ComplianceCompliance penetration testing
Compliance Penetration Testing for PCI DSS, SOC 2, HIPAA, ISO 27001, NIS2 and DORA
Compliance penetration testing is a manual, authorized attack on the systems a framework covers, documented so your auditor can use the report as evidence.
Key facts
- Price
- Quoted individually
- Scopes
- PCI DSS 11.4, SOC 2, HIPAA, ISO 27001
- Certification
- We test; we don’t certify compliance
- Contract
- NDA on request · professional indemnity insurance
Priced in tester-days NDA on request Retest available after fixes How the test works See a sample report
Pentestica runs it for organizations facing PCI DSS, SOC 2, HIPAA, ISO 27001, NIS2, DORA or GDPR reviews, with 25 certified senior pentesters.
What a compliance test covers
- PCI DSS 11.4 internal, external and segmentation tests
- Evidence for SOC 2, HIPAA and ISO 27001 audits
- Testing for NIS2 Article 21 and DORA programs
- Executive Summary and Technical Report for your auditor
Fixed scope, tester-days and price, agreed after a scoping call, before testing starts. Scoped and quoted per engagement. Priced in tester-days, no hidden fees.
We run manual penetration tests scoped to the systems your framework covers and deliver a report your auditor or supervisor can review as evidence. Which frameworks name a pentest, and how often, is covered in our guide to penetration testing requirements; this page covers the test itself.
A pentest doesn’t make you compliant, and we don’t certify compliance or issue SOC 2 reports: our report is evidence for your auditor or supervisor. Every test type we run is on our penetration testing services page.
Last updated: October 28, 2026
Key takeaways
- PCI DSS v4.0.1 (11.4) and DORA (Article 25) name penetration testing; for the others, test results are evidence that controls work.
- One test can serve several frameworks when the systems overlap.
- Compliance scopes are quoted individually, in tester-days after a scoping call.
- A retest is available after fixes.
NDA before testing
We sign an NDA before testing, and the scope and rules of engagement are agreed in writing.
Professional indemnity insurance
We carry professional indemnity insurance.
25 certified senior pentesters
OSCP, OSCE and CISSP certified testers with 500+ penetration tests behind them.
Retest after fixes
A retest is available after fixes. Whether it’s included depends on the engagement.
What is compliance penetration testing?
Compliance penetration testing is a manual penetration test scoped around the systems a framework covers, such as the cardholder data environment (CDE) under PCI DSS or systems holding electronic protected health information (ePHI) under HIPAA.
The attack work is a normal pentest; what changes is the scope and the documentation. In our tests we’ve found that the scope often covers the main application but leaves out subdomains, older APIs, admin panels or supporting systems. Attackers ignore audit boundaries, so we ask about these at scoping.
Know which framework and which systems?
Send the frameworks you answer to and the systems in scope, and get the test type, tester-days, timeline and a fixed price in writing. Prefer to compare first? See our prices.
How does a pentest support each framework?
What each framework says, and our evidence:
PCI DSS v4.0.1
Requirement 11.4 names penetration testing: internal (11.4.2), external (11.4.3) and, if you rely on segmentation, segmentation tests (11.4.5, with a separate cadence for service providers in 11.4.6). Intervals are in our guide to penetration testing frequency. Evidence: methodology, external and internal results, segmentation results and a retest.
SOC 2
SOC 2 is a CPA firm’s attestation. The AICPA Trust Services Criteria don’t mandate a pentest; auditors commonly accept one as evidence that controls are monitored and evaluated (CC4.1). Evidence: a dated report on in-scope systems, with findings and fixes. We don’t issue SOC 2 reports or attestations.
HIPAA Security Rule
The Security Rule doesn’t name penetration testing. 45 CFR 164.308 requires a risk analysis and a periodic technical and nontechnical evaluation. A January 2025 HHS proposal would add a pentest at least once every 12 months; as of October 2026 it remains a proposal and isn’t binding. Evidence: rated vulnerabilities in ePHI systems.
ISO/IEC 27001:2022
ISO/IEC 27001 doesn’t make penetration testing mandatory. A pentest most directly supports Annex A controls 8.8 (management of technical vulnerabilities) and 8.29 (security testing in development and acceptance), if your Statement of Applicability includes them. Evidence: rated findings for risk treatment. We don’t certify ISO 27001.
NIS2 Directive
Article 21(2)(f) requires “policies and procedures to assess the effectiveness of cybersecurity risk-management measures.” The articles don’t name penetration testing or set an interval. Evidence: documented scope, method and findings for points (e) and (f). See NIS2 penetration testing.
DORA
Articles 24 and 25 require a testing program that lists penetration testing, with yearly tests of systems supporting critical or important functions (microenterprises aside). Article 26 adds threat-led penetration testing for financial entities identified by their TLPT authority, generally at least every three years, and Article 27 sets requirements for the testers. Evidence: results for your testing program.
