7.0 Testing Schedule Requirements: "This initial penetration test must be performed no more than 6 months prior to the submission of the SAR. Once within the continuous monitoring phase of the FedRAMP process, additional penetration testing activities must be performed at least every 12 months, unless otherwise approved by an authorizing body with documented rationale." Not checked: whether this 2022 document is still in force under the FedRAMP 2026 rules. ===================================================================== 7. DORA ===================================================================== Regulation (EU) 2022/2554, consolidated text as served by EUR-Lex https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2554 Accessed 12 Nov 2026. Article 26(1): "Financial entities, other than entities referred to in Article 16(1), first subparagraph, and other than microenterprises, which are identified in accordance with paragraph 8, third subparagraph, of this Article, shall carry out at least every 3 years advanced testing by means of TLPT. Based on the risk profile of the financial entity and taking into account operational circumstances, the competent authority may, where necessary, request the financial entity to reduce or increase this frequency." Article 26(8): "Competent authorities shall identify financial entities that are required to perform TLPT taking into account the criteria set out in Article 4(2) ..." Article 24(6): "Financial entities, other than microenterprises, shall ensure, at least yearly, that appropriate tests are conducted on all ICT systems and applications supporting critical or important functions." Article 25(1): "... penetration testing." appears in the list of tests ("... source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing and penetration testing.")