Penetration Testing Requirements: What PCI DSS, DORA, NIS2 and GDPR Expect

Penetration testing requirements depend on the framework you answer to: PCI DSS v4.0.1 requirement 11.4 is the most explicit, with internal and external tests at least every 12 months and after significant changes, while DORA, NIS2 and GDPR ask for testing or assessment of security measures (under GDPR, as appropriate) but don’t require a pentest from every entity. Pentestica’s 25 certified senior pentesters (OSCP, OSCE, CISSP) use methods aligned with NIST SP 800-115, PTES and OWASP WSTG.

Which regulations require penetration testing?

PCI DSS requires penetration testing outright; DORA requires a testing program plus TLPT for financial entities named by TLPT authorities, NIS2 requires policies to assess whether security measures work, and GDPR asks, as appropriate, for regular testing. Our guide to GDPR penetration testing explains what Article 32 lists and what it leaves to your risk assessment. For US healthcare, see HIPAA penetration testing requirements: what the Security Rule asks for and where the proposed changes stand.

Framework	What it requires	How often	Source
PCI DSS v4.0.1, req. 11.4	Internal and external tests; segmentation tests if used	At least every 12 months and after significant changes. Service providers using segmentation: at least every six months	Pentest guidance, scoping guidance
DORA, Art. 24 to 27	Testing program, plus TLPT for named entities	TLPT generally at least every three years, with at least 12 weeks of active red team testing	DORA, RTS 2025/1190
NIS2, Art. 21	Policies to assess whether security measures work, plus risk-based tests for some digital providers	No fixed interval	NIS2, Regulation 2024/2690
GDPR, Art. 32(1)(d)	Regular testing of security measures, as appropriate	Regularly	GDPR

For penetration testing compliance, the report supports your assessor’s review; Pentestica doesn’t certify compliance. See also NIS2 penetration testing and threat-led penetration testing (TLPT). For how often each framework expects a test, see how often you should run a penetration test. For how a TLPT-style red team differs from a standard pentest, see red team vs penetration testing.

What are the PCI DSS penetration testing requirements?

Requirement 11.4 covers methodology, testing, remediation and segmentation. The PCI penetration testing requirements:

1. 11.4.1 Methodology: Industry-accepted approaches covering the entire CDE perimeter and critical systems, inside and out, with results kept at least 12 months.
2. 11.4.2 Internal: Internal penetration testing at least every 12 months and after significant changes.
3. 11.4.3 External: The same cadence for external penetration testing. You define what’s significant.
4. 11.4.4 Remediation: Exploitable findings are corrected based on risk, and PCI SSC guidance says the tester should retest to validate fixes.
5. 11.4.5 Segmentation: If segmentation isolates the CDE, test it at least every 12 months and after segmentation control changes.
6. 11.4.6 Service providers: Service providers that use segmentation test it at least every six months.

What are the major standards for penetration testing?

No single standard is mandatory; PCI DSS 11.4.1 asks for a documented methodology built on industry-accepted approaches, such as these:

Standard	What it covers
NIST SP 800-115	Planning, documented approval and rules of engagement
PTES	Seven stages, listed below
OWASP WSTG	Test cases for web application penetration testing
MITRE ATT&CK	Real-world attacker tactics and techniques

PTES splits a test into 7 stages:

1. Pre-engagement interactions: planning.
2. Intelligence gathering: reconnaissance.
3. Threat modeling: mapping likely attack paths.
4. Vulnerability analysis: finding weaknesses.
5. Exploitation: proving weaknesses are exploitable.
6. Post exploitation: gauging impact.
7. Reporting: findings and fixes.

What does a penetration test need to satisfy an auditor?

Five penetration test requirements help a test stand up to an audit: written scope, an independent tester, manual exploitation, evidence and a retest. A pentest checklist covering each phase of the test shows what your team prepares, from written authorization to cleanup.

• Written scope and rules of engagement: PCI SSC guidance expects rules agreed by both parties. Define your penetration test scope first.
• Independent, qualified tester: The same guidance calls for organizational separation from the target systems’ management and says certifications alone aren’t enough. Meet our certified senior pentesters, who have run 500+ penetration tests.
• Manual exploitation: A pentest proves what a scan only flags. See penetration testing vs vulnerability scanning.
• Evidence-based report: An Executive Summary plus Technical Report with exploitation evidence and step-by-step remediation (see our sample penetration test report).
• Retest: A retest is available after fixes.

Sources: PCI SSC Penetration Testing Guidance v1.1; PCI DSS v3.2.1 to v4.0 Summary of Changes; PCI DSS v4.0 SAQ C; PCI SSC Scoping and Segmentation Guidance v1.1; Regulation (EU) 2022/2554 (DORA); Delegated Regulation (EU) 2025/1190; Directive (EU) 2022/2555 (NIS2); Implementing Regulation (EU) 2024/2690; Regulation (EU) 2016/679 (GDPR); NIST SP 800-115; PTES; OWASP WSTG; MITRE ATT&CK.