GDPR
Article 32(1)(d) lists, as appropriate, “a process for regularly testing, assessing and evaluating the effectiveness” of security measures. It doesn’t require a pentest. Evidence: dated results for systems processing personal data. Our GDPR penetration testing guide explains Article 32.
How is a compliance pentest different from a scan or an audit?
A pentest proves what an attacker can exploit; a scan lists possible weaknesses; an audit judges controls against the framework.
| Compliance penetration test | Vulnerability scan | Compliance audit | |
|---|---|---|---|
| What it shows | Exploitable weaknesses, with evidence | Known vulnerabilities, not confirmed | Whether controls meet the framework |
| How it’s done | Manually, by certified testers | Automated tooling | Document review, interviews, sampling |
| Output | Executive Summary and Technical Report | Scanner findings list | Audit opinion, report or certificate |
| Pentestica’s role | We run it | Not a substitute for a pentest | We don’t run compliance audits or certify |
How does a compliance penetration test run?
Scope from the framework
We start from the systems your framework covers, plus subdomains, legacy APIs and admin panels. Black, grey or white box, agreed per system.
Rules of engagement
Scope, exclusions and testing windows go into a signed document. We sign an NDA before testing.
Manual testing
Testing is aligned with OWASP WSTG, PTES and NIST SP 800-115: industry-accepted approaches, which PCI DSS 11.4.1 asks for.
Critical findings straight away
Confirmed critical issues go to your named contact during testing, without waiting for the final report, and they’re still documented in it.
Report on the systems in scope
Scope, dates and methodology come first, so your auditor can see which in-scope systems were tested and when.
Retest after fixes
A retest is available after fixes. We replay the original attack path and mark each finding fixed, partially fixed or still present.
What does your auditor get from the report?
An Executive Summary for management and a Technical Report for IT: scope, dates, methodology, and each finding with exploitation evidence and remediation. Retest results are added to the same report, so the auditor sees what was fixed.
How much does a compliance penetration test cost?
Compliance scopes are quoted individually, in tester-days after a scoping call, with no hidden fees. For reference, a standalone web application or API test runs $2,500–$5,500 and complex infrastructure or cloud $5,000–$12,000+. See penetration testing pricing or request a quote.
What can you check before you hire us?
Three things you can verify for yourself: what the report looks like, who does the testing, and how a real engagement went.
What does the report look like?
Every report opens with an executive summary for management, then one page per finding: severity and CVSS score, evidence of exploitation, business impact and step-by-step remediation. A retest is available after fixes, and the updated report shows which findings are closed. Browse our sample pentest report with every section explained.
Who tests your systems?
Senior pentesters from our team of 25, holding hands-on offensive security certifications such as OSCP and OSCE alongside CEH, CISA, CISM and CRISC.
Medical SaaS platform
A white box web application test with full source code access that found broken object level authorization and weak backup encryption.
Frequently asked questions
Will a penetration test make us compliant?
No. Compliance depends on all of a framework’s controls and governance. A pentest shows which technical controls held and what was fixed; we don’t certify compliance.
Do you issue SOC 2 reports?
No. Only a CPA firm issues a SOC 2 report. We test the systems in your SOC 2 scope, and your auditor can review our report as evidence.
Can one penetration test cover several frameworks?
Yes, when the systems overlap: a SaaS platform under SOC 2 and GDPR can share one test, and the same report goes to each auditor. For repeat cycles, see how often to run a penetration test.
Does the tester have to be independent?
For PCI DSS, yes: Requirement 11.4.1 calls for organizational independence of the tester, who doesn’t have to be a QSA or ASV. PCI SSC guidance describes a tester organizationally separate from the management of the target systems.
Fixed-price quote
Request a compliance penetration test
Tell us what to test. You get a written scope, the number of tester-days and a fixed price before any testing starts. No hidden fees.
See a sample report first (18-page PDF, no email required)
Compliance scopes are quoted in tester-days after a scoping call. For reference: web app or API from $2,500, infrastructure and cloud from $5,000. All prices
What happens after you send it
- Tell us what to test Send the frameworks you answer to (PCI DSS, SOC 2, HIPAA, ISO 27001, NIS2, DORA or GDPR), the systems in scope, your public domains and IP ranges, and your audit deadline.
- Get a written scope and price We reply by email with scoping questions or a fixed quote in tester-days.
- Test, report, retest Most tests take 1–3 weeks plus a few days for the report. Critical findings are reported during testing. Retesting after fixes is available.
- OSCP, OSCE and CISSP certified testers
- 500+ penetration tests
- Report built for your auditor’s review
- Executive summary and technical report